Firefox is found to be vulnerable to the following:
CVE-2020-15675: Use-After-Free in WebGL.
CVE-2020-15677: Download origin spoofing via redirect.
CVE-2020-15676: XSS when pasting attacker-controlled data into a contenteditable element.
CVE-2020-15678: When recursing through layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free scenario.
CVE-2020-15673: Memory safety bugs fixed in Firefox 81.
CVE-2020-15674: Memory safety bugs fixed in Firefox 81.

Affected Versions:
versions prior to Firefox 81
QID Detection Logic (Authenticated)
This QID checks for vulnerable versions of Firefox browser.

An issue was found in Nagios XI ,there is a privilege escalation vulnerability in backend scripts that ran as root where some included files were editable by nagios user.

Affected versions:
Versions prior to 5.7.3

QID Detection Logic:(Authenticated)
It to check for vulnerable version of Nagios Core from version file.

It was discovered that Exim SpamAssassin does not properly handle configuration strings.

An attacker could possibly use this issue to execute arbitrary code. (CVE-2019-19920)

Affected Product:
Oracle Linux 8

Affected Product:
Oracle Linux 8

Affected Product:
SUSE Linux Enterprise Server 12-SP5

To install packages using the command line interface, use the command "yum update".

Refer to Suse security advisory SUSE-SU-2020:2687-1 to address this issue and obtain further details.

Affected Version:
Prior to Google Chrome 85.0.4183.121

QID Detection Logic:
This QID checks for vulnerable version of Google Chrome on Windows , MAC OS and Linux OS.

Affected Products:
SUSE Linux Enterprise Software Development Kit 12-SP5
SUSE Linux Enterprise Server 12-SP5

To install packages using the command line interface, use the command "yum update".

Refer to Suse security advisory SUSE-SU-2020:2673-1 to address this issue and obtain further details.

CVE-2020-13935:The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service. 1857024: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS

Affected Products:
SUSE Linux Enterprise Software Development Kit 12-SP5
SUSE Linux Enterprise Server for SAP 12-SP4
SUSE Linux Enterprise Server for SAP 12-SP3
SUSE Linux Enterprise Server for SAP 12-SP2
SUSE Linux Enterprise Server 12-SP5

To install packages using the command line interface, use the command "yum update".

Refer to Suse security advisory SUSE-SU-2020:2699-1 to address this issue and obtain further details.

Affected Products:
SUSE Linux Enterprise Server for SAP 12-SP4
SUSE Linux Enterprise Server for SAP 12-SP3
SUSE Linux Enterprise Server for SAP 12-SP2
SUSE Linux Enterprise Server 12-SP5

To install packages using the command line interface, use the command "yum update".

Refer to Suse security advisory SUSE-SU-2020:2661-1 to address this issue and obtain further details.

Affected Product:
SUSE Linux Enterprise Server for SAP 15

To install packages using the command line interface, use the command "yum update".

Refer to Suse security advisory SUSE-SU-2020:2645-1 to address this issue and obtain further details.

CVE-2020-9484:When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed. 1838332: CVE-2020-9484 tomcat: deserialization flaw in session persistence storage leading to RCE

CVE-2020-9484:When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed. 1838332: CVE-2020-9484 tomcat: deserialization flaw in session persistence storage leading to RCE

CVE-2020-10188:1811673: CVE-2020-10188 telnet-server: no bounds checks in nextitem() function allows to remotely execute arbitrary code utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions.

CVE-2019-18408:1769979: CVE-2019-18408 libarchive: use-after-free in archive_read_format_rar_read_data when there is an error in the decompression of an archive entry archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol.

Affected Product:
SUSE Linux Enterprise Server for SAP 12-SP3

To install packages using the command line interface, use the command "yum update".

Refer to Suse security advisory SUSE-SU-2020:2582-1 to address this issue and obtain further details.

FreeBSD has released a security update.
Affected version:
samba410 prior to 4.10.18
samba411 prior to 4.11.13
samba412 prior to 4.12.7

QID Detection Logic:(Authenticated)
It checks for versions of the packages to check for the vulnerable packages

It's Supported platform Apache Tomcat vulnerable to Remote Code Execution vulnerability via session persistence.

Affected Versions:
Apache Tomcat 10.0.0-M1 to 10.0.0-M4
Apache Tomcat 9.0.0.M1 to 9.0.34
Apache Tomcat 8.5.0 to 8.5.54
Apache Tomcat 7.0.0 to 7.0.103

QID Detection Logic (Unauthenticated):
The QID checks for vulnerable version by sending a GET /QUALYS13785 HTTP/1.0 request which helps in retrieving the installed version of Apache Tomcat in the banner of the response.

CVE-2020-5208:It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19. 1798721: CVE-2020-5208 ipmitool: Buffer overflow in read_fru_area_section function in lib/ipmi_fru.c

CVE-2020-8617:1836124: CVE-2020-8617 bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in tsig.c Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. Since BIND, by default, configures a local session key even on servers whose configuration does not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately exits. Prior to the introduction of the check the server would continue operating in an inconsistent state, with potentially harmful results.

CVE-2020-8616:1836118: CVE-2020-8616 bind: BIND does not sufficiently limit the number of fetches performed when processing referrals A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral. This has at least two potential effects: The performance of the recursing server can potentially be degraded by the additional work required to perform these fetches, and The attacker can exploit this behavior to use the recursing server as a reflector in a reflection attack with a high amplification factor.

It was discovered that StoreBackup did not properly manage lock files.

A local attacker could use this issue to cause a denial of service or escalate privileges and run arbitrary code. (CVE-2020-7040)

Affected Product:
SUSE Linux Enterprise Server for SAP 15

To install packages using the command line interface, use the command "yum update".

Refer to Suse security advisory SUSE-SU-2020:2610-1 to address this issue and obtain further details.

Affected Products:
openSUSE Leap 15.2
openSUSE Leap 15.1
openSUSE Backports SLE-15-SP2
openSUSE Backports SLE-15-SP1

To install packages using the command line interface, use the command "yum update".

Refer to SUSE security advisory openSUSE-SU-2020:1478-1 to address this issue and obtain further details.

Affected Products:
openSUSE Leap 15.2

To install packages using the command line interface, use the command "yum update".

Refer to SUSE security advisory openSUSE-SU-2020:1483-1 to address this issue and obtain further details.

Affected Versions:
VMware Fusion prior to 11.x

QID Detection Logic (Unauthenticated):
This QID checks for vulnerable versions of Fusion exe file.

Refer to VMware advisory VMSA-2020-0020 for updates.

Affected OS:
Fedora 32

For more information about the vulnerability and obtaining patches, refer to the following Fedora security advisories :
Fedora 32 Update

Affected OS:
Fedora 31

For more information about the vulnerability and obtaining patches, refer to the following Fedora security advisories :
Fedora 31 Update

Affected Products:
openSUSE Leap 15.2

To install packages using the command line interface, use the command "yum update".

Refer to SUSE security advisory openSUSE-SU-2020:1455-1 to address this issue and obtain further details.

Affected Versions:
Drupal 8.8.x, prior to Drupal 8.8.10.
Drupal 8.9.x, prior to Drupal 8.9.6.
Drupal 9.0.x, prior to Drupal 9.0.6.

QID Detection Logic:(Unauthenticated)
This QID checks for vulnerable version of Drupal installed on the target.

Affected OS:
Fedora 32

For more information about the vulnerability and obtaining patches, refer to the following Fedora security advisories :
Fedora 32 Update

Affected Version:
All versions prior to 5.9.9
QID Detection Logic:
The QID send a request, along with the payload and looks for a pattern in the response, in order to confirm the vulnerability.

McAfee Web Gateway Anti-Malware Engine, part of McAfee Web Protection, is a powerful in-line technology designed to protect against contemporary threats delivered via HTTP and HTTPS channels, taking web exploit detection, zero-day, and targeted threat prevention to the next level.

Affected Versions:
McAfee Web Gateway 9.x earlier than 9.2.3
McAfee Web Gateway 8.2.x earlier than 8.2.11
McAfee Web Gateway 7.8.x earlier than 7.8.2.23

QID Detection Logic :
This QID retrieves McAfee Web Gateway version and checks to see if it's vulnerable.

Affected Versions:
Drupal 7.x, prior to Drupal 7.73.
Drupal 8.8.x, prior to Drupal 8.8.10.
Drupal 8.9.x, prior to Drupal 8.9.6.
Drupal 9.0.x, prior to Drupal 9.0.6.

QID Detection Logic:(Unauthenticated)
This QID checks for vulnerable version of Drupal installed on the target.

Affected OS:
Fedora 32

For more information about the vulnerability and obtaining patches, refer to the following Fedora security advisories :
Fedora 32 Update

Affected Versions:
Ubuntu Linux 16.04
Ubuntu Linux 18.04

Affected Versions:
Ubuntu Linux 14.04

Note: QID 198030 is deprecated as ubuntu 14.04 ESM is not supported.

Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE A flaw was found in Apache httpd in versions 2.4.32 to 2.4.46. The uwsgi protocol does not serialize more than 16K of HTTP header leading to resource exhaustion and denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-11984 )

Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers. A flaw was found in Apache httpd in versions prior to 2.4.46. A specially crafted Cache-Digest header triggers negative argument to memmove() that could lead to a crash and denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-9490 )

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers. A flaw was found in Apache httpd in versions 2.4.20 to 2.4.43. Logging using the wrong pool by mod_http2 at debug/trace log level may lead to potential crashes and denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-11993 )

Affected Version:
Office for Mac 2019 prior to 16.41 (Build 20091302)
Office for Mac 2016 prior to 16.16.26 (20091400)
QID Detection Logic:
This authenticated QID checks the file versions from the Microsoft advisory with the versions on affected office system.

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-14579 )

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). (CVE-2020-14583 )

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). (CVE-2020-14577 )

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access

Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers. A flaw was found in Apache httpd in versions prior to 2.4.46. A specially crafted Cache-Digest header triggers negative argument to memmove() that could lead to a crash and denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-9490 )

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers. A flaw was found in Apache httpd in versions 2.4.20 to 2.4.43. Logging using the wrong pool by mod_http2 at debug/trace log level may lead to potential crashes and denial of service. The highest threat from this vulnerability is to system availability. (CVE-2020-11993 )

In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled. A flaw was found in dovecot. An attacker can use the way dovecot handles RPA (Remote Passphrase Authentication) to crash the authentication process repeatedly preventing login. The highest threat from this vulnerability is to system availability. (CVE-2020-12674 )

In Dovecot before 2.3.11.3, uncontrolled recursion in submission, lmtp, and lda allows remote attackers to cause a denial of service (resource consumption) via a crafted e-mail message with deeply nested MIME parts. A flaw was found in dovecot. A remote attacker could cause a denial of service by repeatedly sending emails containing MIME parts containing malicious content of which dovecot will attempt to parse. The highest threat from this vulnerability is to system availability. (CVE-2020-12100 )

In Dovecot before 2.3.11.3, sending a specially formatted NTLM request will crash the auth service because of an out-of-bounds read. A flaw was found in dovecot. An out-of-bounds read flaw was found in the way dovecot handled NTLM authentication allowing an attacker to crash the dovecot auth process repeatedly preventing login. The highest threat from this vulnerability is to system availability. (CVE-2020-12673 )

Affected Versions:
Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2012 Windows Server 2012 R2 Windows Server 2016 Windows Server 2019 Windows Server, version 1903 Windows Server, version 1909 Windows Server, version 2004

QID Detection Logic (unauthenticated):
This remote detection sends "NetrServerAuthenticate" payload with client credential all 0 to detect the vulnerability.

QID Detection Logic (authenticated):
The QID checks for the registry key to check if Cisco Jabber for Windows is installed on the system or not and if it is a EOL version.

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-14579 )

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). (CVE-2020-14583 )

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). (CVE-2020-14577 )

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unaut

Security Fix(es): chromium-browser: Use after free in video (CVE-2020-6573)
chromium-browser: Insufficient policy enforcement in installer (CVE-2020-6574)
chromium-browser: Race in Mojo (CVE-2020-6575)
chromium-browser: Use after free in offscreen canvas (CVE-2020-6576)
chromium-browser: Insufficient policy enforcement in networking (CVE-2020-15959)

Affected Products:

Red Hat Enterprise Linux Server 6 x86_64
Red Hat Enterprise Linux Server 6 i386
Red Hat Enterprise Linux Workstation 6 x86_64
Red Hat Enterprise Linux Workstation 6 i386
Red Hat Enterprise Linux Desktop 6 x86_64
Red Hat Enterprise Linux Desktop 6 i386
Red Hat Enterprise Linux for Scientific Computing 6 x86_64

Refer to Red Hat security advisory RHSA-2020:3740 to address this issue and obtain more information.

Security Fix(es): librepo: missing path validation in repomd.xml may lead to directory traversal (CVE-2020-14352)

Affected Products:

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1 x86_64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1 s390x
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1 ppc64le
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1 aarch64
Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.1 ppc64le
Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.1 x86_64

Refer to Red Hat security advisory RHSA-2020:3749 to address this issue and obtain more information.

Affected Products:
openSUSE Leap 15.2

To install packages using the command line interface, use the command "yum update".

Refer to SUSE security advisory openSUSE-SU-2020:1302-1 to address this issue and obtain further details.

Affected Products:
openSUSE Leap 15.1

To install packages using the command line interface, use the command "yum update".

Refer to SUSE security advisory openSUSE-SU-2020:1279-1 to address this issue and obtain further details.

Fixed a vulnerability in the ARJ archive-parsing module in ClamAV 0.102.3 that could cause a denial-of-service (DoS) condition. Improper bounds checking resulted in an out-of-bounds read that could cause a crash. The previous fix for this CVE in version 0.102.3 was incomplete. This fix correctly resolves the issue. (CVE-2020-3327 )

Fixed a vulnerability a malicious user could exploit to replace a scan target directory with a symlink to another path to trick clamscan, clamdscan, or clamonacc into removing or moving a different file (such as a critical system file). The issue would affect users that use the --move or --remove options for clamscan, clamdscan and clamonacc. (CVE-2020-3350 )

Fixed a vulnerability in the EGG archive module in ClamAV 0.102.0 - 0.102.3 that could cause a denial-of-service (DoS) condition. Improper error handling could cause a crash due to a NULL pointer dereference. This vulnerability is mitigated for those using the official ClamAV signature databases because the file type signatures in daily.cvd will not enable the EGG archive parser in affected versions. (CVE-2020-3481 )

Affected Products:

centos 7

Security Fix(es): httpd: Push diary crash on specifically crafted HTTP/2 header (CVE-2020-9490)

Affected Products:

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1 x86_64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1 s390x
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1 ppc64le
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1 aarch64
Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.1 ppc64le
Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.1 x86_64

Refer to Red Hat security advisory RHSA-2020:3726 to address this issue and obtain more information.

