[SECURITY] Fedora 26 Update: pure-ftpd-1.0.46-2.fc26

Pure-FTPd is a fast, production-quality, standard-comformant FTP server, based upon Troll-FTPd. Unlike other popular FTP servers, it has no known security flaw, it is really trivial to set up and it is especially designed for modern Linux and FreeBSD kernels setfsuid, sendfile, capabilities...

authconfig security, bug fix, and enhancement update

6.2.8-30 - do not use /usr and LIBDIR together 1455233 6.2.8-29 - update translations 1449625 6.2.8-28 - ignore PAMIGNORE for pamsucceedif so application do not fail in pamsetcred 1450425 6.2.8-27 - fix typo in the patch for CVE-2017-7488 1441604 6.2.8-26 - CVE-2017-7488 authconfig: Information...

CVE-2017-11501

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer...

Design/Logic Flaw

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer...

CVE-2017-11501

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer...

Fedora 26 : authconfig (2017-1fe6f25af9)

New release fixing moderate information leak issue with PAM configuration when authentication to remote services via SSSD is enabled. To fix the incorrect configuration run: authconfig --updateall Note that Tenable Network Security has extracted the preceding description block directly from the...

[SECURITY] Fedora 24 Update: jabberd-2.6.1-1.fc24

The jabberd project aims to provide an open-source server implementation of the Jabber protocols for instant messaging and XML routing. The goal of this project is to provide a scalable, reliable, efficient and extensible server that provides a complete set of features and is up to date with the...

[SECURITY] Fedora 26 Update: jabberd-2.6.1-1.fc26

The jabberd project aims to provide an open-source server implementation of the Jabber protocols for instant messaging and XML routing. The goal of this project is to provide a scalable, reliable, efficient and extensible server that provides a complete set of features and is up to date with the...

SUSE SLED12 / SLES12 Security Update : pam (SUSE-SU-2017:1398-1)

This update for pam fixes the following issues : - CVE-2015-3238: pamunix in conjunction with SELinux allowed for DoS attacks bsc934920. - log a hint to syslog if /etc/nologin is present, but empty bsc1015565. - If /etc/nologin is present, but empty, log a hint to syslog. bsc1015565 - Added suppo...

EulerOS 2.0 SP1 : openssh (EulerOS-SA-2016-1053)

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running the login program. In configurations with...

OracleVM 3.3 / 3.4 : coreutils (OVMSA-2017-0052)

The remote OracleVM system is missing necessary patches to address critical security updates : - clean up empty file if cp is failed Orabug 15973168 - pure rebuild to bring back support for aclextendedfilenofollow on x8664 - su: deny killing other processes with root privileges CVE-2017-2616 - fi...

Debian DLA-872-1 : xrdp security update

It was discovered that xrdp, a Remote Desktop Protocol RDP server, calls the PAM function authstartsession in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pamlimits....

openssh security and bug fix update

5.3p1-122 - Allow to use ibmca crypto hardware 1397547 - CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes 1405374 5.3p1-121 - Fix missing hmac-md5-96 from server offer 1373836 5.3p1-120 - Prevent infinite loop when Ctrl+Z pressed at password prompt 1218424 - Remove...

openssh, pam_ssh_agent_auth security update

CentOS Errata and Security Advisory CESA-2017:0641 An update for openssh is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

RedHat Update for openssh RHSA-2017:0641-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 6 : openssh (RHSA-2017:0641)

An update for openssh is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

openssh: privilege escalation via user's PAM environment and UseLogin=yes

It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running the login program. In configurations with UseLogin=yes and the pamenv PAM module configured to read user environment settings, a local user could use this flaw to execute arbitrary code as root...

Moderate: Red Hat Security Advisory: openssh security and bug fix update

An update for openssh is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2017-6967

xrdp 0.9.1 calls the PAM function authstartsession in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pamlimits.so bypass...

CVE-2017-6967

xrdp 0.9.1 calls the PAM function authstartsession in an incorrect location, leading to PAM session modules not being properly initialized, with a potential consequence of incorrect configurations or elevation of privileges, aka a pamlimits.so bypass...