CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2020-25829
https://notcve.org/view.php?id=CVE-2020-25829
An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cached records for a given name to be updated to the Bogus DNSSEC validation state, instead of their actual DNSSEC Secure state, via a DNS ANY query. This results in a denial of service for installation that always validate (dnssec=validate), and for clients requesting validation when on-demand validation is enabled (dnssec=process). Se ha encontrado un problema en PowerDNS Recursor versiones anteriores a 4.1.18, versiones 4.2.x anteriores a 4.2.5 y versiones 4.3.x anteriores a 4.3.5. Un atacante remoto puede causar que los registros en caché para un nombre dado sean actualizados al estado de comprobación de Bogus DNSSEC, en lugar de su estado DNSSEC Secure real, por medio de una consulta ANY de DNS. • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00036.html https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-07.html https://security.gentoo.org/glsa/202012-19 •
CVSS: 9.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-15229 – Path traversal and files overwrite with unsquashfs
https://notcve.org/view.php?id=CVE-2020-15229
Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability. Due to insecure handling of path traversal and the lack of path sanitization within `unsquashfs`, it is possible to overwrite/create any files on the host filesystem during the extraction with a crafted squashfs filesystem. The extraction occurs automatically for unprivileged (either installation or with `allow setuid = no`) run of Singularity when a user attempt to run an image which is a local SIF image or a single file containing a squashfs filesystem and is coming from remote sources `library://` or `shub://`. Image build is also impacted in a more serious way as it can be used by a root user, allowing an attacker to overwrite/create files leading to a system compromise, so far bootstrap methods `library`, `shub` and `localimage` are triggering the squashfs extraction. This issue is addressed in Singularity 3.6.4. • http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00070.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00071.html http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00009.html https://github.com/hpcng/singularity/blob/v3.6.4/CHANGELOG.md#security-related-fixes https://github.com/hpcng/singularity/commit/eba3dea260b117198fdb6faf41f2482ab2f8d53e https://github.com/hpcng/singularity/pull/5611 https://github.com/hpcng/singularity/security/advisories/GHSA-7gcp-w6ww-2xv9 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 1%CPEs: 6EXPL: 0CVE-2020-15986 – chromium-browser: Integer overflow in media
https://notcve.org/view.php?id=CVE-2020-15986
Integer overflow in media in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Un desbordamiento de enteros en media en Google Chrome anterior a versión 86.0.4240.75, permitía a un atacante remoto explotar potencialmente una corrupción de la pila por medio de una página HTML diseñada • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html https://crbug.com/1100247 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5P • CWE-190: Integer Overflow or Wraparound CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-15982 – chromium-browser: Side-channel information leakage in cache
https://notcve.org/view.php?id=CVE-2020-15982
Inappropriate implementation in cache in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Una implementación inapropiada en cache en Google Chrome anterior a versión 86.0.4240.75, permitía a un atacante remoto obtener información potencialmente confidencial de la memoria del proceso por medio de una página HTML diseñada • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html https://crbug.com/1039882 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5P •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2020-15980 – chromium-browser: Insufficient policy enforcement in Intents
https://notcve.org/view.php?id=CVE-2020-15980
Insufficient policy enforcement in Intents in Google Chrome on Android prior to 86.0.4240.75 allowed a local attacker to bypass navigation restrictions via crafted Intents. Una aplicación de políticas insuficiente en Intents en Google Chrome en Android anterior a versión 86.0.4240.75, permitía a un atacante local omitir las restricciones de navegación por medio de Intents diseñados • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html https://crbug.com/1092453 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5P •