Ubuntu: Security Advisory (USN-3239-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS / 16.04 LTS : GNU C Library Regression (USN-3239-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3239-2 advisory. USN-3239-1 fixed vulnerabilities in the GNU C Library. Unfortunately, the fix for CVE-2015-5180 introduced an internal ABI change within the resolver...

USN-3239-2: GNU C Library Regression

USN-3239-1 fixed vulnerabilities in the GNU C Library. Unfortunately, the fix for CVE-2015-5180 introduced an internal ABI change within the resolver library. This update reverts the change. We apologize for the inconvenience. Please note that long-running services that were restarted to compensa...

Ubuntu 14.04 LTS / 16.04 LTS : GNU C Library vulnerabilities (USN-3239-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3239-1 advisory. It was discovered that the GNU C Library incorrectly handled the strxfrm function. An attacker could use this issue to cause a denial of...

CVE-2017-5180

Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option...

Code injection

Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private optio...

CVE-2017-5180

CVE-2017-5180 affects Firejail prior to 0.9.44.4 and 0.9.38.x LT S before 0.9.38.8 LTS. The issue is that the .Xauthority case is not considered when preventing access to user files for an euid 0 sandbox, enabling local sandbox-escape attacks via a symlink and the --private option. Reported impac...

CVE-2017-5180

Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option...

openSUSE Security Update : libcares2 (openSUSE-2017-58)

This update for libcares2 fixes the following issues : - Add patch to fix single byte out of buffer write CVE-2016-5180, bsc1007728 This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Security fix for the ALT Linux 10 package firejail version 0.9.44.4-alt1

Jan. 8, 2017 Anton Midyukov 0.9.44.4-alt1 - new version 0.9.44.4 - Update for release with security fixes: - CVE-2017-5207 -bandwidth root shell found by Martin Carpenter - CVE-2017-5206 disabled --allow-debuggers when running on kernel 4.8 - CVE-2017-5180 root exploit found by Sebastian Krahmer...

SUSE SLES11 Security Update : libcares2 (SUSE-SU-2016:3287-1)

This update for libcares2 fixes the following issues : - Add patch to fix single byte out of buffer write CVE-2016-5180, bsc1007728 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically cle...

SUSE SLED12 / SLES12 Security Update : libcares2 (SUSE-SU-2016:3286-1)

This update for libcares2 fixes the following issues : - Add patch to fix single byte out of buffer write CVE-2016-5180, bsc1007728 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically cle...

Fedora Update for mingw-c-ares FEDORA-2016-4f34f26649

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for c-ares FEDORA-2016-e523c37b4d

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : nodejs4 (openSUSE-2016-1403)

This update for nodejs4 fixes the following issues : Security issues fixed : - CVE-2016-5180: c-ares: Fix for single-byte buffer overwrite bsc1007728. Bug fixes : - bsc1009011: npm4 should provide versioned nodejs-npm and npm allowing nodejs-packaging to continue to function properly in Leap 42.2...

openSUSE Security Update : libcares2 (openSUSE-2016-1373)

This update for libcares2 fixes the following issues : - arescreatequery single byte out of buffer write CVE-2016-5180, boo1007728 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

SUSE-SU-2016:2898-1 Security update for nodejs4

This update for nodejs4 fixes the following issues: Security issues fixed: - CVE-2016-5180: c-ares: Fix for single-byte buffer overwrite bsc1007728. Bug fixes: - bsc1009011: npm4 should provide versioned nodejs-npm and npm allowing nodejs-packaging to continue to function properly in Leap 42.2...

Fedora 25 : mingw-c-ares (2016-4f34f26649)

Security fix for CVE-2016-5180 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

Fedora Update for mingw-c-ares FEDORA-2016-66d9389548

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for mingw-c-ares FEDORA-2016-a7f9e86df7

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...