Monthly Archive: September 2020

VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain a denial of service vulnerability due to an out-of-bounds write issue in Cortado ThinPrint component. A malicious actor with normal access to...

VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (JPEG2000 parser). A malicious actor with normal access to a virtual machine may be...

VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (EMR STRETCHDIBITS parser). A malicious actor with normal access to a virtual machine may...

VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability in Cortado ThinPrint component (EMF Parser). A malicious actor with normal access to a virtual machine may be...

VMware Fusion (11.x) contains a privilege escalation vulnerability due to the way it allows configuring the system wide path. An attacker with normal user privileges may exploit this issue to trick an admin user...

xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact....

gnuplot 5.5 is affected by double free when executing print_set_output. This may result in context-dependent arbitrary code execution. Date published : 2020-09-16 https://sourceforge.net/p/gnuplot/bugs/2312/

com_line() in command.c in gnuplot 5.4 leads to an out-of-bounds-write from strncpy() that may lead to arbitrary code execution. Date published : 2020-09-16 https://sourceforge.net/p/gnuplot/bugs/2303/

Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations, a different vulnerability than CVE-2020-25039. Date published : 2020-09-16 https://github.com/hpcng/singularity/security/advisories/GHSA-jv9c-w74q-6762 https://medium.com/sylabs

Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution. Date published : 2020-09-16 https://github.com/hpcng/singularity/security/advisories/GHSA-w6v2-qchm-grj7 https://medium.com/sylabs

A specific router allows changing the Wi-Fi password remotely. Genexis Platinum 4410 V2-1.28, a compact router generally used at homes and offices was found to be vulnerable to Broken Access Control and CSRF which...

** DISPUTED ** libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent arbitrary code execution. Note: this vulnerability occurs only if you compile the software in...

A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to context-dependent arbitrary code execution. Date published : 2020-09-16 https://security.gentoo.org/glsa/202010-05 https://github.com/LibRaw/LibRaw/issues/334

A DNS rebinding vulnerability in the Freebox OS web interface in Freebox Server before 4.2.3. Date published : 2020-09-16 Mise à jour du Freebox Server (Révolution/mini/One/Delta/Pop) 4.2.3 https://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/