openSUSE Security Update : openssl (openSUSE-2016-1134)

This update for openssl fixes the following issues : OpenSSL Security Advisory 22 Sep 2016 bsc999665 Severity: High - OCSP Status Request extension unbounded memory growth CVE-2016-6304 bsc999666 Severity: Low - Pointer arithmetic undefined behaviour CVE-2016-2177 bsc982575 - Constant time flag n...

SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:2404-1)

This update for mariadb to 1.0.0.27 fixes the following issues: Security issue fixed : - CVE-2016-6662: A malicious user with SQL and filesystem access could create a my.cnf in the datadir and, under certain circumstances, execute arbitrary code as mysql or even root user. bsc998309 - release not...

SUSE SLES12 Security Update : openssl (SUSE-SU-2016:2387-1)

This update for openssl fixes the following issues: OpenSSL Security Advisory 22 Sep 2016 bsc999665 Severity: High - OCSP Status Request extension unbounded memory growth CVE-2016-6304 bsc999666 Severity: Low - Pointer arithmetic undefined behaviour CVE-2016-2177 bsc982575 - Constant time flag no...

openSUSE Security Update : gtk2 (openSUSE-2016-1118)

This gtk2 update to version 2.24.31 fixes the following issues : Security issues fixed : - CVE-2013-7447: Fixed integer overflow in image handling boo966682. Bugs fixed : - Changes from version 2.24.31 : + Backport many file chooser entry fixes and cleanups. + Don't crash if invisible files are...

CVE-2016-5172

The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code...

[slackware-security] pidgin

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, and 14.1 to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/pidgin-2.11.0-i486-1slack14.1.txz: Upgraded. NOTE: These packages provide updates to pidgin-2.11.0, since the previous...

CVE-2016-6525

Heap-based buffer overflow in the pdfloadmeshparams function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a denial of service crash or execute arbitrary code via a large decode array...

CVE-2015-8871

Use-after-free vulnerability in the opjj2kwritemco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors...

Mozilla Patches Certificate Pinning Vulnerability in Firefox

As expected, Mozilla patched a highly scrutinized flaw in its automated update process for add-ons in Firefox, specifically around the expiration of certificate pins. The vulnerability allowed attackers to intercept encrypted browser traffic, inject a malicious NoScript extension update and gain...

SUSE SLES11 Security Update : mysql (SUSE-SU-2016:2343-1)

This mysql update to verson 5.5.52 fixes the following issues: Security issues fixed : - CVE-2016-3477: Fixed unspecified vulnerability in subcomponent parser bsc989913. - CVE-2016-3521: Fixed unspecified vulnerability in subcomponent types bsc989919. - CVE-2016-3615: Fixed unspecified...

Apple Squashes 68 Security Bugs With Sierra Release

With the release of macOS Sierra 10.12 Tuesday, Apple snuffed out dozens of lingering security vulnerabilities in OS X El Capitan and Yosemite. Along with updates to its OS, Apple addressed security bugs in its Safari web browser and macOS Server in separate security bulletins, also released...

SUSE-SU-2016:2343-1 Security update for mysql

This mysql update to verson 5.5.52 fixes the following issues: Security issues fixed: - CVE-2016-3477: Fixed unspecified vulnerability in subcomponent parser bsc989913. - CVE-2016-3521: Fixed unspecified vulnerability in subcomponent types bsc989919. - CVE-2016-3615: Fixed unspecified vulnerabili...

OPENSUSE-SU-2016:2311-1 Recommended update for chromium

Chromium was updated to 53.0.2785.113 to fix a number of security issues and bugs. The following vulnerabilities were fixed: - CVE-2016-5170: Use after free in Blink - CVE-2016-5171: Use after free in Blink - CVE-2016-5172: Arbitrary Memory Read in v8 - CVE-2016-5173: Extension resource access -...

Security update for Chromium (important)

Chromium was updated to 53.0.2785.101 to fix a number of security issues and bugs. The following vulnerabilities were fixed: boo996648 - CVE-2016-5147: Universal XSS in Blink. - CVE-2016-5148: Universal XSS in Blink. - CVE-2016-5149: Script injection in extensions. - CVE-2016-5150: Use after free...

Fedora 23 : phpMyAdmin (2016-06e4de8210)

phpMyAdmin 4.6.4 2016-08-16 ============================= This release includes many security fixes of various levels of severity. Upstream recommends all users upgrade to this release immediately. For full information on the vulnerabilities fixed and mitigation factors for users who are unable t...

mozilla -- multiple vulnerabilities

Mozilla Foundation reports: CVE-2016-2827 - Out-of-bounds read in mozilla::net::IsValidReferrerPolicy low CVE-2016-5256 - Memory safety bugs fixed in Firefox 49 critical CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 critical CVE-2016-5270 - Heap-buffer-overflow in...

Security update for the Linux Kernel (important)

The openSUSE Leap 42.1 kernel was updated to 4.1.31 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2016-2847: fs/pipe.c in the Linux kernel did not limit the amount of unread data in pipes, which allowed local users to cause a denial of service memory...

CVE-2016-7128

The exifprocessIFDinTIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image...

SUSE SLES11 Security Update : kernel (SUSE-SU-2016:2245-1)

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2016-3955: The usbiprecvxbuff function in drivers/usb/usbip/usbipcommon.c in the Linux kernel allowed remote attackers to cause a denial of service...

SUSE-SU-2016:2246-1 Security update for perl

This update for perl fixes the following issues: - CVE-2016-6185: xsloader looking at a 'eval' directory bsc988311 - CVE-2016-1238: searching current directory for optional modules bsc987887 - CVE-2015-8853: regex engine hanging on bad utf8 bnc976584 - CVE-2016-2381: environment dup handling bug...