[SECURITY] Fedora 28 Update: yubico-piv-tool-1.6.0-1.fc28

The Yubico PIV tool is used for interacting with the Privilege and Identification Card PIV applet on a YubiKey NEO. With it you may generate keys on the device, importing keys and certificate s, and create certificate requests, and other operations. A shared library and a command-line tool is...

August 14, 2018—KB4343892 (OS Build 10240.17946)

None None...

Security Bulletin: IBM Spectrum Scale and IBM GPFS are affected by a security vulnerability (CVE-2016-6115)

Summary A security vulnerability has been identified in IBM Spectrum Scale GPFS that could allow a remote authenticated attacker to overflow a buffer and execute arbitrary code on the system with root privileges or cause the server to crash. This vulnerability is only applicable if: - file...

[SECURITY] Fedora 27 Update: gnupg-1.4.23-1.fc27

GnuPG GNU Privacy Guard is a GNU utility for encrypting data and creating digital signatures. GnuPG has advanced key management capabilities and is compliant with the proposed OpenPGP Internet standard described in RFC2440. Since GnuPG doesn't use any patented algorithm, it is not compatible with...

Important kernel security update: CVE-2018-10675 and other issues; new kernel 2.6.32-042stab131.1; Virtuozzo 6.0 Update 12 Hotfix 28 (6.0.12-3709)

This update provides a new kernel 2.6.32-042stab131.1 for Virtuozzo 6.0 that is a rebase to the Red Hat Enterprise Linux 6.10 kernel 2.6.32-754.el6. The new kernel introduces security and stability fixes. Vulnerability id: CVE-2018-10675 The dogetmempolicy function in 'mm/mempolicy.c' in the Linu...

Important kernel security update: CVE-2018-10675 and other issues; new kernel 2.6.32-042stab131.1 for Virtuozzo Containers for Linux 4.7, Server Bare Metal 5.0

This update provides a new kernel 2.6.32-042stab131.1 for Virtuozzo Containers for Linux 4.7 and Server Bare Metal 5.0 that is a rebase to the Red Hat Enterprise Linux 6.10 kernel 2.6.32-754.el6. The new kernel introduces security and stability fixes. Vulnerability id: CVE-2018-10675 The...

[SECURITY] Fedora 28 Update: gnupg-1.4.23-1.fc28

GnuPG GNU Privacy Guard is a GNU utility for encrypting data and creating digital signatures. GnuPG has advanced key management capabilities and is compliant with the proposed OpenPGP Internet standard described in RFC2440. Since GnuPG doesn't use any patented algorithm, it is not compatible with...

kernel: Null pointer dereference via keyctl

A flaw was found in the Linux kernel key management subsystem in which a local attacker could crash the kernel or corrupt the stack and additional memory denial of service by supplying a specially crafted RSA key. This flaw panics the machine during the verification of the RSA key...

[SECURITY] Fedora 28 Update: gnupg2-2.2.8-1.fc28

GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...

[SECURITY] Fedora 27 Update: gnupg2-2.2.8-1.fc27

GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...

[SECURITY] Fedora 28 Update: gnupg-1.4.22-7.fc28

GnuPG GNU Privacy Guard is a GNU utility for encrypting data and creating digital signatures. GnuPG has advanced key management capabilities and is compliant with the proposed OpenPGP Internet standard described in RFC2440. Since GnuPG doesn't use any patented algorithm, it is not compatible with...

[SECURITY] Fedora 26 Update: gnupg2-2.2.6-1.fc26

GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...

[SECURITY] Fedora 27 Update: gnupg2-2.2.6-1.fc27

GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...

[SECURITY] Fedora 28 Update: gnupg2-2.2.6-1.fc28

GnuPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440 and the S/MIME standard as described...

kernel: Incorrect updates of uninstantiated keys crash the kernel

A vulnerability was found in the key management subsystem of the Linux kernel. An update on an uninstantiated key could cause a kernel panic, leading to denial of service DoS...

kernel: NULL pointer dereference due to KEYCTL_READ on negative key

A vulnerability was found in the Key Management sub component of the Linux kernel, where when trying to issue a KEYTCLREAD on a negative key would lead to a NULL pointer dereference. A local attacker could use this flaw to crash the kernel...

tcpdump: Buffer over-read in print-isakmp.c, several functions in ISAKMP parser

The ISAKMP parser in tcpdump before 4.9.2 has a buffer over-read in print-isakmp.c, several functions...

tcpdump: Infinite loop due to bugs in print-isakmp.c, several functions in ISAKMP parser

The ISAKMP parser in tcpdump before 4.9.2 could enter an infinite loop due to bugs in print-isakmp.c, several functions...

The vulnerability of the Trustwave Secure Web Gateway’s protection and control mechanism, related to errors in managing cryptographic keys, allows a hacker to gain unauthorized access to the system with root privileges.

The vulnerability of the Trustwave Secure Web Gateway relates to errors in the management of cryptographic keys. Exploiting this vulnerability allows a malicious actor to inject an arbitrary open key for the SSH protocol and gain unauthorized access to the system with root privileges, using a...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3583-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3583-1 advisory. It was discovered that an out-of-bounds write vulnerability existed in the Flash-Friendly File System f2fs in the Linux kernel. An attacker could constru...