DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Red Hat Enterprise Linux: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2020-11-03
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um die Verfügbarkeit, Integrität und Vertraulichkeit zu gefährden.
01
beschreibt (17)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-14559US | high7.5 | — | ||
Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access. | ||||
| CVE-2020-14382US | high7.8 | — | ||
A vulnerability was found in upstream release cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that is effectively invoked on every device/image presenting it… | ||||
| CVE-2020-10759US | medium6.0 | Exploit | ||
A PGP signature bypass flaw was found in fwupd (all versions), which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possi… | ||||
| CVE-2019-20916US | high7.5 | — | ||
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as dem… | ||||
| CVE-2020-14928US | medium5.9 | — | ||
evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and eval… | ||||
| CVE-2020-10737US | medium6.3 | — | ||
A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/s… | ||||
| CVE-2020-11078US | medium6.8 | — | ||
In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden request… | ||||
| CVE-2020-12831US | medium5.3OT erhöht | — | ||
An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readab… | ||||
| CVE-2020-11736US | low3.9 | — | ||
fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a direc… | ||||
| CVE-2020-11653US | high7.5 | — | ||
An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROX… | ||||
| CVE-2019-20637US | high7.5 | — | ||
An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client requ… | ||||
| CVE-2019-20446US | medium6.5 | — | ||
In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pat… | ||||
| CVE-2019-15165US | medium5.3 | — | ||
sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. | ||||
| CVE-2019-13627US | medium6.3 | — | ||
It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.… | ||||
| CVE-2019-16680US | medium4.3 | — | ||
An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during e… | ||||
| CVE-2019-16167US | medium5.5 | — | ||
sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c. | ||||
| CVE-2019-15892US | high7.5 | — | ||
An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending craf… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- CentOS Security Advisory CESA-2020:5003 vom 2020-11-18external
- CentOS Security Advisory CESA-2020:5004 vom 2020-11-18external
- Oracle Linux Security Advisory ELSA-2020-5003 vom 2020-11-12external
- Oracle Linux Security Advisory ELSA-2022-5234 vom 2022-06-30external
- Red Hat Security Advisory RHSA-2020:4432 vom 2020-11-03external
- Red Hat Security Advisory RHSA-2020:4436 vom 2020-11-03external
- Red Hat Security Advisory RHSA-2020:4482 vom 2020-11-03external
- Red Hat Security Advisory RHSA-2020:4542 vom 2020-11-03external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan