kernel security and bug fix update

2.6.32-696.20.1.OL6 - Update genkey bug 25599697 2.6.32-696.20.1 - x86 kaiser/efi: unbreak tboot Waiman Long 1519799 1519802 CVE-2017-5754 - x86 pti/mm: Fix trampoline stack problem with XEN PV Waiman Long 1519799 1519802 CVE-2017-5754 - x86 pti/mm: Fix XEN PV boot failure Waiman Long 1519799...

Fedora 27 : fedpkg / rpkg (2017-9cac2b8b4a)

Update - Fixed chain-build - Remove hard dependency of bash-completion from fedpkg rpkg - Ignore TestModulesCli if openidc-client is unavailable cqi - Port mbs-build to rpkg mprahl - Add .vscode to .gitignore mprahl - Fix TestPatch.testrediff in order to run with old version of mock cqi - Allow t...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4011) (Meltdown) (Spectre)

Description of changes: 4.1.12-112.14.11.el7uek - x86/pti/efi: broken conversion from efi to kernel page table Pavel Tatashin Orabug: 27363926 Orabug: 27352353 CVE-2017-5754 - x86/spec: Always set IBRS to guest value on VMENTER and host on VMEXIT redux Konrad Rzeszutek Wilk Orabug: 27369994 -...

Unbreakable Enterprise kernel security update

4.1.12-112.14.11 - x86/pti/efi: broken conversion from efi to kernel page table Pavel Tatashin Orabug: 27363926 Orabug: 27352353 CVE-2017-5754 - x86/spec: Always set IBRS to guest value on VMENTER and host on VMEXIT redux Konrad Rzeszutek Wilk Orabug: 27369994 - x86/IBRS: Make sure we restore...

Fedora 26 : webkitgtk4 (2017-0ad0e2f390)

This update addresses the following vulnerabilities : - CVE-2017-13866, CVE-2017-13870, CVE-2017-7156, CVE-2017-13856 Additional fixes : - Make WebDriver implementation more spec compliant. - Fix a bug when trying to remove cookies before a web process is spawned. - WebKitWebDriver process no...

Weak Implementation Of Password Cipher

nexus-ldap-common contains a weak implementation of password cipher. It stores the LDAP bind password using the PBE Key Spec with only 23 iterations and a hard-coded password. This allows the cipher to be easily defeated...

DEBIAN-CVE-2017-16539

The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss when certain older Linux kernels are used by leveraging Docker container access to write a "scsi remove-single-device" line to...

UBUNTU-CVE-2017-16539

The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss when certain older Linux kernels are used by leveraging Docker container access to write a "scsi remove-single-device" line to...

CVE-2017-16539

The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackers to trigger data loss when certain older Linux kernels are used by leveraging Docker container access to write a "scsi remove-single-device" line to...

PT-2017-14440

Name of the Vulnerable Software and Affected Versions Docker Moby versions prior to 17.03.2-ce Description The issue concerns the DefaultLinuxSpec function in oci/defaults.go, which does not properly block /proc/scsi pathnames. This oversight allows attackers to cause data loss, particularly when...

What are Javascript Source Maps?

Its generally a good practice to minify and combine your assets Javascript & CSS when deploying to production. This process reduces the size of your assets and dramatically improves your websites load time. Source maps create a map from these compressed asset files back to the source files. This...

Design/Logic Flaw

The scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec file...

CVE-2016-6299

The scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec file...

CVE-2016-6299

The scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec file...

CVE-2016-6299

The scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec file...

UBUNTU-CVE-2016-6299

The scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec file...

CVE-2016-6299

CVE-2016-6299 affects the scm plug-in in mock, where crafted spec files can bypass the chroot protection and grant the attacker root privileges. This is a local-type vulnerability with high impact (C/H/I/A) per CVSS. Fedora advisories indicate a security fix was released for this CVE; other sourc...

CVE-2016-6299

The scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec file...

CVE-2016-6299

Removed by vendor...

PT-2017-2109 · Mock · Mock

Name of the Vulnerable Software and Affected Versions: mock affected versions not specified Description: The issue is related to the scm plug-in in mock, which may allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec file. This is due to...