From Red Hat Security Advisory 2020:2755 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2755 advisory.

  - nghttp2: overly large SETTINGS frames can lead to DoS     (CVE-2020-11080)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Description of changes:

docker-cli [19.03.11-4]
- added patch for registry list

[19.03.11-3]
- update to 19.03.11 for CVE-2020-13401

[19.03.1-1.0.0]
- update to 19.03.1

[19.03-0.0.1]
- update to 19.03

[18.09.1-1.0.6]
- disable kmem accounting for UEKR4

[18.09.1-1.0.5]
- apply e4931e664feac6fa8846f3f04268a0cc98822549, fixes CVE-2019-5736

[18.09.1-1.0.4]
- fix authentication error when using docker hub and using 
--default-registry

[18.09.1-1.0.3]
- fix authentication errors when using docker hub

[18.09-1.0.0]
- rename to docker-cli

[18.09-0.0.1]
- merge docker-engine.spec changes by Oracle into docker-ce-cli.spec from upstream 18.09 branch

docker-engine [19.03.11-4]
- added patch for registry list

[19.03.11-3]
- update to 19.03.11 for CVE-2020-13401

[19.03.1-1.0.0]
- update to 19.03.1

[19.03-0.0.1]
- update to 19.03

[18.09.1-1.0.6]
- disable kmem accounting for UEKR4

[18.09.1-1.0.5]
- apply e4931e664feac6fa8846f3f04268a0cc98822549, fixes CVE-2019-5736

[18.09.1-1.0.4]
- fix authentication error when using docker hub and using 
--default-registry

[18.09.1-1.0.3]
- fix authentication errors when using docker hub

[18.09.1-1.0.2]
- use epoch in container-selinux dependency

[18.09.1-1.0.1]
- fix 'docker cp doesn't work for btrfs' (OLM-158)
- update build to Go 1.10.8

[18.09.1-1.0.0]
- update to 18.09.1

[18.09-1.0.0]
- rename back to docker-engine, rename dockerd-ce to dockerd and stop using alternatives

[18.09-0.0.1]
- merge docker-engine.spec changes by Oracle into docker-ce.spec from upstream 18.09 branch

[18.03.1.ol-0.0.7]
- fix [orabug 28452214] and [orabug 28461404]

[18.03.1.ol-0.0.6]
- obsolete/provide the docker package [orabug 28216396]
- Fix docker plugin reference resolution [orabug 28376247]

[18.03.1.ol-1.0.4]
- Fixed issue where RPM overwrites config files

[17.12.0.ol-1.0.1]
- Update docker-engine package for upstream 17.12.0

[17.09.1.ol-1.0.2]
- Update docker-engine package for upstream 17.09.1

[17.06.2.ol-1.0.1]
- Update docker-engine package for upstream 17.06.2 [orabug 26673768]
- Migrate to new 'ol'-based versioning
- add docker-storage-config utility

[17.03.1-ce-3.0.1]
- Update docker-engine package for upstream 17.03.1
- Enable configuration of Docker daemon via sysconfig [orabug 21804877]
- Require UEK4 for docker 1.9 [orabug 22235639 22235645]
- Add docker.conf for prelink [orabug 25147708]
- Update oracle linux selinux policy to match upstream [orabug 25653794]
- Use dockerd instead of docker daemon as it is deprecated [orabug 25653794]

From Red Hat Security Advisory 2020:2664 :

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2664 advisory.

  - Kernel: vfio: access to disabled MMIO space of some     devices may lead to DoS scenario (CVE-2020-12888)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2663 :

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2663 advisory.

  - ntp: DoS on client ntpd using server mode packet     (CVE-2020-11868)

  - ntp: ntpd using highly predictable transmit timestamps     could result in time change or DoS (CVE-2020-13817)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2641 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2641 advisory.

  - grafana: SSRF incorrect access control vulnerability     allows unauthenticated users to make grafana send HTTP     requests to any URL (CVE-2020-13379)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2640 :

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2640 advisory.

  - unbound: amplification of an incoming query into a large     number of queries directed to a target (CVE-2020-12662)

  - unbound: infinite loop via malformed DNS answers     received from upstream servers (CVE-2020-12663)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2637 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2637 advisory.

  - gnutls: session resumption works without master key     allowing MITM (CVE-2020-13777)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2614 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2614 advisory.

  - Mozilla: Security downgrade with IMAP STARTTLS leads to     information leakage (CVE-2020-12398)

  - Mozilla: Use-after-free in SharedWorkerService     (CVE-2020-12405)

  - Mozilla: JavaScript Type confusion with NativeTypes     (CVE-2020-12406)

  - Mozilla: Memory safety bugs fixed in Firefox 77 and     Firefox ESR 68.9 (CVE-2020-12410)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2642 :

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2642 advisory.

  - unbound: incomplete fix for CVE-2020-12662 in RHEL7     (CVE-2020-10772)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Description of changes:

[4.14.35-1902.303.5.3.el7uek] - rds: Deregister all FRWR mr with free_mr (Hans Westgaard Ry) [Orabug: 31476202]
- Revert 'rds: Do not cancel RDMAs that have been posted to the HCA' (Gerd Rausch) [Orabug: 31475329]
- Revert 'rds: Introduce rds_conn_to_path helper' (Gerd Rausch) [Orabug: 31475329]
- Revert 'rds: Three cancel fixes' (Gerd Rausch) [Orabug: 31475318]

[4.14.35-1902.303.5.2.el7uek] - rds: Three cancel fixes (H&aring kon Bugge) [Orabug: 31463014]

[4.14.35-1902.303.5.1.el7uek] - x86/speculation: Add SRBDS vulnerability and mitigation documentation (Mark Gross) [Orabug: 31446720] {CVE-2020-0543} - x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Mark Gross) [Orabug: 31446720] {CVE-2020-0543} - x86/cpu: Add 'table' argument to cpu_matches() (Mark Gross) [Orabug: 31446720] {CVE-2020-0543}
- x86/cpu: Add a steppings field to struct x86_cpu_id (Mark Gross) [Orabug: 31446720] {CVE-2020-0543}

[4.14.35-1902.303.5.el7uek] - net/mlx5: Decrease default mr cache size (Artemy Kovalyov) [Orabug: 31446379]

As of 2020/06/22 this advisory has been retracted because it apparently does not fix any security problems relevant to already running systems.

From Red Hat Security Advisory 2020:2615 :

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2615 advisory.

  - Mozilla: Security downgrade with IMAP STARTTLS leads to     information leakage (CVE-2020-12398)

  - Mozilla: Use-after-free in SharedWorkerService     (CVE-2020-12405)

  - Mozilla: JavaScript Type confusion with NativeTypes     (CVE-2020-12406)

  - Mozilla: Memory safety bugs fixed in Firefox 77 and     Firefox ESR 68.9 (CVE-2020-12410)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2433 :

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2433 advisory.

  - hw: Special Register Buffer Data Sampling (SRBDS)     (CVE-2020-0543)

  - hw: Vector Register Data Sampling (CVE-2020-0548)

  - hw: L1D Cache Eviction Sampling (CVE-2020-0549)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2432 :

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2432 advisory.

  - hw: Special Register Buffer Data Sampling (SRBDS)     (CVE-2020-0543)

  - hw: Vector Register Data Sampling (CVE-2020-0548)

  - hw: L1D Cache Eviction Sampling (CVE-2020-0549)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2550 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2550 advisory.

  - libexif: several buffer over-reads in EXIF MakerNote     handling can lead to information disclosure and DoS     (CVE-2020-13112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2549 :

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2549 advisory.

  - libexif: several buffer over-reads in EXIF MakerNote     handling can lead to information disclosure and DoS     (CVE-2020-13112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2529 :

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2529 advisory.

  - tomcat: deserialization flaw in session persistence     storage leading to RCE (CVE-2020-9484)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2516 :

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2516 advisory.

  - libexif: several buffer over-reads in EXIF MakerNote     handling can lead to information disclosure and DoS     (CVE-2020-13112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Description of changes:

[4.1.12-124.39.5.1.el7uek]
- x86/speculation: Add Ivy Bridge to affected list (Josh Poimboeuf) [Orabug: 31352782] {CVE-2020-0543}
- x86/speculation: Add SRBDS vulnerability and mitigation documentation (Mark Gross) [Orabug: 31352782] {CVE-2020-0543}
- x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Mark Gross) [Orabug: 31352782] {CVE-2020-0543}
- x86/cpu: Add 'table' argument to cpu_matches() (Mark Gross) [Orabug: 31352782] {CVE-2020-0543}
- x86/cpu: Add a steppings field to struct x86_cpu_id (Mark Gross) [Orabug: 31352782] {CVE-2020-0543}
- x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping (Jia Zhang) [Orabug: 31352782] {CVE-2020-0543}

From Red Hat Security Advisory 2020:2530 :

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2530 advisory.

  - tomcat: deserialization flaw in session persistence     storage leading to RCE (CVE-2020-9484)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2450 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2450 advisory.

  - dotnet: Denial of service via untrusted input     (CVE-2020-1108)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2431 :

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2431 advisory.

  - hw: Special Register Buffer Data Sampling (SRBDS)     (CVE-2020-0543)

  - hw: Vector Register Data Sampling (CVE-2020-0548)

  - hw: L1D Cache Eviction Sampling (CVE-2020-0549)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2427 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2427 advisory.

  - kernel: use-after-free in block/bfq-iosched.c related to     bfq_idle_slice_timer_body (CVE-2020-12657)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2430 :

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2430 advisory.

  - kernel: NULL pointer dereference due to KEYCTL_READ on     negative key (CVE-2017-12192)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2250 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2250 advisory.

  - dotnet: Denial of service via untrusted input     (CVE-2020-1108)

  - dotnet: Denial of service due to infinite loop     (CVE-2020-1161)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux host is missing a security update for the Unbreakable Enterprise kernel package(s).

Description of changes:

[5.4.17-2011.3.2.1.el8uek]
- x86/speculation: Add Ivy Bridge to affected list (Josh Poimboeuf)  [Orabug: 31352779]  {CVE-2020-0543}
- x86/speculation: Add SRBDS vulnerability and mitigation documentation (Mark Gross)  [Orabug: 31352779]  {CVE-2020-0543}
- x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Mark Gross)  [Orabug: 31352779]  {CVE-2020-0543}
- x86/cpu: Add 'table' argument to cpu_matches() (Mark Gross)  [Orabug: 31352779]  {CVE-2020-0543}
- x86/cpu: Add a steppings field to struct x86_cpu_id (Mark Gross)  [Orabug: 31352779]  {CVE-2020-0543}
- x86/speculation/spectre_v2: Exclude Zhaoxin CPUs from SPECTRE_V2 (Tony W Wang-oc)  [Orabug: 31352779]  {CVE-2020-0543}

[5.4.17-2011.3.2.el8uek]
- USB: core: Fix free-while-in-use bug in the USB S-Glibrary (Alan Stern)  [Orabug: 31350962]  {CVE-2020-12464}
- mt76: fix array overflow on receiving too many fragments for a packet (Felix Fietkau)  [Orabug: 31350952]  {CVE-2020-12465}
- mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv() (Qing Xu)  [Orabug: 31350929]  {CVE-2020-12653}
- block, bfq: fix use-after-free in bfq_idle_slice_timer_body (Zhiqiang Liu)  [Orabug: 31350910]  {CVE-2020-12657}
- xsk: Add missing check on user-supplied headroom size (Magnus Karlsson)  [Orabug: 31350732]  {CVE-2020-12659}
- mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status() (Qing Xu)  [Orabug: 31350513]  {CVE-2020-12654}
- xen/manage: enable C_A_D to force reboot (Dongli Zhang)  [Orabug: 31387411]
- KVM: x86: Fixes posted interrupt check for IRQs delivery modes (Suravee Suthikulpanit)  [Orabug: 31316437]
- Revert 'Revert 'nvme_fc: add module to ops template to allow module references'' (James Smart)  [Orabug: 31377552]
- uek-rpm: Move grub boot menu update to posttrans stage. (Somasundaram Krishnasamy)  [Orabug: 31358097]
- KVM: SVM: Fix potential memory leak in svm_cpu_init() (Miaohe Lin)  [Orabug: 31350455]  {CVE-2020-12768}

