Summary
Zack Flack discovered that Monit incorrectly handled certain input. A
remote authenticated user could exploit this to conduct cross-site
scripting (XSS) attacks. (CVE-2019-11454)
Zack Flack discovered a buffer overread when Monit decoded certain crafted
URLs. An attacker could exploit this to potentially leak sensitive
information. (CVE-2019-11455)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | monit | 1:5.6-2ubuntu0.1+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | monit | 1:5.16-2ubuntu0.2+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | monit | 1:5.25.1-1ubuntu0.1~esm1 |
Vulnerabilities 2
-
Unscored —
Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticat…
-
Unscored —
A buffer over-read in Util_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker…