USN-3685-1: Ruby vulnerabilities

Some of these CVE were already addressed in previous USN: 3439-1, 3553-1, 3528-1. Here we address for the remain releases. It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to cause a buffer overrun. CVE-2017-0898 It was discovered that Ruby incorrectly...

Signature Validation Bug Let Malware Bypass Several Mac Security Products

A years-old vulnerability has been discovered in the way several security products for Mac implement Apple's code-signing API that could make it easier for malicious programs to bypass the security check, potentially leaving millions of Apple users vulnerable to hackers. Josh Pitts, a researcher...

Security update for icu (moderate)

icu was updated to fix two security issues. These security issues were fixed: - CVE-2014-8147: The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode ICU used an integer data type that is...

SUSE-SU-2018:1181-1 Security update for xen

This update for xen fixes several issues. These security issues were fixed: - CVE-2018-8897: Prevent mishandling of debug exceptions on x86 XSA-260, bsc1090820 - Handle HPET timers in IO-APIC mode correctly to prevent malicious or buggy HVM guests from causing a hypervisor crash or potentially...

Security update for zsh (important)

This update for zsh fixes the following issues: - CVE-2014-10070: environment variable injection could lead to local privilege escalation bnc1082885 - CVE-2014-10071: buffer overflow in exec.c could lead to denial of service. bnc1082977 - CVE-2014-10072: buffer overflow In utils.c when scanning...

Oracle E-Business Multiple Vulnerabilities (April 2018 CPU)

The version of Oracle E-Business installed on the remote host is missing the April 2018 Oracle Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities as noted in the April 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for...

MySQL 5.5.x < 5.5.60 Multiple Vulnerabilities (RPM Check) (April 2018 CPU)

The version of MySQL running on the remote host is 5.5.x prior to 5.5.60. It is, therefore, affected by multiple vulnerabilities as noted in the April 2018 Critical Patch Update advisory. Please consult the CVRF details for the applicable CVEs for additional information. Note that Nessus has not...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 9, 2018

The interviewing process can be mentally draining. You have to look your best, say the right things, and prove that you’re the best person for the job. When I interview candidates, I love to come up with the one crazy question that isn’t on the usual list of questions that might be asked. I...

Adobe Patches Four Critical Bugs in Flash, InDesign

Adobe fixed four critical vulnerabilities in its Flash Player and InDesign products as part of its regularly scheduled April Security Bulletin Tuesday morning. In all, Adobe released 19 patches for products including Adobe Experience Manager, Adobe InDesign CC, Adobe Digital Editions and the Adob...

Fedora 26 : 1:tomcat (2018-a233dae4ab)

This update includes a rebase from 8.0.49 up to 8.0.50 which resolves two CVEs along with various other bugs/features : - rhbz1548290CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unitended exposure of resources - rhbz1548284 CVE-2018-1305 tomcat:...

Fedora 26 : 3:mariadb (2018-02c0e3725e)

MariaDB 10.1.32 Release notes : https://mariadb.com/kb/en/library/mariadb-10131-release-notes/ https://mariadb.com/kb/en/library/mariadb-10132-release-notes/ Bugs solved : Jemalloc issue on aarch64 solved in jemalloc package https://bugzilla.redhat.com/showbug.cgi?id=1545539 CVEs fixed :...

Fedora 27 : chromium (2018-faff5f661e)

The remote Fedora 27 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2018-faff5f661e advisory. Update to Chromium 65. For EPEL7, it has been a long time since a successful build has been possible, so this will fix a LOT of CVEs. CVE-2017-15396...

Fedora 26 : qt5-qtwebengine (2018-024afa2d48)

A QtWebEngine security update backporting security fixes from Chromium 65 up to 65.0.3325.146. The backports have been forward-ported from QtWebEngine 5.9.5 LTS. This update fixes the following security issues : - CVE-2017-15429 - CVE-2018-6033 claimed fixed in 5.10.1, but the fix was incomplete...

USN-3593-1: Zsh vulnerabilities

It was discovered that Zsh incorrectly handled certain enviroment variables. An attacker could possibly use this issue to gain privileged access to the system. This issue only affected Ubuntu 14.04 LTS. CVE-2014-10070 It was discovered that Zsh incorrectly handled certain inputs. An attacker coul...

Internet Bug Bounty: Two vulnerability in GNU binutils

Last year, I submitted a bug to GNU and applied for two cve: https://vulners.com/cve/CVE-2017-12799 https://vulners.com/cve/CVE-2017-12967 Impact denial of service or leak information...

Security update for openssl-steam (important)

This update for openssl-steam fixes the following issues: - Merged changes from upstream openssl Factory rev 137 into this fork for Steam. Updated to openssl 1.0.2k: CVE-2016-7055: Montgomery multiplication may produce incorrect results boo1009528 CVE-2016-7056: ECSDA P-256 timing attack key...

Threat Analysis: Pylot (Travle) Malware Family

The Pylot or Travle malware family appears to be an evolution of the NetTravler malware family which has been linked to attackers out of China by numerous sources. Over the last year a variant has been observed as a secondary payload often used in conjunction with malicious carrier files typicall...

Fedora 27 : chromium (2017-f2f3fa09e3)

Security fix for CVE-2017-15398, CVE-2017-15399 ---- Security fix for CVE-2017-15386 CVE-2017-15387 CVE-2017-15388 CVE-2017-15389 CVE-2017-15390 CVE-2017-15391 CVE-2017-15392 CVE-2017-15393 CVE-2017-15394 CVE-2017-15395 CVE-2017-5124 CVE-2017-5125 CVE-2017-5126 CVE-2017-5127. Build switched to us...

SUSE-SU-2018:0079-1 Security update for mariadb

This update for mariadb fixes several issues. These security issues were fixed: - CVE-2017-3636: Client programs had an unspecified vulnerability that could lead to unauthorized access and denial of service bsc1049399 - CVE-2017-3641: DDL unspecified vulnerability could lead to denial of service...

EulerOS 2.0 SP1 : kernel (EulerOS-SA-2018-1002)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The recent speculative execution CVEs address three potential attacks across a wide variety of architectures and hardware platforms. - Note: Thi...