Ubuntu 18.04 LTS : Thunderbird regression (USN-4202-2)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4202-2 advisory. USN-4202-1 fixed vulnerabilities in Thunderbird. After upgrading, Thunderbird created a new profile for some users. This update fixes the problem. We apologize fo...

[SECURITY] [DLA 2030-1] jackson-databind security update

Package : jackson-databind Version : 2.4.2-2+deb8u10 CVE ID : CVE-2019-17267 CVE-2019-17531 More deserialization flaws were discovered in jackson-databind which could allow an unauthenticated user to perform remote code execution. The issue was resolved by extending the blacklist and blocking mor...

[SECURITY] [DLA 2031-1] freeimage security update

Package : freeimage Version : 3.15.4-4.2+deb8u2 CVE ID : CVE-2019-12211 CVE-2019-12213 Debian Bug : 929597 It was found that freeimage, a graphics library, was affected by the following two security issues: CVE-2019-12211 Heap buffer overflow caused by invalid memcpy in PluginTIFF. This flaw migh...

Ubuntu 18.04 LTS : Firefox vulnerabilities (USN-4216-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4216-1 advisory. Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially...

Git CVE-2019-19604 Arbitrary Code Execution Vulnerability

Description Git is prone to an arbitrary code-execution vulnerability. A remote attacker may exploit this issue to execute arbitrary code in the context of the affected application. Failed attempts will likely cause a denial-of-service condition. Git versions prior to 2.20.2, 2.21.x through and...

CVE-2019-19645

alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements...

[SECURITY] [DLA 2026-1] htmldoc security update

Package : htmldoc Version : 1.8.27-8+deb8u1 CVE ID : CVE-2019-19630 In HTMLDOC, there was a one-byte underflow in htmldoc/ps-pdf.cxx caused by a floating point math difference between GCC and Clang. For Debian 8 "Jessie", this issue has been fixed in htmldoc version 1.8.27-8+deb8u1. We recommend...

Ubuntu 18.04 LTS : HAProxy vulnerability (USN-4212-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4212-1 advisory. Tim Dsterhus discovered that HAProxy incorrectly handled certain HTTP/2 headers. An attacker could possibly use this issue to execute arbitrary code through CRLF...

Ubuntu 16.04 LTS / 18.04 LTS : Squid vulnerabilities (USN-4213-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4213-1 advisory. Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly handled certain URN requests. A remote attacker could possibly use thi...

Ubuntu 16.04 LTS / 18.04 LTS : Intel Microcode regression (USN-4182-3)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4182-3 advisory. USN-4182-1 provided updated Intel Processor Microcode. A regression was discovered that caused some Skylake processors to hang after a warm reboot. Th...

Ubuntu 16.04 LTS : GraphicsMagick vulnerabilities (USN-4206-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4206-1 advisory. It was discovered that GraphicsMagick incorrectly handled certain image files. An attacker could possibly use this issue to cause a denial of service...

Ubuntu 18.04 LTS : GraphicsMagick vulnerabilities (USN-4207-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4207-1 advisory. It was discovered that GraphicsMagick incorrectly handled certain image files. An attacker could possibly use this issue to cause a denial of service or...

Ubuntu 16.04 LTS / 18.04 LTS : psutil vulnerability (USN-4204-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4204-1 advisory. Riccardo Schirone discovered that psutil incorrectly handled certain reference counting operations. An attacker could use this issue to cause psutil t...

Ubuntu 16.04 LTS / 18.04 LTS : SQLite vulnerabilities (USN-4205-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4205-1 advisory. It was discovered that SQLite incorrectly handled certain schemas. An attacker could possibly use this issue to cause a denial of service. Th...

Ubuntu 16.04 LTS / 18.04 LTS : NSS vulnerability (USN-4203-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4203-1 advisory. It was discovered that NSS incorrectly handled certain memory operations. A remote attacker could use this issue to cause NSS to crash, resulting in a...

Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4208-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4208-1 advisory. Jann Horn discovered that the OverlayFS and ShiftFS Drivers in the Linux kernel did not properly handle reference counting during memory mapping operatio...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4210-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4210-1 advisory. It was discovered that a buffer overflow existed in the 802.11 Wi-Fi configuration interface for the Linux kernel when handling beacon...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4211-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4211-1 advisory. Zhipeng Xie discovered that an infinite loop could be triggered in the CFS Linux kernel process scheduler. A local attacker could possibly use this to...

[SECURITY] [DLA 2019-1] exiv2 security update

Package : exiv2 Version : 0.24-4.1+deb8u5 CVE ID : CVE-2019-17402 A corrupted or specially crafted CRW images might exceed the overall buffersize to cause a denial of service. For Debian 8 "Jessie", this problem has been fixed in version 0.24-4.1+deb8u5. We recommend that you upgrade your exiv2...

[SECURITY] [DLA 2016-1] ssvnc security update

Package : ssvnc Version : 1.0.29-2+deb8u1 CVE ID : CVE-2018-20020 CVE-2018-20021 CVE-2018-20022 CVE-2018-20024 Debian Bug : 945827 Several vulnerabilities have been identified in the VNC code of ssvnc, an encryption-capable VNC client.. The vulnerabilities referenced below are issues that have...