SUSE SLED12 / SLES12 Security Update : compat-openssl098 (SUSE-SU-2017:0605-1)

This update for compat-openssl098 fixes the following issues contained in the OpenSSL Security Advisory 26 Jan 2017 bsc1021641 Security issues fixed : - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed bsc1019334 - CVE-2016-8610: A remote denial of...

Xenmobile : MDM and MAM Console Features

There's a lot to consider while deciding the enrollment mode MDM/MAM to the XenMobile environment. What devices should you choose? How should you manage them? What are the devices features available from the console etc. How do you ensure that your network remains secure while still being user...

Fedora 24 : libXdmcp (2017-bcb1999e65)

Security fix for CVE-2017-2625 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

Linux/x86-64 - Reverse Shell Shellcode (84 bytes)

/ Title: Linux/x86-64 - Reverse TCP shellcode - 84 bytes Author: Manuel Mancera @sinkmanu Tested on: 3.16.0-4-amd64 1 SMP Debian 3.16.39-1 2016-12-30 x8664 GNU/Linux ----------------- Assembly code ------------------- section .text global start start: push 0x2d01a8c0 ; Address 192.168.1.45 push...

Aruba AirWave 8.2.3 - XML External Entity Injection Cross-Site Scripting

Aruba AirWave 8.2.3 - XML External Entity Injection Cross-Site Scripting SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: XML External Entity Injection XXE, Reflected Cross Site Scripting product: Aruba AirWave vulnerab...

Linux/x86-64 - Reverse Shell Shellcode (84 bytes)

Linux/x86-64 - Reverse Shell Shellcode 84 bytes. Shellcode exploit for Linux platform / Title: Linux/x86-64 - Reverse TCP shellcode - 84 bytes Author: Manuel Mancera @sinkmanu Tested on: 3.16.0-4-amd64 1 SMP Debian 3.16.39-1 2016-12-30 x8664 GNU/Linux ----------------- Assembly code...

Fedora 24 : 2:vim (2017-9b2cf468d5)

The newest upstream commit, fixing CVE-2017-5953 vim: Tree length values not validated properly when handling a spell file Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean...

CVE-2017-2682

CVE-2017-2682 concerns Siemens RUGGEDCOM NMS web application CSRF vulnerability. The issue affects RUGGEDCOM NMS versions prior to V2.1.0 and involves the web interface on ports 8080/TCP and 8081/TCP, where a remote attacker could induce an authenticated user to perform administrative operations ...

Fedora 25 : 1:xrdp (2017-8fffbae8af)

WARNING: Please note that this update comes with a slightly different syntax of sesman.ini file, so if you edited this file by hand, you may need to look at the .rpmnew file and merge any required changes by hand. This release also creates three files in /etc/xrdp directory if they don't already...

Debian DLA-832-1 : bitlbee security update

CVE-2017-5668 Fix for incomplete fix for 'NULL pointer dereference with file transfer request from unknown contacts'. Though this package wasn't in Wheezy with this issue, I mention it here. The fix was done with the second patch for CVE-2016-10189 CVE-2016-10189 NULL pointer dereference with fil...

SUSE SLED12 / SLES12 Security Update : util-linux (SUSE-SU-2017:0555-1)

This update for util-linux fixes the following issues: This security issue was fixed : - CVE-2017-2616: In su with PAM support it was possible for local users to send SIGKILL to selected other processes with root privileges bsc1023041. The update package also includes non-security fixes. See...

VIPA Controls WinPLC7

CVSS v3 7.5 ATTENTION: Remotely exploitable/low skill level to exploit Vendor: VIPA Controls Equipment: WinPLC7 Vulnerability: Stack Buffer Overflow AFFECTED PRODUCTS The following versions of WinPLC7, a PLC programming software, are affected: WinPLC Versions 5.0.45.5921 and prior. IMPACT...

Ubuntu 12.04 LTS : linux, linux-ti-omap4 vulnerabilities (USN-3206-1)

It was discovered that a use-after-free vulnerability existed in the block device layer of the Linux kernel. A local attacker could use this to cause a denial of service system crash or possibly gain administrative privileges. CVE-2016-7910 Dmitry Vyukov discovered a use-after-free vulnerability ...

Ubuntu 16.10 : linux, linux-raspi2 vulnerabilities (USN-3209-1)

It was discovered that the generic SCSI block layer in the Linux kernel did not properly restrict write operations in certain situations. A local attacker could use this to cause a denial of service system crash or possibly gain administrative privileges. CVE-2016-10088 Jim Mattson discovered tha...

Debian DLA-828-1 : gst-plugins-good0.10 security update

Two memory handling issues were found in gst-plugins-good0.10 : CVE-2016-10198 An invalid read can be triggered in the aacparse element via a maliciously crafted file. CVE-2017-5840 An out of bounds heap read can be triggered in the qtdemux element via a maliciously crafted file. For Debian 7...

No Firewalls, No Problem for Google

SAN FRANCISCO—Google may have sent the tired castle analogy of network security’s soft center protected by a tough exterior out to pasture for good. On Tuesday at RSA Conference, Google shared the seven-year journey of its internal BeyondCorp rollout where it affirms trust based on what it knows...

Fedora 25 : xen (2017-cdb53b04e0)

Qemu: net: mcffec: infinite loop while receiving data in mcffecreceive CVE-2016-9776 Qemu: audio: memory leakage in ac97 CVE-2017-5525 Qemu: audio: memory leakage in es1370 device CVE-2017-5526 oob access in cirrus bitblt copy XSA-208, CVE-2017-2615 Note that Tenable Network Security has extracte...

Fedora 24 : spice (2017-05793780f0)

Add upstream patches fixing CVE-2016-9577 and CVE-2016-9578 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additiona...

Fedora 25 : 2:vim (2017-595fec72ef)

The newest upstream commit, fixing CVE-2017-5953 vim: Tree length values not validated properly when handling a spell file Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean...

Fedora 25 : w3m (2016-87dc28b1a0)

Rebase to latest upstream gitrev 20161120 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...