Debian DLA-894-1 : samba security update

Jann Horn of Google discovered a time-of-check, time-of-use race condition in Samba, a SMB/CIFS file, print, and login server for Unix. A malicious client can take advantage of this flaw by exploting a symlink race to access areas of the server file system not exported under a share definition. F...

Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3257-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3257-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, ...

Debian DLA-890-1 : ming security update

It was discovered that there were multiple heap-based buffer overflows in ming, a library to generate SWF Flash files. The updated packages prevent a crash in the 'listswf' utility due to a heap-based buffer overflow in the parseSWFRGBA function and several other functions in parser.c...

Fedora 25 : xen (2017-054729ab08)

Qemu: 9pfs: host memory leakage via v9fscreate CVE-2017-7377 1437873 x86: broken check in memoryexchange permits PV guest breakout XSA-212, CVE-2017-7228 1438804 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenabl...

SUSE SLED12 / SLES12 Security Update : dracut (SUSE-SU-2017:0951-1)

This update for dracut fixes the following issues: Security issues fixed : - CVE-2016-8637: When the early microcode loading was enabled during initrd creation, the initrd would be read-only available for all users, allowing local users to retrieve secrets stored in the initial ramdisk. bsc100834...

SUSE SLED12 / SLES12 Security Update : jasper (SUSE-SU-2017:0953-1)

This update for jasper fixes the following issues: Security issues fixed : - CVE-2016-9600: NULL pointer Dereference due to missing check for UNKNOWN color space in JP2 encoder bsc1018088 - CVE-2016-10251: Use of uninitialized value in jpcpinextcprl jpct2cod.c bsc1029497 - CVE-2017-5498: left-shi...

SUSE SLES11 Security Update : ruby (SUSE-SU-2017:0948-1)

This update for ruby fixes the following issues: Secuirty issues fixed : - CVE-2015-1855: Ruby OpenSSL Hostname Verification bsc926974 - CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL bsc959495 Bugfixes : - fix small mistake in the backport for bsc986630 Note that Tenable Network...

SUSE SLED12 Security Update : gimp (SUSE-SU-2017:0945-1)

This update for gimp fixes the following issues: This security issue was fixed : - CVE-2007-3126: Context-dependent attackers were able to cause a denial of service via an ICO file with an InfoHeader containing a Height of zero bsc1032241. The update package also includes non-security fixes. See...

SUSE SLED12 / SLES12 Security Update : audiofile (SUSE-SU-2017:0940-1)

This audiofile update fixes the following issue: Security issues fixed : - CVE-2015-7747: Fixed buffer overflow issue when changing both number of channels and sample format. bsc949399 - CVE-2017-6827: heap-based buffer overflow in MSADPCM::initializeCoefficients MSADPCM.cpp bsc1026979 -...

Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel vulnerability (USN-3256-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3256-1 advisory. Andrey Konovalov discovered that the AFPACKET implementation in the Linux kernel did not properly validate certain block-size data. A local attacker...

Debian DLA-882-1 : tryton-server security update

It was discovered that there was a path suffix injection attack in tryton-server, a general purpose application platform. For Debian 7 'Wheezy', this issue has been fixed in tryton-server version 2.2.4-1+deb7u4. We recommend that you upgrade your tryton-server packages. NOTE: Tenable Network...

Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel (HWE) vulnerability (USN-3256-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3256-2 advisory. USN-3256-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. This update provides the corresponding...

Ubuntu 16.04 LTS : LightDM vulnerability (USN-3255-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3255-1 advisory. It was discovered that LightDM incorrectly handled home directory creation for guest users. A local attacker could use this issue to gain ownership of arbitrary...

Ubuntu 14.04 LTS / 16.04 LTS : Nagios vulnerabilities (USN-3253-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3253-1 advisory. It was discovered that Nagios incorrectly handled certain long strings. A remote authenticated attacker could use this issue to cause Nagios ...

Fedora 24 : moodle (2017-0fcaf52f1a)

Update for multiple CVEs Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Google Cloud Platform Compute Engine Instance Metadata Enumeration (Unix)

The remote host appears to be a Google Compute Engine instance. Nessus was able to use the metadata API to collect information about the system. TRUSTED...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:0876-1)

This update for the Linux Kernel 3.12.60-5260 fixes one issue. The following security bugs were fixed : - CVE-2017-7184: The XFRM processsing in the Linux kernel 16.10 allowed local users to obtain root privileges or cause a denial of service heap-based out-of-bounds access via an integer overflo...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:0873-1)

This update for the Linux Kernel 3.12.55-5245 fixes one issue. The following security bugs were fixed : - CVE-2017-7184: The XFRM processsing in the Linux kernel 16.10 allowed local users to obtain root privileges or cause a denial of service heap-based out-of-bounds access via an integer overflo...

Ubuntu 14.04 LTS / 16.04 LTS : AppArmor vulnerability (USN-3247-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3247-1 advisory. Stphane Graber discovered that AppArmor incorrectly unloaded some profiles when restarted or upgraded, contrary to expected behavior. Tenable has...

Fedora 24 : webkitgtk4 (2017-0f38995622)

Highlights of the 2.16.0 release : - Hardware acceleration is now enabled on demand to drastically reduce memory consumption. - CSS Grid Layout is enabled by default. - New WebKitSetting to set the hardware acceleration policy. - UI process API to configure network proxy settings. - Improved...