Security Fix(es): jbossweb: Incomplete fix of CVE-2020-13935 for WebSocket in JBossWeb could lead to DoS (CVE-2020-14384)

Affected Products:

JBoss Enterprise Application Platform 6.4 for RHEL 7 x86_64
JBoss Enterprise Application Platform 6.4 for RHEL 7 ppc64
JBoss Enterprise Application Platform 6.4 for RHEL 6 x86_64
JBoss Enterprise Application Platform 6.4 for RHEL 6 ppc64
JBoss Enterprise Application Platform 6.4 for RHEL 6 i386
JBoss Enterprise Application Platform 6.4 for RHEL 5 x86_64
JBoss Enterprise Application Platform 6.4 for RHEL 5 i386
JBoss Enterprise Application Platform 6 for RHEL 7 x86_64
JBoss Enterprise Application Platform 6 for RHEL 7 ppc64
JBoss Enterprise Application Platform 6 for RHEL 6 x86_64
JBoss Enterprise Application Platform 6 for RHEL 6 ppc64
JBoss Enterprise Application Platform 6 for RHEL 6 i386
JBoss Enterprise Application Platform 6 for RHEL 5 x86_64
JBoss Enterprise Application Platform 6 for RHEL 5 i386

Refer to Red Hat security advisory RHSA-2020:3730 to address this issue and obtain more information.

Security Fix(es): httpd: Push diary crash on specifically crafted HTTP/2 header (CVE-2020-9490)

Affected Products:

Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.7 x86_64
Red Hat Software Collections (for RHEL Server for System Z) 1 for RHEL 7.7 s390x
Red Hat Software Collections (for RHEL Server for IBM Power LE) 1 for RHEL 7.7 ppc64le
Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.6 x86_64
Red Hat Software Collections (for RHEL Server for System Z) 1 for RHEL 7.6 s390x
Red Hat Software Collections (for RHEL Server for IBM Power LE) 1 for RHEL 7.6 ppc64le
Red Hat Software Collections (for RHEL Server) 1 for RHEL 7 x86_64
Red Hat Software Collections (for RHEL Server for System Z) 1 for RHEL 7 s390x
Red Hat Software Collections (for RHEL Server for IBM Power LE) 1 for RHEL 7 ppc64le
Red Hat Software Collections (for RHEL Server for ARM) 1 aarch64
Red Hat Software Collections (for RHEL Server) 1 for RHEL 6 x86_64
Red Hat Software Collections (for RHEL Workstation) 1 for RHEL 7 x86_64
Red Hat Software Collections (for RHEL Workstation) 1 for RHEL 6 x86_64

Refer to Red Hat security advisory RHSA-2020:3733 to address this issue and obtain more information.

Security Fix(es): dovecot: Resource exhaustion via deeply nested MIME parts (CVE-2020-12100)
dovecot: Out of bound reads in dovecot NTLM implementation (CVE-2020-12673)
dovecot: Crash due to assert in RPA implementation (CVE-2020-12674)

Affected Products:

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1 x86_64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1 s390x
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1 ppc64le
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1 aarch64
Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.1 ppc64le
Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.1 x86_64
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.1 x86_64
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.1 ppc64le
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 8.1 s390x
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.1 aarch64

Refer to Red Hat security advisory RHSA-2020:3736 to address this issue and obtain more information.

Affected Products:
openSUSE Leap 15.2

To install packages using the command line interface, use the command "yum update".

Refer to SUSE security advisory openSUSE-SU-2020:1313-1 to address this issue and obtain further details.

