[SECURITY] [DSA 3364-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3364-1 [email protected] https://www.debian.org/security/ Ben Hutchings September 21, 2015 https://www.debian.org/security/faq -...

DSA-3364-1 linux - security update

Bulletin has no description...

Debian Security Advisory DSA 3364-1 (linux - security update)

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation or denial of service. CVE-2015-0272 It was discovered that NetworkManager would set IPv6 MTUs based on the values received in IPv6 RAs Router Advertisements, without sufficiently validating...

Debian: Security Advisory (DSA-3364-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DLA-310-1 linux-2.6 - security update

Bulletin has no description...

Race condition

Race condition in net/sctp/socket.c in the Linux kernel before 4.1.2 allows local users to cause a denial of service list corruption and panic via a rapid series of system calls related to sockets, as demonstrated by setsockopt calls...

CVE-2015-3212

Race condition in net/sctp/socket.c in the Linux kernel before 4.1.2 allows local users to cause a denial of service list corruption and panic via a rapid series of system calls related to sockets, as demonstrated by setsockopt calls...

RHEL 7 : kernel-rt (RHSA-2015:1565)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1565 advisory. - kernel: netfilter connection tracking extensions denial of service CVE-2014-9715 - kernel: execution in the early microcode loader...

mysql: use of SSL/TLS can not be enforced in mysql client library (oCERT-2015-003, BACKRONYM)

It was found that the MySQL client library permitted but did not require a client to use SSL/TLS when establishing a secure connection to a MySQL server using the "--ssl" option. A man-in-the-middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client an...

kernel: ping sockets: use-after-free leading to local privilege escalation

It was found that the Linux kernel's ping socket implementation did not properly handle socket unhashing during spurious disconnects, which could lead to a use-after-free flaw. On x86-64 architecture systems, a local user able to create ping sockets could use this flaw to crash the system. On...

Microsoft Windows WebDAV Man-in-the-Middle Information Disclosure Vulnerability (CNVD-2015-05494)

Microsoft Windows is a popular operating system. A security vulnerability exists in Microsoft Windows WebDAV where the WebDAV client allows SSL 2.0 man-in-the-middle attackers to force the encryption algorithm to downgrade to SSL 2.0 and then decrypt the communication...

The vulnerability of the OpenSSL library, which allows a hacker to trigger a service failure

The vulnerability of the ssl3writebytes function in the OpenSSL library is related to errors in the code. Exploiting this vulnerability can allow a remote attacker to cause service interruptions due to errors in processing a series of input/output operations...

Microsoft XML Core Services Man-in-the-Middle Information Disclosure Vulnerability (CNVD-2015-05495)

Microsoft XML Core Services MSXML is a user to allow the use of JScript, VBScript and Visual Studio 6.0 users to develop XML-based applications , in order to interoperate with other applications that follow the XML 1.0 standard . A security vulnerability exists in Microsoft XML Core Services that...

kernel: ping sockets: use-after-free leading to local privilege escalation

It was found that the Linux kernel's ping socket implementation did not properly handle socket unhashing during spurious disconnects, which could lead to a use-after-free flaw. On x86-64 architecture systems, a local user able to create ping sockets could use this flaw to crash the system. On...

MS15-084: Vulnerabilities in XML core services could allow information disclosure: August 11, 2015

Resolves vulnerabilities in Windows and Office that could allow information disclosure by either exposing memory addresses if a user clicks a specially crafted link or by explicitly allowing the use of Secure Sockets Layer SSL 2.0.Summary This security update resolves vulnerabilities in Microsoft...

MS15-084: Description of the security update for Windows XML core services: August 11, 2015

None None...

kernel: ping sockets: use-after-free leading to local privilege escalation

It was found that the Linux kernel's ping socket implementation did not properly handle socket unhashing during spurious disconnects, which could lead to a use-after-free flaw. On x86-64 architecture systems, a local user able to create ping sockets could use this flaw to crash the system. On...

kernel: ping sockets: use-after-free leading to local privilege escalation

It was found that the Linux kernel's ping socket implementation did not properly handle socket unhashing during spurious disconnects, which could lead to a use-after-free flaw. On x86-64 architecture systems, a local user able to create ping sockets could use this flaw to crash the system. On...

389-ds-base: nsSSL3Ciphers preference not enforced server side (regression)

389 Directory Server formerly Fedora Directory Server before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to have unspecified impact by requesting to use a disabled cipher...

SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack

A flaw was found in the way SSL 3.0 handled padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining CBC mode. This flaw allows a man-in-the-middle MITM attacker to decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a...