SUSE SLES11 Security Update : xorg-x11-server (SUSE-SU-2017:1741-1)

This update for xorg-x11-server fixes the following issues: Security issues : - CVE-2017-2624: Prevent timing attack against MIT cookie. bsc1025029, CVE-2017-2624 Non security issues : - Use arc4random to generate cookies. bsc1025084 - XDrawArc performance improvement bsc1019649 - Fix byte swappi...

Fedora 24 : xen (2017-b3bdaf58bc)

xen: various flaws 1463247 blkif responses leak backend stack data XSA-216 page transfer may allow PV guest to elevate privilege XSA-217 Races in the grant table unmap code XSA-218 x86: insufficient reference counts during shadow emulation XSA-219 x86: PKRU and BND leakage between vCPU-s XSA-220...

Fedora 24 : openvpn (2017-5596f2f94d)

Updates to the latest upstream OpenVPN 2.3.17, containing security updates for CVE-2017-7508, CVE-2017-7520 and CVE-2017-7521. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1735-1) (Stack Clash)

This Linux kernel update for SUSE Linux Enterprise 12 fixes the following issues : - A previous security update to address CVE-2017-1000364 caused unintended side-effects in several other tools, most notably Java. These issues have been remedied. bsc1045340 Note that Tenable Network Security has...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3344-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3344-1 advisory. USN 3328-1 fixed a vulnerability in the Linux kernel. However, that fix introduced regressions for some Java applications. This update addresses the issu...

Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3342-2)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3342-2 advisory. USN-3342-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.10. This update provides the corresponding updates for the Linux Hardware Enablement H...

Fedora 25 : 1:chromium-native_client (2017-a66e2c5b62)

Chromium 59. Add smaller logo files. Fix lots of security bugs: Security fix for CVE-2017-5070, CVE-2017-5071, CVE-2017-5072, CVE-2017-5073, CVE-2017-5074, CVE-2017-5075, CVE-2017-5086, CVE-2017-5076, CVE-2017-5077, CVE-2017-5078, CVE-2017-5079, CVE-2017-5080, CVE-2017-5081, CVE-2017-5082,...

Ubuntu 12.04 LTS : eglibc vulnerability (USN-3323-2) (Stack Clash)

USN-3323-1 fixed a vulnerability in the GNU C Library. This update provides the corresponding update for Ubuntu 12.04 ESM. It was discovered that the GNU C library did not properly handle memory when processing environment variables for setuid programs. A local attacker could use this in...

Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3344-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3344-2 advisory. USN-3344-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enableme...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1704-1) (Stack Clash)

This Linux kernel update for SUSE Linux Enterprise 12 SP1 fixes the following issues : - A previous security update to address CVE-2017-1000364 caused unintended side-effects in several other tools, most notably Java. These issues have been remedied. bsc1045340 Note that Tenable Network Security...

Virtuozzo 7 : crit / criu / criu-devel / python-criu / vzkernel / etc (VZA-2017-056)

According to the version of the crit / criu / criu-devel / python-criu / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - A flaw was found in the way memory was being allocated on the stack for user space binaries. If...

SUSE SLED12 / SLES12 Security Update : poppler (SUSE-SU-2017:1672-1)

This update for poppler fixes the following issues : - CVE-2017-9406: Fixed a memory leak that occurred while parsing invalid XRef attributes bsc1042803. - CVE-2017-9083: Fixed a memory leak that occurred when the parser tried to recover from a broken input file. bsc1040170 Note that Tenable...

SUSE SLED12 / SLES12 Security Update : cairo (SUSE-SU-2017:1671-1)

This update for cairo fixes the following issues : - CVE-2017-7475: Fixed a segfault in getbitmapsurface due to malformed font bsc1036789. - CVE-2016-9082: fix a segfault when using 4GB images since int values were used for pointer operations bsc1007255. Note that Tenable Network Security has...

Tenable SecurityCenter PHP < 5.6.25 Multiple Vulnerabilities (TNS-2016-09)

The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of PHP : - An unspecified flaw exists in the objectcommon2 function in varunserializer.c that occurs when handling objects...

Tenable SecurityCenter PHP < 5.6.30 Multiple Vulnerabilities (TNS-2017-04)

The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of PHP : - A seg fault when loading hostile phar could be used to crash the PHP interpreter or potentially disclose...

Tenable SecurityCenter OpenSSL 1.0.1 < 1.0.1u Multiple Vulnerabilities (SWEET32)

The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of OpenSSL : - Multiple integer overflow conditions exist in s3srvr.c, sslsess.c, and t1lib.c due to improper use of point...

Tenable SecurityCenter PHP < 5.6.26 Multiple Vulnerabilities

The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of PHP : - A flaw exists in ext/standard/varunserializer.re when destroying deserialized objects due to improper validatio...

Tenable SecurityCenter OpenSSL 1.0.2 < 1.0.2k Multiple Vulnerabilities (TNS-2017-04)

The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of OpenSSL : - A carry propagation error exists in the Broadwell-specific Montgomery multiplication procedure when handlin...

Debian DLA-999-1 : openvpn security update

It was discovered that there were multiple out-of-bounds memory read vulnerabilities in openvpn, a popular virtual private network VPN daemon. If clients used a HTTP proxy with NTLM authentication, a man-in-the-middle attacker could cause the client to crash or disclose at most 96 bytes of stack...

Fedora 25 : glibc (2017-79414fefa1) (Stack Clash)

This update addresses CVE-2017-1000366, a vulnerability in the dynamic linker allowing local privilege escalation. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and form...