Security Fix(es): mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2020-14663, CVE-2020-14678, CVE-2020-14697, CVE-2020-2761, CVE-2020-2774, CVE-2020-2779, CVE-2020-2853, CVE-2020-14586, CVE-2020-14702)
mysql: Server: Security: Encryption multiple unspecified vulnerabilities (CVE-2019-2914, CVE-2019-2957)
mysql: InnoDB multiple unspecified vulnerabilities (CVE-2019-2938, CVE-2019-2963, CVE-2019-2968, CVE-2019-3018, CVE-2020-2577, CVE-2020-2589, CVE-2020-2760, CVE-2020-2762, CVE-2020-2814, CVE-2020-2893, CVE-2020-2895, CVE-2020-14568, CVE-2020-14623, CVE-2020-14633, CVE-2020-14634)
mysql: Server: PS multiple unspecified vulnerabilities (CVE-2019-2946, CVE-2020-2925)
mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2019-2960, CVE-2020-2759, CVE-2020-2763, CVE-2020-14567)
mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2019-2966, CVE-2019-2967, CVE-2019-2974, CVE-2019-2982, CVE-2019-2991, CVE-2019-2998, CVE-2020-2579, CVE-2020-2660, CVE-2020-2679, CVE-2020-2686, CVE-2020-2765, CVE-2020-2892, CVE-2020-2897, CVE-2020-2901, CVE-2020-2904, CVE-2020-2923, CVE-2020-2924, CVE-2020-2928, CVE-2020-14539, CVE-2020-14547, CVE-2020-14597, CVE-2020-14614, CVE-2020-14654, CVE-2020-14680, CVE-2020-14725)
mysql: Server: C API multiple unspecified vulnerabilities (CVE-2019-2993, CVE-2019-3011)
mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2019-2997, CVE-2020-2580)
mysql: Server: Parser multiple unspecified vulnerabilities (CVE-2019-3004, CVE-2020-2627, CVE-2020-2930, CVE-2020-14619)
mysql: Server: Connection unspecified vulnerability (CVE-2019-3009)
mysql: Server: Options multiple unspecified vulnerabilities (CVE-2020-2584, CVE-2020-14632)
mysql: Server: DML multiple unspecified vulnerabilities (CVE-2020-2588, CVE-2020-2780, CVE-2020-14540, CVE-2020-14575, CVE-2020-14620)
mysql: C API multiple unspecified vulnerabilities (CVE-2020-2752, CVE-2020-2922, CVE-2020-14550, CVE-2020-2570, CVE-2020-2573, CVE-2020-2574)
mysql: Server

Affected Products:

Red Hat Enterprise Linux for x86_64 8 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2 x86_64
Red Hat Enterprise Linux Server - AUS 8.2 x86_64
Red Hat Enterprise Linux for IBM z Systems 8 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.2 s390x
Red Hat Enterprise Linux for Power, little endian 8 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.2 ppc64le
Red Hat Enterprise Linux Server - TUS 8.2 x86_64
Red Hat Enterprise Linux for ARM 64 8 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.2 aarch64
Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.2 ppc64le
Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.2 x86_64

Refer to Red Hat security advisory RHSA-2020:3732 to address this issue and obtain more information.

Security Fix(es): mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2020-14663, CVE-2020-14678, CVE-2020-14697, CVE-2020-2761, CVE-2020-2774, CVE-2020-2779, CVE-2020-2853, CVE-2020-14586, CVE-2020-14702)
mysql: Server: Security: Encryption multiple unspecified vulnerabilities (CVE-2019-2914, CVE-2019-2957)
mysql: InnoDB multiple unspecified vulnerabilities (CVE-2019-2938, CVE-2019-2963, CVE-2019-2968, CVE-2019-3018, CVE-2020-2577, CVE-2020-2589, CVE-2020-2760, CVE-2020-2762, CVE-2020-2814, CVE-2020-2893, CVE-2020-2895, CVE-2020-14568, CVE-2020-14623, CVE-2020-14633, CVE-2020-14634)
mysql: Server: PS multiple unspecified vulnerabilities (CVE-2019-2946, CVE-2020-2925)
mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2019-2960, CVE-2020-2759, CVE-2020-2763, CVE-2020-14567)
mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2019-2966, CVE-2019-2967, CVE-2019-2974, CVE-2019-2982, CVE-2019-2991, CVE-2019-2998, CVE-2020-2579, CVE-2020-2660, CVE-2020-2679, CVE-2020-2686, CVE-2020-2765, CVE-2020-2892, CVE-2020-2897, CVE-2020-2901, CVE-2020-2904, CVE-2020-2923, CVE-2020-2924, CVE-2020-2928, CVE-2020-14539, CVE-2020-14547, CVE-2020-14597, CVE-2020-14614, CVE-2020-14654, CVE-2020-14680, CVE-2020-14725)
mysql: Server: C API multiple unspecified vulnerabilities (CVE-2019-2993, CVE-2019-3011)
mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2019-2997, CVE-2020-2580)
mysql: Server: Parser multiple unspecified vulnerabilities (CVE-2019-3004, CVE-2020-2627, CVE-2020-2930, CVE-2020-14619)
mysql: Server: Connection unspecified vulnerability (CVE-2019-3009)
mysql: Server: Options multiple unspecified vulnerabilities (CVE-2020-2584, CVE-2020-14632)
mysql: Server: DML multiple unspecified vulnerabilities (CVE-2020-2588, CVE-2020-2780, CVE-2020-14540, CVE-2020-14575, CVE-2020-14620)
mysql: C API multiple unspecified vulnerabilities (CVE-2020-2752, CVE-2020-2922, CVE-2020-14550, CVE-2020-2570, CVE-2020-2573, CVE-2020-2574)
mysql: Server

Affected Products:

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1 x86_64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1 s390x
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1 ppc64le
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1 aarch64
Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.1 ppc64le
Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.1 x86_64

Refer to Red Hat security advisory RHSA-2020:3757 to address this issue and obtain more information.

