Log

AVG-1879 edited at 19 May 2021 12:40:19
Affected
- 5.12.4.arch2-1
+ 5.12.5.arch1-1
AVG-1594 edited at 19 May 2021 12:37:12
Affected
- 5.12.4.arch2-1
+ 5.12.5.arch1-1
ASA-202105-15 edited at 19 May 2021 11:39:04
Impact
- A local attacker could load arbitrary locale files through path traversal using a crafted local identifier and execute arbitrary code.
+ A local attacker could load arbitrary locale files through path traversal using a crafted locale identifier and execute arbitrary code.
ASA-202105-14 edited at 19 May 2021 11:38:47
Impact
- A privileged remote attacker could cause the MariaDB to hang or crash.
+ A privileged remote attacker could cause the MariaDB server to hang or crash.
ASA-202105-9 edited at 19 May 2021 11:37:47
Impact
- A remote attacker with write access to a not can inject arbitrary JavaScript code that is executed through cross-site scripting when the note is viewed.
+ A remote attacker with write access to a note can inject arbitrary JavaScript code that is executed through cross-site scripting when the note is viewed.
ASA-202105-3 edited at 19 May 2021 11:36:33
Impact
- A remote attacker could obtain a user's access token using cross-site scripting, inject headers into requests to bypass CORS, crash the server using a craftedr request, or reuse old authentication keys.
+ A remote attacker could obtain a user's access token using cross-site scripting, inject headers into requests to bypass CORS, crash the server using a crafted request, or reuse old authentication keys.
AVG-1972 edited at 19 May 2021 11:32:58
Severity
- Unknown
+ High
CVE-2021-30465 edited at 19 May 2021 11:32:58
Severity
- Unknown
+ High
Remote
- Unknown
+ Local
Type
- Unknown
+ Sandbox escape
Description
+ runc 1.0.0-rc94 and earlier are vulnerable to a symlink exchange attack whereby an attacker can request a seemingly-innocuous container configuration that actually results in the host filesystem being bind-mounted into the container (allowing for a container escape).
+
+ An attacker must have the ability to start containers using some kind of custom volume configuration, and while recommended container hardening mechanisms such as LSMs (AppArmor/SELinux) and user namespaces will restrict the amount of damage an attacker could do, they do not block this attack outright.
+
+ runc 1.0.0-rc95 contains a fix for this issue.
References
+ https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-gh7r
+ https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f
Notes
AVG-1972 created at 19 May 2021 11:29:02
Packages
+ runc
Issues
+ CVE-2021-30465
Status
+ Vulnerable
Severity
+ Unknown
Affected
+ 1.0.0rc94-1
Fixed
Ticket
Advisory qualified
+ Yes
References
Notes
CVE-2021-30465 created at 19 May 2021 11:29:02
ASA-202105-15 edited at 19 May 2021 11:23:44
Impact
+ A local attacker could load arbitrary locale files through path traversal using a crafted local identifier and execute arbitrary code.
ASA-202105-15 created at 19 May 2021 11:23:00