SUSE SLED15 / SLES15 Security Update : Initial update for kernel-azure (SUSE-SU-2018:1952-1)

This update is the initial delivery of the Azure flavor of the Linux Kernel, which contains enhancements and optimizations for running the SUSE Linux Enterprise kernel in the Azure cloud. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

SUSE SLED15 / SLES15 Security Update : mercurial (SUSE-SU-2018:1998-1)

This update for mercurial fixes the following issues: Security issues fixed : - CVE-2018-13346: Fix mpatchapply function in mpatch.c that incorrectly proceeds in cases where the fragment start is past the end of the original data bsc1100354. - CVE-2018-13347: Fix mpatch.c that mishandles integer...

SUSE SLES12 Security Update : php5 (SUSE-SU-2016:1277-1)

This update for php5 fixes the following security issues : - CVE-2016-4073: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string length calculations in mbstrcut bsc977003 - CVE-2015-8867: The PHP function...

SUSE SLED15 / SLES15 Security Update : xorg-x11-server (SUSE-SU-2018:3680-1)

This update for xorg-x11-server fixes the following issues : CVE-2018-14665: Disable -logfile and -modulepath when running with elevated privileges bsc1112020, Note that SUSE by default does not run with elevated privileges, so the default installation is not affected by this problem. Note that...

SUSE SLED15 / SLES15 Security Update : ucode-intel (SUSE-SU-2018:1926-1) (Spectre)

This update for ucode-intel fixes the following issues: The microcode bundles was updated to the 20180703 release For the listed CPU chipsets this fixes CVE-2018-3640 Spectre v3a and helps mitigating CVE-2018-3639 Spectre v4 bsc1100147 bsc1087082 bsc1087083. More information on:...

SUSE SLED15 / SLES15 Security Update : postgresql10 (SUSE-SU-2018:3942-1)

This update for postgresql10 fixes the following issues : Security issue fixed : CVE-2018-16850: Fixed improper quoting of transition table names when pgdump emits CREATE TRIGGER could have caused privilege escalation bsc1114837. Non-security issues fixed: Update to release 10.6 : -...

SUSE SLED15 / SLES15 Security Update : accountsservice (SUSE-SU-2018:3625-1)

This update for accountsservice fixes the following issues : This security issue was fixed : CVE-2018-14036: Prevent directory traversal caused by an insufficient path check in userchangeiconfileauthorizedcb bsc1099699 Thsese non-security issues were fixed: Don't abort loading users when an...

SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2018:3927-1)

This update for qemu fixes the following issues : Security issues fixed : CVE-2018-10839: Fixed NE2000 NIC emulation support that is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use...

SUSE SLES12 Security Update : php5 (SUSE-SU-2017:0038-1)

This update for php5 fixes the following issues : - CVE-2016-9933 Possible stack overflow on truecolor images handling bsc1015187 - CVE-2016-9934 Dereference from NULL pointer could lead to crash bsc1015188 - CVE-2016-9935 Invalid read could lead to crash bsc1015189 Note that Tenable Network...

SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2018:2298-1)

This update for MozillaFirefox to the 52.9 ESR release fixes the following issues: These security issues were fixed : - Firefox ESR 52.9 : - CVE-2018-5188 Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 bsc1098998. - CVE-2018-12368 No warning when opening executable...

SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2018:2539-1)

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-15572: The spectrev2selectmitigation function in arch/x86/kernel/cpu/bugs.c did not always fill RSB upon a context switch, which made it easier for attacke...

SUSE SLED15 / SLES15 Security Update : pam (SUSE-SU-2018:3965-1)

This update for pam fixes the following issue : Security issue fixed : CVE-2018-17953: Fixed IP address and subnet handling of pamaccess.so that was not honoured correctly when a single host was specified bsc1115640. Note that Tenable Network Security has extracted the preceding description block...

SUSE SLED15 / SLES15 Security Update : systemd (SUSE-SU-2018:3644-1)

This update for systemd fixes the following issues : Security issues fixed : CVE-2018-15688: A buffer overflow vulnerability in the dhcp6 client of systemd allowed a malicious dhcp6 server to overwrite heap memory in systemd-networkd. bsc1113632 CVE-2018-15686: A vulnerability in unitdeserialize ...

SUSE SLED15 / SLES15 Security Update : java-10-openjdk (SUSE-SU-2018:2083-1)

This update for OpenJDK 10.0.2 fixes the following security issues : - CVE-2018-2940: the libraries sub-component contained an easily exploitable vulnerability that allowed attackers to compromise Java SE or Java SE Embedded over the network, potentially gaining unauthorized read access to data...

SUSE SLED15 / SLES15 Security Update : mutt (SUSE-SU-2018:2085-1)

This update for mutt fixes the following issues: Security issues fixed : - bsc1101428: Mutt 1.10.1 security release update. - CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size bsc1101583. - CVE-2018-14353: Fix imapquotestring in imap/util.c that has an...

CVE-2018-18508

In Network Security Services NSS before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service...

UBUNTU-CVE-2018-18508

In Network Security Services NSS before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service...

EulerOS 2.0 SP3 : openssl110f (EulerOS-SA-2018-1434)

According to the version of the openssl110f packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A microprocessor side-channel vulnerability was found on SMT e.g, Hyper-Threading architectures. An attacker running a malicious process on th...

The RPC vulnerability mining case studies, on-vulnerability and early warning-the black bar safety net

2018 8 the end of the month, a self-proclaimed“sandbox escape”SandboxEscaperof female researchers released a Windows local privilege escalation 0 day vulnerability. In addition, also attach a proof of concept attack that allows hackers to read the system in unauthorized areas, but at the moment...

Debian DLA-1617-1 : libvncserver security update

Kaspersky Lab discovered several vulnerabilities in libvncserver, a C library to implement VNC server/client functionalities. CVE-2018-6307 a heap use-after-free vulnerability in the server code of the file transfer extension, which can result in remote code execution. This attack appears to be...