Affected Version:
Lenovo System Update prior to version 5.07.0106

QID Detection Logic (authenticated):
This QID looks for the vulnerable version of Lenovo System Update (SUService.exe).

Security Fix(es): Soft reboot after live-migration reverts instance to original source domain XML (CVE-2020-17376)

Affected Products:

Red Hat OpenStack 16.1 x86_64
Red Hat OpenStack for IBM Power 16.1 ppc64le

Refer to Red Hat security advisory RHSA-2020:3702 to address this issue and obtain more information.

Security Fix(es): Soft reboot after live-migration reverts instance to original source domain XML (CVE-2020-17376)

Affected Products:

Red Hat OpenStack 16 for RHEL 8 x86_64
Red Hat OpenStack for IBM Power 16 ppc64le

Refer to Red Hat security advisory RHSA-2020:3704 to address this issue and obtain more information.

Security Fix(es): Soft reboot after live-migration reverts instance to original source domain XML (CVE-2020-17376)

Affected Products:

Red Hat OpenStack 15 x86_64
Red Hat OpenStack for IBM Power 15 ppc64le

Refer to Red Hat security advisory RHSA-2020:3706 to address this issue and obtain more information.

Security Fix(es): Soft reboot after live-migration reverts instance to original source domain XML (CVE-2020-17376)

Affected Products:

Red Hat OpenStack 13 x86_64
Red Hat OpenStack for IBM Power 13 ppc64le

Refer to Red Hat security advisory RHSA-2020:3708 to address this issue and obtain more information.

Security Fix(es): httpd: Push diary crash on specifically crafted HTTP/2 header (CVE-2020-9490)

Affected Products:

Red Hat Enterprise Linux for x86_64 8 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2 x86_64
Red Hat Enterprise Linux Server - AUS 8.2 x86_64
Red Hat Enterprise Linux for IBM z Systems 8 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.2 s390x
Red Hat Enterprise Linux for Power, little endian 8 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.2 ppc64le
Red Hat Enterprise Linux Server - TUS 8.2 x86_64
Red Hat Enterprise Linux for ARM 64 8 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.2 aarch64
Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.2 ppc64le
Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.2 x86_64

Refer to Red Hat security advisory RHSA-2020:3714 to address this issue and obtain more information.

The McAfee Agent is the distributed component of McAfee ePolicy Orchestrator (McAfee ePO).
It downloads and enforces policies, and executes client-side tasks such as deployment and updating. McAfee Agent is affected with following vulnerability: CVE-2020-7311 : Privilege Escalation vulnerability CVE-2020-7312 : DLL Search Order Hijacking Vulnerability in the installer in McAfee Agent (MA) CVE-2020-7315 : DLL Injection Vulnerability

Affected Software:
McAfee Agent: 5.6.x prior to 5.6.6 5.5.x prior to 5.6.6

Detection Logic:
The QID checks for vulnerable version of McAfee Agent by checking the version of masvc.exe file.

Affected Products:

centos 7

Affected Products:

centos 6

QID detection logic:
The QID checks for Cisco SD WAN version retrieved via Unix Auth using "show system status" command.

Affected Products
SD-WAN vManage Software prior to 18.4.5 , 19.2.x prior to 19.2.2, 19.3.x and greater prior to 20.1.1

Customers are advised to refer to cisco-sa-uabvman-SYGzt8Bv for more information.

QID detection logic:
The QID checks for Cisco SD WAN version retrieved via Unix Auth using "show system status" command.

Affected Products
SD-WAN vManage Software prior to 18.3.x prior to 18.4.5,19.2.x prior to 19.2.3,19.3.x prior to 20.1.1
SD-WAN vEdge 100-M series router prior to 18.3.x prior to 18.4.5,19.2.x prior to 19.2.3,19.3.x prior to 20.1.1

Customers are advised to refer to cisco-sa-sdbufof-h5f5VSeL for more information.

The vulnerability is due to a failure to properly validate certain parameters included within the error reporting application configuration. An attacker could exploit this vulnerability by sending a crafted command to the error reporting feature.

QID detection logic:
The QID checks for Cisco SD WAN version retrieved via Unix Auth using "show system status" command.

Affected Products
SD-WAN vManage Software prior to 18.3.0
SD-WAN vEdge 100-M series router prior to 18.3.0

Customers are advised to refer to cisco-sa-20180905-sd-wan-escalation for more information.

QID detection logic:
The QID checks for Cisco SD WAN version retrieved via Unix Auth using "show system status" command.

