CVE-2019-3689

The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If...

CVE-2019-3689

The CVE-2019-3689 issue affects the nfs-utils package on SUSE Linux Enterprise Server 12 (≤1.3.0-34.18.1) and SLES 15 (≤2.1.1-6.10.2). The directory /var/lib/nfs is owned by statd:nogroup, while files inside are root-owned. If statd is compromised, a process with root privileges could be tricked ...

SUSE SLED12 / SLES12 Security Update : bzip2 (SUSE-SU-2019:2013-1)

This update for bzip2 fixes the following issues : Fixed a regression with the fix for CVE-2019-12900, which caused incompatibilities with files that used many selectors bsc1139083. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1935-1) (SACK Slowness)

This update for the Linux Kernel 3.12.74-6064115 fixes one issue. The following security issue was fixed : This update contains a regression fix for CVE-2019-11478 bsc1140747. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory...

SUSE-SU-2019:1802-1 Security update for kernel-firmware

This update for kernel-firmware aligns the firmware code with SUSE Linux Enterprise Server 15. The version is now at 20190618. Please refer to the kernel-firmware rpm changelog file to see the full history of changes...

SUSE SLED12 / SLES12 Security Update : wget (SUSE-SU-2019:0956-1)

This update for wget fixes the following issues : Security issue fixed : CVE-2019-5953: Fixed a buffer overflow vulnerability which might cause code execution bsc1131493. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory...

OpenSSH CVE-2019-6109 Man in the Middle Security Bypass Vulnerability

Description OpenSSH is prone to a security-bypass vulnerability. Successfully exploiting this issue may allow attackers to bypass certain security restrictions and perform unauthorized actions by conducting a man-in-the-middle attack. This may lead to other attacks. OpenSSH 7.9 version is...

SUSE SLES11 Security Update : libvirt (SUSE-SU-2018:1475-1) (Spectre)

This update for libvirt fixes the following issues : - CVE-2018-3639: cpu: Added support for 'ssbd' and 'virt-ssbd' CPUID feature bits pass through. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

SUSE SLES11 Security Update : ncurses (SUSE-SU-2018:0178-1)

This update for ncurses fixes the following issues: Security issue fixed : - CVE-2017-13733: Fix illegal address access in the fmtentry function bsc1056127. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

SUSE-SU-2017:2700-1 Security update for SLES 12-SP1 Docker image

The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include security and stability fixes. The following issues related to building of the container images have been fixed: - Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by th...

SUSE-SU-2017:2699-1 Security update for SLES 12 Docker image

The SUSE Linux Enterprise Server 12 container image has been updated to include security and stability fixes. The following issues related to building of the container images have been fixed: - Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the...

Novell SUSE Linux Enterprise Server and Linux Enterprise Desktop Arbitrary Code Execution Vulnerability

Novell SuSE Linux Enterprise Server is an enterprise server version of the Linux operating system from Novell, Inc. Linux Enterprise Desktop is a desktop version of the Linux system. A security vulnerability exists in Novell SUSE Linux Enterprise Server version 12-SP1 and Linux Enterprise Desktop...

SUSE SLES11 Security Update : apport (SUSE-SU-2017:1938-1)

This update for apport fixes the following issues: Security issue fixed : - CVE-2015-1338: Insecurely created crash dumps could lead to a DoS or privilege escalation through malicious symlinks. bsc947731 Note that Tenable Network Security has extracted the preceding description block directly fro...

Novell SUSE Linux Enterprise Server/SUSE Linux Enterprise Desktop Code Injection Vulnerability

SuSE Linux Enterprise Server and SUSE Linux Enterprise Desktop are both enterprise server versions of the Linux operating system from the American company Novell. A code injection vulnerability exists in the supportconfig data collection tool in supportutils in Novell SUSE Linux Enterprise Server...

SUSE SLES11 Security Update : samba (SUSE-SU-2017:0841-1)

This update for samba fixes the following issues: Security issue fixed : - CVE-2017-2619: symlink race permits opening files outside share directory bsc1027147. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

CVE-2016-1602

CVE-2016-1602 is a local code injection vulnerability in the supportconfig data collection tool of supportutils used by SUSE Linux Enterprise Server 12/12-SP1 and SUSE Linux Enterprise Desktop 12/12-SP1. The issue allows a local attacker to execute code as the user running supportconfig (typicall...

SUSE SLED12 / SLES12 Security Update : gstreamer-0_10-plugins-base (SUSE-SU-2017:0263-1)

gstreamer-010-plugins-base was updated to fix one issue. This security issue was fixed : - CVE-2016-9811: Out of bounds memory read in windowsicontypefind bsc1013669. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable...

SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2016:2286-1)

IBM Java 7 was updated to 7.1-9.50, fixing bugs and security issues bsc992537. Security issues fixed: CVE-2016-3485 CVE-2016-3511 CVE-2016-3598 Please see https://www.ibm.com/developerworks/java/jdk/alerts/ for more information. Note that Tenable Network Security has extracted the preceding...

CVE-2016-4036

The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for /etc/quagga, which allows local users to obtain sensitive information by reading files in the directory...

SUSE-SU-2016:1941-1 Security update for SUSE Linux Enterprise Server Docker images

This update for the SUSE Linux Enterprise Server 12 and 12 SP1 Docker images provides the latest security patches for openldap2, glibc and openssl bsc982831...