1405 matches found
Debian DSA-4203-1 : vlc - security update
Hans Jerry Illikainen discovered a type conversion vulnerability in the MP4 demuxer of the VLC media player, which could result in the execution of arbitrary code if a malformed media file is played. This update upgrades VLC in stretch to the new 3.x release series as security fixes couldn't be...
Debian DLA-1362-1 : gcc-4.9-backport new package
GCC 4.9 has been packaged as gcc-4.9-backport for Debian 7. This package will be needed by future updates to linux, and possibly other packages, to implement the 'retpoline' mitigation for CVE-2017-5715 Spectre variant 2. NOTE: Tenable Network Security has extracted the preceding description bloc...
[SECURITY] [DLA 1362-1] gcc-4.9-backport new package
Package : gcc-4.9-backport Version : 4.9.2-10+deb7u1 GCC 4.9 has been packaged as gcc-4.9-backport for Debian 7. This package will be needed by future updates to linux, and possibly other packages, to implement the "retpoline" mitigation for CVE-2017-5715 Spectre variant 2. Further information...
DLA-1362-1 gcc-4.9-backport - security update
Bulletin has no description...
CVE-2018-1099
DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost or any other address...
CVE-2017-2628
curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVEGSSAPI define was meanwhile substituted by USEHTTPNEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 curl...
CVE-2017-2628
curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVEGSSAPI define was meanwhile substituted by USEHTTPNEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 curl...
CVE-2017-2628
curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVEGSSAPI define was meanwhile substituted by USEHTTPNEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 curl...
CVE-2017-2628
curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVEGSSAPI define was meanwhile substituted by USEHTTPNEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 curl...
kernel security update
2.6.18-419.0.0.0.8 - Backport CVEs to RHCK/OL5 orabug 27547712 CVE-2017-5753 CVE-2017-5754 - 2.6.18-419.0.0.0.5 - fs fix kernel panic on boot on ia64 guests Honglei Wang orabug 26934100...
CVE-2018-5735
The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages from other distributions who did similar...
UBUNTU-CVE-2018-5735
The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb8u18; 9.10.3.dfsg.P4-12.3+deb9u5; 9.11.5.P4+dfsg-5.1 No ISC releases are affected. Other packages from other distributions who did similar...
kernel: Null pointer dereference due to incorrect node-splitting in assoc_array implementation
A flaw was found in the Linux kernel's implementation of associative arrays introduced in 3.13. This functionality was backported to the 3.10 kernels in Red Hat Enterprise Linux 7. The flaw involved a null pointer dereference in assocarrayapplyedit due to incorrect node-splitting in assocarray...
Fedora 27 : 2:qemu (2017-8db9c497f9)
Fix ppc64 KVM failure bz 1501936 - CVE-2017-15038: 9p: information disclosure when reading extended attributes bz 1499111 - CVE-2017-15268: potential memory exhaustion via websock connection to VNC bz 1496882 ---- qemu-pr-helper didn't work due to a change in the libmultipath/libmpathpersist APIs...
CVE-2017-1000396
Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. This library is widely used as a transitive dependency in Jenkins...
CVE-2017-15085
It was discovered that the fix for CVE-2017-12150 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHEL 6...
CVE-2017-15086
It was discovered that the fix for CVE-2017-12151 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHEL 6...
wpa_supplicant security update
1:0.7.3-9.2 - Fix backport errors CVE-2017-13077, CVE-2017-13080 1:0.7.3-9.1 - avoid key reinstallation CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082...