Affected Products
SD-WAN vManage Software prior to 17.2.7,18.x prior to 18.3.0
SD-WAN vEdge 100-M series router prior to 17.2.7, 18.x prior to 18.3.0

Customers are advised to refer to cisco-sa-sdw-dos-KWOdyHnB for more information.

The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI utility.The attacker must be authenticated to access the CLI utility.

QID detection logic:
The QID checks for Cisco SD WAN version retrieved via Unix Auth using "show system status" command.

Affected Products
SD-WAN vManage Software prior to Release 18.3.0
SD-WAN vEdge 100-M series router prior to Release 18.3.0

Customers are advised to refer to cisco-sa-20180905-sd-wan-injection for more information.

QID detection logic:
The QID checks for Cisco SD WAN version retrieved via Unix Auth using "show system status" command.

Affected Products:
SD-WAN vManage Software prior to 18.3.6,18.4.x prior to 18.4.1,19.0 prior to 19.1.0
SD-WAN vEdge 100-M series router prior to 18.3.6,18.4.x prior to 18.4.1,19.0 prior to 19.1.0

Customers are advised to refer to cisco-sa-20190619-sdwan-privesca for more information.

Vulnerable Component: BIG-IP ASM, APM,LTM

Affected Versions:
15.1.0
15.0.0 - 15.0.1
14.1.0 - 14.1.2

QID Detection Logic(Authenticated):
This QID checks for the vulnerable versions of F5 BIG-IP devices using the tmsh command.

Affected Products:
openSUSE Leap 15.2

To install packages using the command line interface, use the command "yum update".

Refer to SUSE security advisory openSUSE-SU-2020:1407-1 to address this issue and obtain further details.

Affected Versions:
PAN-OS 8.0 all versions
PAN-OS 8.1 versions earlier than PAN-OS 8.1.16
QID Detection Logic (Authenticated):
This QID looks for the vulnerable version of PAN-OS via XML API.

NOTE: This issue is applicable only where either Captive Portal is enabled or Multi-Factor Authentication (MFA) is configured.

Refer to PAN-151978 for more information about patching this vulnerability.

The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device.

QID detection logic:
The QID checks for Cisco SD WAN version retrieved via Unix Auth using "show system status" command.

Affected Products
SD-WAN vManage Software prior to Release 18.3.0
SD-WAN vEdge 100-M series router prior to Release 18.3.0

Customers are advised to refer to cisco-sa-20180905-sd-wan-validation for more information.

Vulnerable Component: BIG-IP ASM, APM,LTM

Affected Versions:
13.0.0
12.1.0 - 12.1.2 HF1
11.6.1 - 11.6.2

QID Detection Logic(Authenticated):
This QID checks for the vulnerable versions of F5 BIG-IP devices using the tmsh command.

Affected Versions:
PAN-OS 10.0 versions earlier than PAN-OS 10.0.1

Refer to PAN-145797, PAN-150409 for more information about patching this vulnerability.

Affected Products:
openSUSE Leap 15.2

To install packages using the command line interface, use the command "yum update".

Refer to SUSE security advisory openSUSE-SU-2020:1369-1 to address this issue and obtain further details.

Affected Products:
openSUSE Leap 15.1

To install packages using the command line interface, use the command "yum update".

Refer to SUSE security advisory openSUSE-SU-2020:1346-1 to address this issue and obtain further details.

Security Fix(es): Mozilla: Attacker-induced prompt for extension installation (CVE-2020-15664)
Mozilla: Use-After-Free when aborting an operation (CVE-2020-15669)

Affected Products:

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1 x86_64
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1 ppc64le
Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.1 ppc64le
Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.1 x86_64

Refer to Red Hat security advisory RHSA-2020:3632 to address this issue and obtain more information.

Security Fix(es): Soft reboot after live-migration reverts instance to original source domain XML (CVE-2020-17376)

Affected Products:

Red Hat OpenStack 10 x86_64

Refer to Red Hat security advisory RHSA-2020:3711 to address this issue and obtain more information.

Affected Products:
openSUSE Leap 15.2

To install packages using the command line interface, use the command "yum update".

Refer to SUSE security advisory openSUSE-SU-2020:1376-1 to address this issue and obtain further details.

Affected Products:
openSUSE Leap 15.1

To install packages using the command line interface, use the command "yum update".

Refer to SUSE security advisory openSUSE-SU-2020:1374-1 to address this issue and obtain further details.

Security Fix(es): dovecot: Resource exhaustion via deeply nested MIME parts (CVE-2020-12100)
dovecot: Out of bound reads in dovecot NTLM implementation (CVE-2020-12673)
dovecot: Crash due to assert in RPA implementation (CVE-2020-12674)

Affected Products:

Red Hat Enterprise Linux for x86_64 8 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2 x86_64
Red Hat Enterprise Linux Server - AUS 8.2 x86_64
Red Hat Enterprise Linux for IBM z Systems 8 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.2 s390x
Red Hat Enterprise Linux for Power, little endian 8 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.2 ppc64le
Red Hat Enterprise Linux Server - TUS 8.2 x86_64
Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.2 ppc64le
Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.2 x86_64

Refer to Red Hat security advisory RHSA-2020:3713 to address this issue and obtain more information.