[5.4.17-2011.3.1.el8uek]
- intel_idle: Use ACPI _CST for processor models without C-state tables (Rafael J. Wysocki)  [Orabug: 31332120]
- ACPI: processor: Export acpi_processor_evaluate_cst() (Rafael J. Wysocki)  [Orabug: 31332120]
- ACPI: processor: Clean up acpi_processor_evaluate_cst() (Rafael J. Wysocki)  [Orabug: 31332120]
- ACPI: processor: Introduce acpi_processor_evaluate_cst() (Rafael J. Wysocki)  [Orabug: 31332120]
- ACPI: processor: Export function to claim _CST control (Rafael J. Wysocki)  [Orabug: 31332120]
- rds: ib: Fix dysfunctional long address resolve timeout (H&aring kon Bugge)  [Orabug: 31302704]
- KVM: x86: Revert 'KVM: X86: Fix fpu state crash in kvm guest' (Sean Christopherson)  [Orabug: 31333676]
- KVM: x86: Ensure guest's FPU state is loaded when accessing for emulation (Sean Christopherson)  [Orabug: 31333676]
- KVM: x86: Handle TIF_NEED_FPU_LOAD in kvm_{load,put}_guest_fpu() (Sean Christopherson)  [Orabug: 31333676]
- net: dsa: Do not leave DSA master with NULL netdev_ops (Florian Fainelli)  [Orabug: 30456791]
- Revert 'dsa: disable module unloading for ARM64' (Allen Pais)  [Orabug: 30456791]

[5.4.17-2011.3.0.el8uek]
- NFSv4.0: nfs4_do_fsinfo() should not do implicit lease renewals (Robert Milkowski)  [Orabug: 31304406]
- NFSv4: try lease recovery on NFS4ERR_EXPIRED (Robert Milkowski)  [Orabug: 31304406]
- btrfs: Don't submit any btree write bio if the fs has errors (Qu Wenruo)  [Orabug: 31265336]  {CVE-2019-19377} {CVE-2019-19377}

From Red Hat Security Advisory 2020:2416 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2416 advisory.

  - unbound: amplification of an incoming query into a large     number of queries directed to a target (CVE-2020-12662)

  - unbound: infinite loop via malformed DNS answers     received from upstream servers (CVE-2020-12663)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2414 :

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2414 advisory.

  - unbound: amplification of an incoming query into a large     number of queries directed to a target (CVE-2020-12662)

  - unbound: infinite loop via malformed DNS answers     received from upstream servers (CVE-2020-12663)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Description of changes:

[2.6.39-400.323.1.el6uek]
- USB: adutux: fix use-after-free on disconnect (Johan Hovold) [Orabug: 31240297] {CVE-2019-19523}
- USB: core: Fix races in character device registration and deregistraion (Alan Stern) [Orabug: 31317669] {CVE-2019-19537}
- USB: iowarrior: fix use-after-free on disconnect (Johan Hovold) [Orabug: 31351064] {CVE-2019-19528}
- usb: iowarrior: fix deadlock on disconnect (Oliver Neukum) [Orabug: 31351064] {CVE-2019-19528}

[2.6.39-400.322.1.el6uek]
- ipvs: reset ipvs pointer in netns (Julian Anastasov) [Orabug: 31027196] - ipvs: prefer NETDEV_DOWN event to free cached dsts (Julian Anastasov) [Orabug: 31027196] - HID: hiddev: do cleanup in failure of opening a device (Hillf Danton) [Orabug: 31206362] {CVE-2019-19527}
- HID: hiddev: avoid opening a disconnected device (Hillf Danton) [Orabug: 31206362] {CVE-2019-19527}
- HID: Fix assumption that devices have inputs (Alan Stern) [Orabug: 31208624] {CVE-2019-19532}

