[SECURITY] [DSA 3832-1] icedove security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3832-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 20, 2017 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3832-1 (icedove - security update)

Multiple security issues have been found in Thunderbird, which may may lead to the execution of arbitrary code or information leaks. With this update, the Icedove packages are de-branded back to the official Mozilla branding. With the removing of the Debian branding the packages are also renamed...

Debian: Security Advisory (DSA-3832-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

xen-kernel -- broken check in memory_exchange() permits PV guest breakout

The Xen Project reports: The XSA-29 fix introduced an insufficient check on XENMEMexchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays. A malicious or buggy 64-bit PV guest may be able to access all of system memory, allowing fo...

OracleVM 3.3 / 3.4 : bash (OVMSA-2017-0050)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix signal handling in read builtin Resolves: 1421926 - CVE-2016-9401 - Fix crash when '-' is passed as second sign to popd Resolves: 1396383 - CVE-2016-7543 - Fix for arbitrary code execution via...

Denial Of Service (DoS)

ImageMagick is susceptible to denial of service DoS attacks. The vulnerability is possible because there are multiple memory leaks in the caption and label handling code...

CVE-2016-10146

Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service memory consumption via unspecified vectors...

Code injection

Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service memory consumption via unspecified vectors...

DEBIAN-CVE-2016-10146

Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service memory consumption via unspecified vectors...

CVE-2016-10146

Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service memory consumption via unspecified vectors...

CVE-2016-10146

CVE-2016-10146 : ImageMagick suffers from multiple memory leaks in the caption and label handling code, allowing remote attackers to cause a denial of service through memory consumption via unspecified vectors. No remediation details are provided in the connected documents; monitoring for updates...

CVE-2016-10146

Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service memory consumption via unspecified vectors...

Memory Leak

ImageMagick is vulnerable to memory leaks. It is caused by the ReadPSDLayers function in coders/psd.c, and can be exploited using image files...

OracleVM 3.3 / 3.4 : openjpeg (OVMSA-2017-0048)

The remote OracleVM system is missing necessary patches to address critical security updates : - Revert previous changes in patch for CVE-2016-5159 - Fix double free in patch for CVE-2016-5139 - Fix memory leaks and invalid read in ciobytein Related: 1419775 - Add two more allocation checks to...

openjpeg security update

1.5.1-16 - Revert previous changes in patch for CVE-2016-5159 - Fix memory leaks Related: 1419772 1.5.1-15 - Add two more allocation checks to patch for CVE-2016-5159 Related: 1419772 1.5.1-14 - Fix CWE-825 errors in patch for CVE-2016-5158 Related: 1419772 1.5.1-13 - Add patches for CVE-2016-513...

Security Advisory - Sixteen OpenSSL Vulnerabilities on Some Huawei products

Statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote attackers to cause a denial of service use-after-free or possibly execute arbitrary code via a crafted TLS session. Vulnerability ID: HWPSIRT-2016-09065 This vulnerability has been...

openjpeg security update

1.3-16 - Revert previous changes in patch for CVE-2016-5159 - Fix double free in patch for CVE-2016-5139 - Fix memory leaks and invalid read in ciobytein Related: 1419775 1.3-15 - Add two more allocation checks to patch for CVE-2016-5159 Related: 1419775 1.3-14 - Add patches for CVE-2016-5139,...

Telepresence Robots Patched Against Data Leaks

Double Robotics telepresence robots, marketed as a mobile conferencing tool giving remote workers a physical presence at an office, were recently patched against vulnerabilities that could be abused by an attacker. Researchers at Rapid7 today disclosed details on three vulnerabilities in the...

Security fix for the ALT Linux 8 package shadow version 1:4.2.1-alt7.M80P.1

1:4.2.1-alt7.M80P.1 built March 13, 2017 Mikhail Efremov in task 179286 --- March 7, 2017 Mikhail Efremov - Backported from upstream git: + Fix a resource leak in syslogsg. + Fix a resource leak in libmis/idmapping.c. + Free memory on error path. - Fix user busy errors at userdel patch from Fedor...

SUSE SLES12 Security Update : openssh (SUSE-SU-2017:0607-3)

This update for openssh fixes the following issues : - CVE-2016-8858: prevent resource depletion during key exchange bsc1005480 - CVE-2016-10009: limit directories for loading PKCS11 modules to avoid privilege escalation bsc1016366 - CVE-2016-10011: Prevent possible leaks of host private keys to...