[SECURITY] [DLA 1777-1] jquery security update

Package : jquery Version : 1.7.2+dfsg-3.2+deb8u6 CVE ID : CVE-2019-11358 jQuery mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype. For additional informatio...

IBM MQ 9.1.0.x LTS < 9.1.0.2 LTS / 9.1.1 CD Console Weak Cryptography Man in the Middle Vulnerability (CVE-2018-1925)

According to its self-reported version, the IBM MQ server installed on the remote host is 9.1.0.x LTS 9.1.0.2 LTS, or 9.1.1 CD and is therefore affected by an unspecified man in the middle vulnerability in the IBM MQ Console due to weaker than expected cryptographic algorithms. C Tenable Network...

Denial Of Service (DoS)

Red Hat Enterprise Linux OpenStack Platform provides the facilities for building a private or public infrastructure-as-a-service IaaS cloud running on commonly available physical hardware. This update addresses the following issues: This package rebases mariadb-galera to 5.5.42, fixing an issue...

Denial Of Service (DoS)

Red Hat Enterprise Linux OpenStack Platform provides the facilities for building a private or public infrastructure-as-a-service IaaS cloud running on commonly available physical hardware. This update addresses the following issues: This package rebases mariadb-galera to 5.5.42, fixing an issue...

[SECURITY] [DLA 1773-1] signing-party security update

Package : signing-party Version : 1.1.10-3+deb8u1 CVE ID : CVE-2019-11627 Debian Bug : 928256 An unsafe shell call enabling shell injection via a user ID was corrected in gpg-key2ps, a tool to generate a PostScript file with OpenPGP key fingerprint slips. For Debian 8 "Jessie", this problem has...

Ubuntu 18.04 LTS : libpng vulnerability (USN-3962-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3962-1 advisory. It was discovered that libpng incorrectly handled certain memory operations. If a user or automated system were tricked into opening a specially crafted PNG file,...

[SECURITY] [DLA 1772-1] libvirt security update

Package : libvirt Version : 1.2.9-9+deb8u6 CVE ID : CVE-2016-10746 libvirt-domain.c in libvirt supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed to be required. This could lead to could lead to potentially disclosing unintended...

[SECURITY] [DLA 1766-1] evolution security update

Package : evolution Version : 3.12.9git20141130.241663-1+deb8u1 CVE ID : CVE-2018-15587 Debian Bug : 924616 Hanno Böck discovered that GNOME Evolution is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted HTML email. This issue was mitigated by moving the...

Apache Pluto 3.0.0 / 3.0.1 - Persistent Cross-Site Scripting

Exploit Title: Stored XSS Date: 25-04-2019 Exploit Author: Dhiraj Mishra Vendor Homepage: https://portals.apache.org/pluto Software Link: https://portals.apache.org/pluto/download.html Version: 3.0.0, 3.0.1 Tested on: Ubuntu 16.04 LTS CVE: CVE-2019-0186 References:...

Ubuntu 16.04 LTS / 18.04 LTS : tcpflow vulnerabilities (USN-3955-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3955-1 advisory. It was discovered that tcpflow incorrectly handled certain malformed network packets. A remote attacker could send these packets to a target...

Ubuntu 18.04 LTS : FreeRADIUS vulnerabilities (USN-3954-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3954-1 advisory. It was discovered that FreeRADIUS incorrectly handled certain inputs. An attacker could possibly use this issue to bypass authentication. CVE-2019-11234,...

[SECURITY] [DLA 1762-1] systemd security update

Package : systemd Version : 215-17+deb8u12 CVE ID : CVE-2017-18078 CVE-2019-3842 Two vulnerabilities have been addressed in the systemd components systemd-tmpfiles and pamsystemd.so. CVE-2017-18078 systemd-tmpfiles in systemd attempted to support ownership/permission changes on hardlinked files...

Ubuntu 14.04 LTS : PHP vulnerabilities (USN-3922-2)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3922-2 advisory. USN-3922-1 fixed vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 14.04 LTS. It was discovered that PHP incorrectly handl...

Ubuntu 16.04 LTS / 18.04 LTS : PHP vulnerabilities (USN-3953-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3953-1 advisory. It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote attacker could use this issue to cause PHP to crash...

[SECURITY] [DLA 1761-1] ghostscript security update

Package : ghostscript Version : 9.26adfsg-0+deb8u2 CVE ID : CVE-2019-3835 CVE-2019-3838 Debian Bug : 925256 925257 Cedric Buissart discovered two vulnerabilities in Ghostscript, the GPL PostScript/PDF interpreter, which could result in bypass of file system restrictions of the dSAFER sandbox. For...

Ubuntu 18.04 LTS : OpenJDK 11 vulnerability (USN-3949-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3949-1 advisory. It was discovered that a memory disclosure issue existed in the OpenJDK Library subsystem. An attacker could use this to expose sensitive information and possibly...

Ubuntu: Security Advisory (USN-3949-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 18.04 LTS : WebKitGTK+ vulnerabilities (USN-3948-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3948-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, ...

[SECURITY] [DLA 1755-1] graphicsmagick security update

Package : graphicsmagick Version : 1.3.20-3+deb8u6 CVE ID : CVE-2017-10799 CVE-2019-11006 CVE-2019-11007 CVE-2019-11008 CVE-2019-11009 CVE-2019-11010 Debian Bug : 927029 Several security vulnerabilities were discovered in Graphicsmagick, a collection of image processing tools. Heap-based buffer...

Security Bulletin: IBM MQ Console has inadequate input validation (CVE-2018-1836)

Summary The IBM MQ console has inadequate input validation in one of its forms that could allow an attacker to inject unintended data into fields. Vulnerability Details CVEID: CVE-2018-1836 DESCRIPTION: IBM MQ Console is vulnerable to cross-site scripting. This vulnerability allows users to embed...