Description of changes:

[2.6.39-400.322.1.el6uek]
- ipvs: reset ipvs pointer in netns (Julian Anastasov) [Orabug: 31027196] - ipvs: prefer NETDEV_DOWN event to free cached dsts (Julian Anastasov) [Orabug: 31027196] - HID: hiddev: do cleanup in failure of opening a device (Hillf Danton) [Orabug: 31206362] {CVE-2019-19527}
- HID: hiddev: avoid opening a disconnected device (Hillf Danton) [Orabug: 31206362] {CVE-2019-19527}
- HID: Fix assumption that devices have inputs (Alan Stern) [Orabug: 31208624] {CVE-2019-19532}

From Red Hat Security Advisory 2020:2407 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2407 advisory.

  - freerdp: Out-of-bounds write in crypto_rsa_common in     libfreerdp/crypto/crypto.c (CVE-2020-13398)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2406 :

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2406 advisory.

  - freerdp: Out-of-bounds write in crypto_rsa_common in     libfreerdp/crypto/crypto.c (CVE-2020-13398)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2405 :

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2405 advisory.

  - freerdp: Out-of-bounds write in crypto_rsa_common in     libfreerdp/crypto/crypto.c (CVE-2020-13398)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2381 :

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2381 advisory.

  - Mozilla: Use-after-free in SharedWorkerService     (CVE-2020-12405)

  - Mozilla: JavaScript Type confusion with NativeTypes     (CVE-2020-12406)

  - Mozilla: Memory safety bugs fixed in Firefox 77 and     Firefox ESR 68.9 (CVE-2020-12410)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2379 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2379 advisory.

  - Mozilla: Use-after-free in SharedWorkerService     (CVE-2020-12405)

  - Mozilla: JavaScript Type confusion with NativeTypes     (CVE-2020-12406)

  - Mozilla: Memory safety bugs fixed in Firefox 77 and     Firefox ESR 68.9 (CVE-2020-12410)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Description of changes:

[32:9.11.13-5]
- Limit number of queries triggered by a request (CVE-2020-8616)

[32:9.11.13-4]
- Fix invalid tsig request (CVE-2020-8617)

From Red Hat Security Advisory 2020:2336 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2336 advisory.

  - freerdp: Out-of-bounds write in planar.c     (CVE-2020-11521)

  - freerdp: Integer overflow in region.c (CVE-2020-11523)

  - freerdp: Out-of-bounds write in interleaved.c     (CVE-2020-11524)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Description of changes:

[4.1.12-124.39.5.el7uek]
- Input: ff-memless - kill timer in destroy() (Oliver Neukum)  [Orabug: 31213691]  {CVE-2019-19524}
- libertas: Fix two buffer overflows at parsing bss descriptor (Wen Huang)  [Orabug: 31351307]  {CVE-2019-14896} {CVE-2019-14897} {CVE-2019-14897}
- binfmt_elf: use ELF_ET_DYN_BASE only for PIE (Kees Cook)  [Orabug: 31352068]  {CVE-2017-1000370} {CVE-2017-1000371} {CVE-2017-1000370}
- NFSv4.0: Remove transport protocol name from non-UCS client ID (Chuck Lever)  [Orabug: 31357212]
- NFSv4.0: Remove cl_ipaddr from non-UCS client ID (Chuck Lever)  [Orabug: 31357212]
- xen/manage: enable C_A_D to force reboot (Dongli Zhang)  [Orabug: 31387466]