Affected Products:
openSUSE Leap 15.1

To install packages using the command line interface, use the command "yum update".

Refer to SUSE security advisory openSUSE-SU-2020:1405-1 to address this issue and obtain further details.

Affected Products:
openSUSE Leap 15.2

To install packages using the command line interface, use the command "yum update".

Refer to SUSE security advisory openSUSE-SU-2020:1382-1 to address this issue and obtain further details.

Affected Products:
openSUSE Leap 15.1

To install packages using the command line interface, use the command "yum update".

Refer to SUSE security advisory openSUSE-SU-2020:1379-1 to address this issue and obtain further details.

Affected Products:

centos 6

Affected Products:

centos 7

Security Fix(es): chromium-browser: Use after free in presentation API (CVE-2020-6559)
chromium-browser: Incorrect security UI in Omnibox (CVE-2020-6571)
chromium-browser: Insufficient policy enforcement in autofill (CVE-2020-6560)
chromium-browser: Inappropriate implementation in Content Security Policy (CVE-2020-6561)
chromium-browser: Insufficient policy enforcement in Blink (CVE-2020-6562)
chromium-browser: Insufficient policy enforcement in intent handling (CVE-2020-6563)
chromium-browser: Incorrect security UI in permissions (CVE-2020-6564)
chromium-browser: Incorrect security UI in Omnibox (CVE-2020-6565)
chromium-browser: Insufficient policy enforcement in media (CVE-2020-6566)
chromium-browser: Insufficient validation of untrusted input in command line handling (CVE-2020-6567)
chromium-browser: Insufficient policy enforcement in intent handling (CVE-2020-6568)
chromium-browser: Integer overflow in WebUSB (CVE-2020-6569)
chromium-browser: Side-channel information leakage in WebRTC (CVE-2020-6570)

Affected Products:

Red Hat Enterprise Linux Server 6 x86_64
Red Hat Enterprise Linux Server 6 i386
Red Hat Enterprise Linux Workstation 6 x86_64
Red Hat Enterprise Linux Workstation 6 i386
Red Hat Enterprise Linux Desktop 6 x86_64
Red Hat Enterprise Linux Desktop 6 i386
Red Hat Enterprise Linux for Scientific Computing 6 x86_64

Refer to Red Hat security advisory RHSA-2020:3723 to address this issue and obtain more information.

Affected Products:
openSUSE Leap 15.2

To install packages using the command line interface, use the command "yum update".

Refer to SUSE security advisory openSUSE-SU-2020:1392-1 to address this issue and obtain further details.

Affected Products:
openSUSE Leap 15.1

To install packages using the command line interface, use the command "yum update".

Refer to SUSE security advisory openSUSE-SU-2020:1383-1 to address this issue and obtain further details.

Affected Versions:
PAN-OS 9.1 versions earlier than PAN-OS 9.1.3
PAN-OS 9.0 versions earlier than PAN-OS 9.0.9
PAN-OS 8.1 versions earlier than PAN-OS 8.1.15
PAN-OS 8.0 all versions
QID Detection Logic (Authenticated):
This QID looks for the vulnerable version of PAN-OS via XML API.

NOTE: This issue is applicable only where either Captive Portal is enabled or Multi-Factor Authentication (MFA) is configured.

Refer to PAN-145149, PAN-145150, PAN-145151, PAN-145195 for more information about patching this vulnerability.

Affected Versions:
PAN-OS 9.0 versions earlier than PAN-OS 9.0.9
PAN-OS 8.1 versions earlier than PAN-OS 8.1.16
QID Detection Logic (Authenticated):
This QID looks for the vulnerable version of PAN-OS via XML API.

Refer to PAN-116720 for more information about patching this vulnerability.

Affected Versions:
PAN-OS 10.0 versions earlier than PAN-OS 10.0.1
PAN-OS 9.1 versions earlier than PAN-OS 9.1.4
PAN-OS 9.0 versions earlier than PAN-OS 9.0.10
QID Detection Logic (Authenticated):
This QID looks for the vulnerable version of PAN-OS via XML API.

Refer to PAN-101484 for more information about patching this vulnerability.

Affected Versions:
PAN-OS 9.1 versions earlier than PAN-OS 9.1.3
PAN-OS 9.0 versions earlier than PAN-OS 9.0.10
PAN-OS 8.1 versions earlier than PAN-OS 8.1.16
QID Detection Logic (Authenticated):
This QID looks for the vulnerable version of PAN-OS via XML API.

Refer to PAN-128761 for more information about patching this vulnerability.