SUSE-SU-2016:2700-1 Security update for curl

This update for curl fixes the following issues: - CVE-2016-8624: invalid URL parsing with '' bsc1005646 - CVE-2016-8623: Use-after-free via shared cookies bsc1005645 - CVE-2016-8621: curlgetdate read out of bounds bsc1005642 - CVE-2016-8619: double-free in krb5 code bsc1005638 - CVE-2016-8618:...

SUSE-SU-2016:2667-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: These vulnerabilities could be triggered by processing specially crafted image files, which could lead to a process crash or resource consumtion, or potentially have unspecified futher impact. - CVE-2016-8684: Mismatch between real filesize...

OpenSSL: Fix memory issues in BIO_*printf functions

Several flaws were found in the way BIOprintf functions were implemented in OpenSSL. Applications which passed large amounts of untrusted data through these functions could crash or potentially execute code with the permissions of the user running such an application...

SUSE-SU-2016:2459-1 Security update for php53

This update for php53 fixes the following security issues: CVE-2016-7124: Create an Unexpected Object and Don't Invoke wakeup in Deserialization CVE-2016-7125: PHP Session Data Injection Vulnerability CVE-2016-7126: selectcolors write out-of-bounds CVE-2016-7127: imagegammacorrect allowed arbitra...

SUSE-SU-2016:2010-1 Security update for Linux Kernel Live Patch 11 for SLE 12

This update for the Linux Kernel 3.12.51-5239 fixes several issues. The following security bugs were fixed: - CVE-2016-4470: The keyrejectandlink function in security/keys/key.c in the Linux kernel did not ensure that a certain data structure is initialized, which allowed local users to cause a...

OracleVM 3.2 : openssl (OVMSA-2016-0086)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2016-0799 - Fix memory issues in BIOprintf functions - CVE-2016-2105 - Avoid overflow in EVPEncodeUpdate - CVE-2016-2106 - Fix encrypt overflow - CVE-2016-2109 - Harden ASN.1 BIO handling of large...

Oracle Linux 5 : openssl (ELSA-2016-3576)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3576 advisory. - CVE-2016-0799 - Fix memory issues in BIOprintf functions - CVE-2016-2105 - Avoid overflow in EVPEncodeUpdate - CVE-2016-2106 - Fix encrypt overflow...

openssl security update

0.9.8e-40.0.2 - CVE-2016-0799 - Fix memory issues in BIOprintf functions - CVE-2016-2105 - Avoid overflow in EVPEncodeUpdate - CVE-2016-2106 - Fix encrypt overflow - CVE-2016-2109 - Harden ASN.1 BIO handling of large amounts of data...

SUSE-SU-2016:1569-1 Security update for python-Pillow

This update for python-Pillow fixes the following security issues: CVE-2016-0775: Fixed a buffer overflow in FliDecode.c causing a segfault when opening FLI files. bsc965582 CVE-2016-0740: Fixed a buffer overflow in TiffDecode.c causing an arbitrary amount of memory to be overwritten when opening...

OracleVM 3.3 / 3.4 : openssl (OVMSA-2016-0049) (SLOTH)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2016-2105 - possible overflow in base64 encoding - fix CVE-2016-2106 - possible overflow in EVPEncryptUpdate - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC - fix CVE-2016-2108...

OpenSSL: Fix memory issues in BIO_*printf functions

Several flaws were found in the way BIOprintf functions were implemented in OpenSSL. Applications which passed large amounts of untrusted data through these functions could crash or potentially execute code with the permissions of the user running such an application...

SUSE-SU-2016:1228-1 Security update for openssl

This update for openssl fixes the following issues: - CVE-2016-2108: Memory corruption in the ASN.1 encoder bsc977617 - CVE-2016-2107: Padding oracle in AES-NI CBC MAC check bsc977616 - CVE-2016-2105: EVPEncodeUpdate overflow bsc977614 - CVE-2016-2106: EVPEncryptUpdate overflow bsc977615 -...

SUSE-SU-2016:0959-1 Security update for java-1_7_0-openjdk

The OpenJDK Java java-170-openjdk was updated to 2.6.5 to fix the following issues: Update to 2.6.5 - OpenJDK 7u99 bsc972468 Security fixes - S8152335, CVE-2016-0636: Improve MethodHandle consistency Import of OpenJDK 7 u99 build 0 - S6425769, PR2858: Allow specifying an address to bind JMX remot...

MGASA-2016-0121 Updated openafs packages fix security vulnerability

In OpenAFS before 1.6.17, users from foreign Kerberos realms can create groups as if they were administrators CVE-2016-2860. In OpenAFS before 1.6.17, information leakage over the network due to uninitialized memory CVE-2016-4536...

Vulnerability in OpenSSL - Fix memory issues in BIO_*printf functions

The internal |fmtstr| function used in processing a “%s” format string in the BIOprintf functions could overflow while calculating the length of a string and cause an OOB read when printing very long strings. Additionally the internal |doaproutch| function can attempt to write to an OOB memory...

Internet Bug Bounty: CVE-2016-0799 memory issues in BIO_*printf functions

https://github.com/openssl/openssl/commit/9cb177301fdab492e4cfef376b28339afe3ef663...

Scientific Linux Security Update : glibc on SL7.x x86_64 (20160216)

A stack-based buffer overflow was found in the way the libresolv library performed dual A/AAAA DNS queries. A remote attacker could create a specially crafted DNS response which could cause libresolv to crash or, potentially, execute code with the permissions of the user running the library. Note...

SUSE-SU-2016:0284-1 Security update for php5

This update for php5 fixes the following issues: - CVE-2015-7803: Specially crafted .phar files with a crafted TAR archive entry allowed remote attackers to cause a Denial of Service DoS bsc949961 - CVE-2016-1903: Specially crafted image files could could allow remote attackers read unspecified...

MGASA-2015-0469 Updated libraw packages fix security vulnerabilities

Updated libraw packages fix security vulnerabilities: It was found that smaldecodesegment function do not handle index carefully, which may cause index overflow CVE-2015-8366. It was found that phaseonecorrect function does not handle memory object's initialization correctly, which may have...

The vulnerabilities of Adobe Integrated Runtime and Flash Player software allow a perpetrator to execute arbitrary code.

The vulnerability of Adobe Integrated Runtime and Flash Player programs is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by using the LoadSound function...