[4.1.12-124.39.4.el7uek]
- acpi: disable erst (Wengang Wang)  [Orabug: 31194253]
- mdio_bus: Fix use-after-free on device_register fails (YueHaibing)  [Orabug: 31222292]  {CVE-2019-12819}
- rds: ib: Fix dysfunctional long address resolve timeout (H&aring kon Bugge)  [Orabug: 31302708]
- vxlan: dont migrate permanent fdb entries during learn (Roopa Prabhu)  [Orabug: 31325318]
- USB: iowarrior: fix use-after-free on disconnect (Johan Hovold)  [Orabug: 31351061]  {CVE-2019-19528}
- usb: iowarrior: fix deadlock on disconnect (Oliver Neukum)  [Orabug: 31351061]  {CVE-2019-19528}
- mremap: properly flush TLB before releasing the page (Linus Torvalds)  [Orabug: 31352011]  {CVE-2018-18281}

[4.1.12-124.39.3.el7uek]
- Input: add safety guards to input_set_keycode() (Dmitry Torokhov)  [Orabug: 31200558]  {CVE-2019-20636}
- media: stv06xx: add missing descriptor sanity checks (Johan Hovold)  [Orabug: 31200579]  {CVE-2020-11609}
- media: ov519: add missing endpoint sanity checks (Johan Hovold)  [Orabug: 31213758]  {CVE-2020-11608}
- media: xirlink_cit: add missing descriptor sanity checks (Johan Hovold)  [Orabug: 31213767]  {CVE-2020-11668}
- mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring (Navid Emamdoost)  [Orabug: 31263147]  {CVE-2019-19057}
- USB: core: Fix races in character device registration and deregistraion (Alan Stern)  [Orabug: 31317667]  {CVE-2019-19537}

Description of changes:

kernel-uek [3.8.13-118.46.1.el7uek]
- ipv6: only static routes qualify for equal cost multipathing (Hannes Frederic Sowa) [Orabug: 30977687] {CVE-2013-4125}
- USB: adutux: fix use-after-free on disconnect (Johan Hovold) [Orabug: 31240296] {CVE-2019-19523}
- USB: core: Fix races in character device registration and deregistraion (Alan Stern) [Orabug: 31317668] {CVE-2019-19537}
- USB: iowarrior: fix use-after-free on disconnect (Johan Hovold) [Orabug: 31351063] {CVE-2019-19528}
- usb: iowarrior: fix deadlock on disconnect (Oliver Neukum) [Orabug: 31351063] {CVE-2019-19528}
- mremap: properly flush TLB before releasing the page (Linus Torvalds) [Orabug: 31352012] {CVE-2018-18281}

Description of changes:

[2.0.0-4.rc4]
- CVE-2020-11521: Fix out-of-bounds write in planar.c (#1837621)
- CVE-2020-11523: Fix integer overflow in region.c (#1837622)
- CVE-2020-11524: Fix out-of-bounds write in interleaved.c (#1837623)

From Red Hat Security Advisory 2020:2383 :

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2383 advisory.

  - bind: BIND does not sufficiently limit the number of     fetches performed when processing referrals     (CVE-2020-8616)

  - bind: A logic error in code which checks TSIG validity     can be used to trigger an assertion failure in tsig.c     (CVE-2020-8617)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2344 :

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2344 advisory.

  - bind: BIND does not sufficiently limit the number of     fetches performed when processing referrals     (CVE-2020-8616)

  - bind: A logic error in code which checks TSIG validity     can be used to trigger an assertion failure in tsig.c     (CVE-2020-8617)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Description of changes:

[1.8.3.1-23]
- Prevent crafted URL containing new lines, empty host or lacks a scheme    to cause credential leak.
   Resolves: CVE-2020-11008

Description of changes:

Description of changes: [5.4.17-2011.2.2.el8uek] - scsi: qla2xxx: Move free of fcport out of interrupt context (Joe Carnuccio) [Orabug: 31225231] - xfs: move inode flush to the sync workqueue (Darrick J. Wong) [Orabug: 31132665] - arm64: Kconfig: Enable NODES_SPAN_OTHER_NODES config for NUMA (Hoan Tran) [Orabug: 31049202] - scsi: bnx2fc: timeout calculation invalid for bnx2fc_eh_abort() (Laurence Oberman) [Orabug: 31207643] - jbd2: disable CONFIG_JBD2_DEBUG (Junxiao Bi) [Orabug: 31264694] [5.4.17-2011.2.1.el8uek] - x86/mce: Restart the system when LMCE UE error occurs (Thomas Tai) [Orabug: 31218859] - media: xirlink_cit: add missing descriptor sanity checks (Johan Hovold) [Orabug: 31213764] {CVE-2020-11668} - media: ov519: add missing endpoint sanity checks (Johan Hovold) [Orabug: 31213755] {CVE-2020-11608} - x86/microcode/AMD: Increase microcode PATCH_MAX_SIZE (John Allen) [Orabug: 31213533] - media: stv06xx: add missing descriptor sanity checks (Johan Hovold) [Orabug: 31200576] {CVE-2020-11609} - rds: Fix use-after-free in rds_ib_free_caches (Hans Westgaard Ry) [Orabug: 31200768] - net/rds: Fix MR reference counting problem (Ka-Cheong Poon) [Orabug: 31130194] - net/rds: Replace struct rds_mr's r_refcount with struct kref (Ka-Cheong Poon) [Orabug: 31130194] - ctf: discard CTF from the vDSO (Nick Alcock) [Orabug: 31194036] [5.4.17-2011.2.0.el8uek] - RDMA/rxe: Enhance Soft Roce to support Oracle proprietary shared PD extension (Rao Shoaib) [Orabug: 31094525] - mm: Avoid creating virtual address aliases in brk()/mmap()/mremap() (Catalin Marinas) [Orabug: 31053313] {CVE-2020-9391} - rds: Add debugfs for inc/frag cache statistics (Hans Westgaard Ry) [Orabug: 31137997] - rds: Add inc/frag cache statistics (Hans Westgaard Ry) [Orabug: 31137997] - rds: Control the CPU (de)allocating fragments (Hans Westgaard Ry) [Orabug: 31137997] 
- rds: Change caching strategy for receive buffers (Hans Westgaard Ry) [Orabug: 31137997] - rds: Add lockfree stack routines (Hans Westgaard Ry) [Orabug: 31137997] - net_sched: fix an OOB access in cls_tcindex (Cong Wang) [Orabug: 30871138] - vgacon: Fix a UAF in vgacon_invert_region (Zhang Xiaoxu) [Orabug: 31143943] {CVE-2020-8649} {CVE-2020-8647} {CVE-2020-8647} {CVE-2020-8649} {CVE-2020-8647}

From Red Hat Security Advisory 2020:2143 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2143 advisory.

  - dotnet: Denial of service via untrusted input     (CVE-2020-1108)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2102 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2102 advisory.

  - Kernel: NetLabel: null pointer dereference while     receiving CIPSO packet with null category may cause     kernel panic (CVE-2020-10711)

  - Kernel: s390: page table upgrade in secondary address     mode may lead to privilege escalation (CVE-2020-11884)

  - Kernel: kvm: nVMX: L2 guest may trick the L0 hypervisor     to access sensitive L1 resources (CVE-2020-2732)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2082 :

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2082 advisory.

  - kernel: double free may be caused by the function     allocate_trace_buffer in the file kernel/trace/trace.c     (CVE-2017-18595)

  - kernel: use-after-free in __blk_add_trace in     kernel/trace/blktrace.c (CVE-2019-19768)

  - Kernel: NetLabel: null pointer dereference while     receiving CIPSO packet with null category may cause     kernel panic (CVE-2020-10711)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:1926 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1926 advisory.

  - buildah: Crafted input tar file may lead to local file     overwrite during image build process (CVE-2020-10696)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2103 :

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2103 advisory.

  - Kernel: NetLabel: null pointer dereference while     receiving CIPSO packet with null category may cause     kernel panic (CVE-2020-10711)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2020:2070 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2070 advisory.

