Debian DLA-1741-1 : php5 security update

Several vulnerabilities have been found in php5, a server-side, HTML-embedded scripting language. CVE-2019-9637 rename across the device may allow unwanted access during processing. CVE-2019-9638, CVE-2019-9639 Uninitialized read in exifprocessIFDinMAKERNOTE. CVE-2019-9640 Invalid Read on...

Debian DLA-1736-1 : dovecot security update

A security vulnerability was discovered in the Dovecot email server. When reading FTS headers from the Dovecot index, the input buffer size is not bounds-checked. An attacker with the ability to modify dovecot indexes, can take advantage of this flaw for privilege escalation or the execution of...

SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2019:0803-1)

This update for openssl fixes the following issues : Security issues fixed : The 9 Lives of Bleichenbacher's CAT: Cache Attacks on TLS Implementations bsc1117951 CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond...

Fedora 28 : putty (2019-9e1a1cd634)

This is new version of putty fixing few security vulnerabilities. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Ubuntu 18.04 LTS : mod_auth_mellon vulnerabilities (USN-3924-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3924-1 advisory. It was discovered that modauthmellon incorrectly handled certain requests. An attacker could possibly use this issue to redirect a user to a malicious UR...

Fedora 29 : svgsalamander (2019-3cbce64a64)

New upstream release with security fix for CVE-2017-5617 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Debian DLA-1734-1 : libraw security update

Secunia Research has discovered multiple vulnerabilities in libraw, a raw image decoder library, which can be exploited to cause a Denial of Service. The issues contain divisions by zero, out-of-bounds read memory access, heap-based buffer overflows and NULL pointer dereferences. For Debian 8...

SUSE SLED15 / SLES15 Security Update : gd (SUSE-SU-2019:0771-1)

This update for gd fixes the following issues : Security issues fixed : CVE-2019-6977: Fixed a heap-based buffer overflow the GD Graphics Library used in the imagecolormatch function bsc1123361. CVE-2019-6978: Fixed a double free in the gdImagePtr functions bsc1123522. Note that Tenable Network...

SUSE SLED15 / SLES15 Security Update : ntp (SUSE-SU-2019:0777-1)

This update for ntp fixes the following issues : Security issue fixed : CVE-2019-8936: Fixed a NULL pointer exception which could allow an authenticated attcker to cause segmentation fault to ntpd bsc1128525. Other issues addressed: Fixed several bugs in the BANCOMM reclock driver. Fixed...

Tenable Nessus < 8.3.0 Multiple Vulnerabilities (TNS-2019-02)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 8.3.0. It is, therefore, affected by: - An information disclosure vulnerability exists in OpenSSL. A remote attacker may be able to obtain sensitive information, caused by the failure to...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0767-1)

The SUSE Linux Enterprise Server 12 SP4 Azure kernel was updated to fix various issues. The following security bugs were fixed : CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc1129179. CVE-2019-9213: expanddownwards in mm/mmap.c lacked a chec...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : XMLTooling vulnerability (USN-3921-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3921-1 advisory. It was discovered that XMLTooling incorrectly handled certain XML files with invalid data. An attacker could use this issue to cause...

FreeBSD : Python -- NULL pointer dereference vulnerability (d74371d2-4fee-11e9-a5cd-1df8a848de3d)

Python Changelog : bpo-35746: CVE-2019-5010 Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL distribution points with empty DP or URI correctly. A malicious or buggy certificate can result into segfault. Vulnerability TALOS-2018-0758 reported by Colin Read and Nicolas Ed...

Debian DLA-1728-1 : openssh security update

Multiple scp client vulnerabilities have been discovered in OpenSSH, the premier connectivity tool for secure remote shell login and secure file transfer. CVE-2018-20685 In scp.c, the scp client allowed remote SSH servers to bypass intended access restrictions via the filename of . or an empty...

Debian DLA-1727-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code. For Debian 8 'Jessie', these problems have been fixed in version 60.6.1esr-1deb8u1. We recommend that you upgrade your firefox-esr packages. NOTE: Tenabl...

Fedora 29 : libarchive (2019-0233ec0ff3)

Security fix for CVE-2018-1000877 CVE-2018-1000878 CVE-2018-1000879 CVE-2018-1000880 ---- Applied various flaws from upsteam Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clea...

SUSE SLED12 / SLES12 Security Update : ucode-intel (SUSE-SU-2019:0736-1)

This update for ucode-intel fixes the following issues : Updated to the 20190312 bundle release bsc1129231 New Platforms : AML-Y22 H0 6-8e-9/10 0000009e Core Gen8 Mobile WHL-U W0 6-8e-b/d0 000000a4 Core Gen8 Mobile WHL-U V0 6-8e-d/94 000000b2 Core Gen8 Mobile CFL-S P0 6-9e-c/22 000000a2 Core Gen9...

SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2019:0678-1)

This update for openssl-11 OpenSSL Security Advisory 6 March 2019 fixes the following issues : Security issue fixed : CVE-2019-1543: Fixed an implementation error in ChaCha20-Poly1305 where it was allowed to set IV with more than 12 bytes bsc1128189. Other issues addressed: Fixed a segfault in...

Fedora 28 : tcpflow (2019-8cdd669aca)

Update tcpflow to 1.5.2 tag at github, fixing a security issue. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Debian DLA-1725-1 : rsync security update

Trail of Bits used the automated vulnerability discovery tools developed for the DARPA Cyber Grand Challenge to audit zlib. As rsync, a fast, versatile, remote and local file-copying tool, uses an embedded copy of zlib, those issues are also present in rsync. CVE-2016-9840 In order to avoid...