Debian DLA-1058-1 : krb5 security update

In MIT Kerberos 5 aka krb5 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests. For Debian 7 'Wheezy', these problems have been fixed in version 1.10.1+dfsg-5+deb7u8. We recommend that you upgrade your krb5 packages. NOTE:...

Fedora 26 : kernel (2017-adc7d95627)

The 4.12.5 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Fedora 25 : git (2017-8ba7572cfd)

Resolve an arbitrary code execution vulnerability via crafted 'ssh://' URL CVE-2017-1000117. From the release announcement : A malicious third-party can give a crafted 'ssh://...' URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's...

Fedora 26 : git (2017-b1b3ae6666)

Resolve an arbitrary code execution vulnerability via crafted 'ssh://' URL CVE-2017-1000117. From the release announcement : A malicious third-party can give a crafted 'ssh://...' URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's...

Debian DLA-1056-1 : cvs security update

It was discovered that there was a command injection vulnerability in the CVS revision control system. For Debian 7 'Wheezy', this issue has been fixed in cvs version 2:1.12.13+real-9+deb7u1. We recommend that you upgrade your cvs packages. Thanks to Thorsten Glaser for preparing and testing this...

Ubuntu 17.04 : linux, linux-raspi2 vulnerabilities (USN-3384-1)

Andrey Konovalov discovered a race condition in the UDP Fragmentation Offload UFO code in the Linux kernel. A local attacker could use this to cause a denial of service or execute arbitrary code. CVE-2017-1000112 Andrey Konovalov discovered a race condition in AFPACKET socket option handling code...

ABB SREA-01 and SREA-50

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Public exploits are available. Vendor: ABB Equipment: SREA-01 and SREA-50 Vulnerability: Relative Path Traversal AFFECTED PRODUCTS ABB reports that the vulnerability affects the following SREA-01 and SREA-50 legacy remote...

More on the Vulnerabilities Equities Process

Richard Ledgett -- a former Deputy Director of the NSA -- argues against the US government disclosing all vulnerabilities: Proponents argue that this would allow patches to be developed, which in turn would help ensure that networks are secure. On its face, this argument might seem to make sense ...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2099-1)

This update for the Linux Kernel 3.12.60-5257 fixes several issues. The following security bugs were fixed : - CVE-2017-7533: A bug in inotify code allowed local users to escalate privilege bsc1050751. - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel allowed remot...

Fedora 25 : 2:freerdp / remmina (2017-ed31e1f941)

Update to latest snapshot that contains fixes for the latest Talos discovered CVEs. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible witho...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2092-1)

This update for the Linux Kernel 3.12.69-606432 fixes several issues. The following security bugs were fixed : - CVE-2017-7533: A bug in inotify code allowed local users to escalate privilege bsc1050751. - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel allowed...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2093-1)

This update for the Linux Kernel 3.12.60-5260 fixes several issues. The following security bugs were fixed : - CVE-2017-7533: A bug in inotify code allowed local users to escalate privilege bsc1050751. - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel allowed remot...

Design/Logic Flaw

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Serialization. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker...

CVE-2017-10198

CVE-2017-10198 affects Oracle Java SE, Java SE Embedded, and JRockit. Vulnerability in the Security component (and related areas) allows unauthenticated network-based access to compromise affected Java runtimes (Java SE 6u151, 7u141, 8u131; Embedded 8u131; JRockit R28.3.14). Exploitation is possi...

CVE-2017-6869

Siemens ViewPort for Web Office Portal prior to revision 1453 is affected by CVE-2017-6869. An unauthenticated remote attacker can upload arbitrary code and execute it with the OS user running the web server by sending specially crafted packets to ports 443/TCP or 80/TCP. The issue is categorized...

Microsoft Edge CVE-2017-8640 Scripting Engine Remote Memory Corruption Vulnerability

Description Microsoft Edge is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Faile...

EulerOS 2.0 SP2 : glibc (EulerOS-SA-2017-1147)

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The nssdns implementation of getnetbyname in GNU C Library aka glibc before 2.21, when the DNS backend in the Name Service Switch configuration i...

Raspberry Pi Network Security Monitoring: SweetSecurity

Raspberry Pi Network Security Monitoring Scripts to setup and install Bro IDS, Elasticsearch, Logstash, Kibana, and Critical Stack on any device. Installation: sudo python setup.py Follow prompts to enter appropriate information for chosen installation type Installation Types 1. Full Install : Th...

UBUNTU-CVE-2015-5244

The NSSCipherSuite option with ciphersuites enabled in modnss before 1.0.12 allows remote attackers to bypass application restrictions...

Virtuozzo 7 : readykernel-patch (VZA-2017-069)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - Integer overflow vulnerability in ip6find1stfragopt function was found. Local attacker that has privileges to open r...