  - libreswan: DoS attack via malicious IKEv1 informational     exchange message (CVE-2020-1763)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
137871	Oracle Linux 8 : nghttp2 (ELSA-2020-2755)	High
137821	Oracle Linux 7 : docker-cli / docker-engine (ELSA-2020-5739)	High
137820	Oracle Linux 7 : kernel (ELSA-2020-2664)	Low
137819	Oracle Linux 7 : ntp (ELSA-2020-2663)	Medium
137771	Oracle Linux 8 : grafana (ELSA-2020-2641)	Medium
137770	Oracle Linux 6 : unbound (ELSA-2020-2640)	Medium
137769	Oracle Linux 8 : gnutls (ELSA-2020-2637)	Medium
137768	Oracle Linux 8 : thunderbird (ELSA-2020-2614)	High
137740	Oracle Linux 7 : unbound (ELSA-2020-2642)	High
137697	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5732) (deprecated)	High
137696	Oracle Linux 7 : thunderbird (ELSA-2020-2615)	High
137695	Oracle Linux 6 : microcode_ctl (ELSA-2020-2433)	Low
137694	Oracle Linux 7 : microcode_ctl (ELSA-2020-2432)	Low
137532	Oracle Linux 8 : libexif (ELSA-2020-2550)	Medium
137531	Oracle Linux 7 : libexif (ELSA-2020-2549)	Medium
137530	Oracle Linux 6 : tomcat6 (ELSA-2020-2529)	Medium
137529	Oracle Linux 6 : libexif (ELSA-2020-2516)	Medium
137388	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5722)	Low
137387	Oracle Linux 7 : tomcat (ELSA-2020-2530)	Medium
137386	Oracle Linux 8 : .NET / 3.1 / 8 / Core / Enterprise / Hat / Linux / Red / on (ELSA-2020-2450)	Medium
137385	Oracle Linux 8 : microcode_ctl (ELSA-2020-2431)	Low
137384	Oracle Linux 8 : kernel (ELSA-2020-2427)	Medium
137346	Oracle Linux 6 : kernel (ELSA-2020-2430)	Medium
137345	Oracle Linux 8 : dotnet3.1 (ELSA-2020-2250)	Medium
137291	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5715)	Critical
137290	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2020-5714)	High
137289	Oracle Linux 8 : unbound (ELSA-2020-2416)	Medium
137250	Oracle Linux 7 : unbound (ELSA-2020-2414)	Medium
137226	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2020-5710)	High
137225	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2020-5709)	High
137224	Oracle Linux 8 : freerdp (ELSA-2020-2407)	Medium
137223	Oracle Linux 6 : freerdp (ELSA-2020-2406)	Medium
137222	Oracle Linux 7 : freerdp (ELSA-2020-2405)	Medium
137221	Oracle Linux 7 : firefox (ELSA-2020-2381)	High
137220	Oracle Linux 8 : firefox (ELSA-2020-2379)	High
137219	Oracle Linux 8 : bind (ELSA-2020-2338)	Medium
137218	Oracle Linux 8 : freerdp (ELSA-2020-2336)	High
137173	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5708) (Stack Clash)	Critical
137172	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5706)	Medium
137171	Oracle Linux 7 : freerdp (ELSA-2020-2334)	High
137129	Oracle Linux 6 : bind (ELSA-2020-2383)	Medium
137037	Oracle Linux 7 : bind (ELSA-2020-2344)	Medium
136958	Oracle Linux 7 : git (ELSA-2020-2337)	Medium
136727	Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2020-5691)	Medium
136647	Oracle Linux 8 : .NET / Core (ELSA-2020-2143)	Medium
136646	Oracle Linux 8 : kernel (ELSA-2020-2102)	Medium
136645	Oracle Linux 7 : kernel (ELSA-2020-2082)	High
136644	Oracle Linux 8 : container-tools:1.0 (ELSA-2020-1926)	High
136602	Oracle Linux 6 : kernel (ELSA-2020-2103)	Medium
136601	Oracle Linux 8 : libreswan (ELSA-2020-2070)	Medium

Oracle Linux Local Security Checks Family for Nessus