Debian: Security Advisory (DSA-3607-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Whonix 13 - Anonymous Operating System

Whonix is a desktop operating system designed for advanced security and privacy. It realistically addresses attacks while maintaining usability. It makes online anonymity possible via fail-safe, automatic, and desktop-wide use of the Tor network. A heavily reconfigured Debian base is run inside...

OracleVM 3.2 : openldap (OVMSA-2016-0069)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2015-6908 openldap: bergetnext denial of service vulnerability 1263170 - fix: syncprov psearch race condition 999811 - fix: CVE-2013-4449 segfault on certain queries with rwm overlay 1064146 - fix...

Debian DLA-516-1 : linux security update

This update fixes the CVEs described below. CVE-2016-0821 Solar Designer noted that the list 'poisoning' feature, intended to mitigate the effects of bugs in list manipulation in the kernel, used poison values within the range of virtual addresses that can be allocated by user processes...

USN-3001-1: Linux kernel (Vivid HWE) vulnerabilities

Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from kernel memory. CVE-2016-2117 Jann Horn discovered that eCryptfs improperly attempted to use...

Ubuntu 15.10 : linux-raspi2 vulnerabilities (USN-3004-1)

Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables scatter/gather I/O. A remote attacker could use this to obtain potentially sensitive information from kernel memory. CVE-2016-2117 Jann Horn discovered that eCryptfs improperly attempted to use...

Scientific Linux Security Update : openssl on SL6.x i386/x86_64 (20160510)

Security Fixes : - A flaw was found in the way OpenSSL encoded certain ASN.1 data structures. An attacker could use this flaw to create a specially crafted certificate which, when verified or re-encoded by OpenSSL, could cause it to crash, or execute arbitrary code using the permissions of the us...

CVE-2013-7456 and CVE-2016-5093 PHP vulnerabilities | Cloud Foundry

CVE-2013-7456 and CVE-2016-5093 PHP vulnerabilities Low Vendor PHP Versions Affected Cloud Foundry PHP buildpack versions prior to 4.3.14 Description Several out-of-bounds reads were discovered in PHP and its dependencies that could cause memory leaks or other unexpected conditions. Mitigation...

MGASA-2016-0215 Updated libgd packages fix security vulnerabilities

Updated libgd packages fix security vulnerabilities: The gdImageScaleTwoPass function in gdinterpolation.c in libgd before 2.2.0 uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service memory consumption via a crafted call, as demonstrated by a...

chromium: multiple issues

CVE-2016-1672: Cross-origin bypass in extension bindings. Credit to Mariusz Mlynski. - CVE-2016-1673: Cross-origin bypass in Blink. Credit to Mariusz Mlynski. - CVE-2016-1674: Cross-origin bypass in extensions. Credit to Mariusz Mlynski. - CVE-2016-1675: Cross-origin bypass in Blink. Credit to...

CentOS 6 : openssl (CESA-2016:0996)

An update for openssl is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

About the security content of tvOS 9.2.1

About the security content of tvOS 9.2.1 This document describes the security content of tvOS 9.2.1. For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To...

Zomato: Instagram OAuth2 Implementation Leaks Access Token; Allows for Cross-Site Script Inclusion (XSSI)

Once a user connects his Zomato account to Instagram via OAuth2, the page https://www.zomato.com/php/instagramtagrelay leaks the Instagram OAuth2 Access Token issued to Zomato: PoC: https://www.zomato.com/php/instagramtagrelay?callback=aaabc Result personal data x'ed: HTTP/1.1 200 OK...

RHEL 6 : ntp (RHSA-2016:0780)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0780 advisory. The Network Time Protocol NTP is used to synchronize a computer's time with another referenced time source. These packages include the ntpd...

Scientific Linux Security Update : openssl on SL7.x x86_64 (20160509)

Security Fixes : - A flaw was found in the way OpenSSL encoded certain ASN.1 data structures. An attacker could use this flaw to create a specially crafted certificate which, when verified or re-encoded by OpenSSL, could cause it to crash, or execute arbitrary code using the permissions of the us...

Ubuntu: Security Advisory (USN-2934-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-2934-1: Thunderbird vulnerabilities

Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel Holbert, Jesse Ruderman, and Randell Jesup discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denia...

Debian DSA-3547-1 : imagemagick - security update

Several vulnerabilities were discovered in Imagemagick, a program suite for image manipulation. This update fixes a large number of potential security problems such as NULL pointer access and buffer-overflows that might lead to memory leaks or denial of service. None of these security problems ha...

[SECURITY] [DSA 3547-1] imagemagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3547-1 [email protected] https://www.debian.org/security/ Luciano Bello April 11, 2016 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3547-1] imagemagick security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3547-1 [email protected] https://www.debian.org/security/ Luciano Bello April 11, 2016 https://www.debian.org/security/faq -...