EulerOS 2.0 SP5 : golang (EulerOS-SA-2019-1967)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an...

EulerOS 2.0 SP5 : gvfs (EulerOS-SA-2019-1968)

According to the versions of the gvfs packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not...

Debian DLA-1929-1 : php-pecl-http security update

A vulnerability has been discovered in php-pecl-http, the peclhttp module for PHP 5 Extended HTTP Support. A type confusion vulnerability in the mergeparam function allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests. For Debian 8 'Jessie', this problem has...

Fedora 29 : jackson-annotations / jackson-bom / jackson-core / jackson-databind (2019-fb23eccc03)

Update jackson-databind to version 2.9.9.3. - Update jackson-core to version 2.9.9. - Update jackson-annotations to version 2.9.9. - Update jackson-bom to version 2.9.9. Resolves CVE-2019-12086, CVE-2019-12384, CVE-2019-12814, CVE-2019-14379, and CVE-14439. Note that Tenable Network Security has...

EulerOS 2.0 SP5 : foomatic (EulerOS-SA-2019-1964)

According to the versions of the foomatic packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was discovered that foomatic-rip failed to remove all shell special characters from inputs used to construct command lines for external...

Debian DSA-4527-1 : php7.3 - security update

Multiple security issues were found in PHP, a widely-used open source general purpose scripting language: Missing sanitising in the EXIF extension and the iconvmimedecodeheaders function could result in information disclosure or denial of service. C Tenable Network Security, Inc. The descriptive...

SUSE SLED15 / SLES15 Security Update : python-SQLAlchemy (SUSE-SU-2019:2253-2)

This update for python-SQLAlchemy fixes the following issues : Security issues fixed : CVE-2019-7164: Fixed SQL Injection via the orderby parameter bsc1124593. CVE-2019-7548: Fixed SQL Injection via the groupby parameter bsc1124593. Note that Tenable Network Security has extracted the preceding...

Threat Source newsletter (Sept. 19, 2019)

Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. We’re all still trying to shake off the summer. Gone are the early Fridays, beach vacations and days by the pool. Turns out, attackers m...

Fedora 30 : 1:qbittorrent (2019-2cb551904b)

Update to 4.1.7 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security, Inc. T...

Debian DLA-1926-1 : thunderbird security update

Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code, cross-site scripting, information disclosure and a covert content attack on S/MIME encryption using a crafted multipart/alternative message. For Debian 8 'Jessie', these...

Fedora 30 : kernel / kernel-headers (2019-e3010166bd)

The 5.2.15 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Fedora 29 : 1:qbittorrent (2019-ce6c6de3cc)

Update to 4.1.7 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security, Inc. T...

SUSE SLED15 / SLES15 Security Update : ibus (SUSE-SU-2019:2387-1)

This update for ibus fixes the following issues : Security issue fixed : CVE-2019-14822: Fixed a misconfiguration of the DBus server that allowed an unprivileged user to monitor and send method calls to the ibus bus of another user. bsc1150011 Note that Tenable Network Security has extracted the...

CVE-2019-9009

CVE-2019-9009 affects 3S-Smart CODESYS V3 runtime systems prior to 3.5.15.0. A crafted network packet can cause the Control Runtime to crash, enabling a remote denial of service. The issue is associated with CODESYS V3 products containing a communication server, and patches are available in versi...

EulerOS 2.0 SP2 : openssl110f (EulerOS-SA-2019-1862)

According to the version of the openssl110f packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS...

EulerOS Virtualization for ARM 64 3.0.2.0 : cronie (EulerOS-SA-2019-1933)

According to the versions of the cronie packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service memory consumption via...

SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2019:2381-1)

This update for curl fixes the following issues : Security issues fixed : CVE-2019-5481: Fixed a double-free during kerberos FTP data transfer. bsc1149495 CVE-2019-5482: Fixed a TFTP small block size heap buffer overflow bsc1149496. Note that Tenable Network Security has extracted the preceding...

EulerOS 2.0 SP2 : libxml2 (EulerOS-SA-2019-1858)

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libxml2 in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or...

EulerOS Virtualization for ARM 64 3.0.2.0 : git (EulerOS-SA-2019-1930)

According to the version of the git packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service memory...

Debian DLA-1924-1 : python3.4 security update

A vulnerability was discovered in Python, an interactive high-level object-oriented language. CVE-2019-16056 The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a...