Ubuntu 14.04 LTS / 16.04 LTS : GStreamer Good Plugins vulnerability (USN-3135-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3135-2 advisory. USN-3135-1 fixed a vulnerability in GStreamer Good Plugins. The original security fix was incomplete. This update fixes the problem. Tenable has...

Debian DLA-724-1 : mcabber security update

It was discovered that there was a 'roster push attack' 0 in mcabber, a console-based Jabber XMPP client. For Debian 7 'Wheezy', this issue has been fixed in mcabber version 0.10.1-3+deb7u1. We recommend that you upgrade your mcabber packages. 0...

Debian DLA-722-1 : irssi security update

An information disclosure vulnerability was found in irssi. CVE-2016-7553 Other users on the same machine as the user running irssi with buf.pl loaded may be able to retrieve the whole window contents after /UPGRADE. Furthermore, this dump of the windows contents is never removed afterwards. For...

SUSE SLED12 / SLES12 Security Update : sudo (SUSE-SU-2016:2893-1)

This update for sudo fixes the following issues : - fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality : - noexec bypass via system and popen CVE-2016-7032, bsc1007766 - noexec bypass via wordexp CVE-2016-7076, bsc1007501 Note that Tenable Network Security h...

Ubuntu 14.04 LTS / 16.04 LTS : MoinMoin vulnerabilities (USN-3137-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3137-1 advisory. It was discovered that MoinMoin did not properly sanitize certain inputs, resulting in cross-site scripting XSS vulnerabilities. With...

SUSE SLED12 / SLES12 Security Update : tar (SUSE-SU-2016:2896-1)

This update for tar fixes the following issues : - Fix the POINTYFEATHER vulnerability - GNU tar archiver can be tricked into extracting files and directories in the given destination, regardless of the path names specified on the command line bsc1007188 CVE-2016-6321 - Fix Amanda integration iss...

Fedora 24 : perl-DBD-MySQL (2016-54fd3bf412)

Security fix for CVE-2016-1249 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

Ubuntu 14.04 LTS / 16.04 LTS : LXC vulnerability (USN-3136-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3136-1 advisory. Roman Fiedler discovered a directory traversal flaw in lxc-attach. An attacker with access to an LXC container could exploit this flaw to access files...

Oracle Linux 6 : memcached (ELSA-2016-2820)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2820 advisory. 0:1.4.4-3.el68.1 - fix vulnerabilities allowing remote code execution CVE-2016-8704, CVE-2016-8705, CVE-2016-8706 Tenable has extracted the preceding...

SUSE SLED12 / SLES12 Security Update : bash (SUSE-SU-2016:2872-1) (Shellshock)

This update for bash fixes the following issues : - CVE-2016-7543: Local attackers could have executed arbitrary commands via specially crafted SHELLOPTS+PS4 variables bsc1001299 - CVE-2016-0634: Malicious hostnames could have allowed arbitrary command execution when $HOSTNAME was expanded in the...

Debian DLA-717-1 : moin security update

Several cross-site scripting vulnerabilities were discovered in moin, a Python clone of WikiWiki. A remote attacker can conduct cross-site scripting attacks via the GUI editor's attachment dialogue CVE-2016-7146 and the GUI editor's link dialogue CVE-2016-9119. For Debian 7 'Wheezy', these proble...

Ubuntu 14.04 LTS / 16.04 LTS : tar vulnerability (USN-3132-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3132-1 advisory. Harry Sintonen discovered that tar incorrectly handled extracting files when path names are specified on the command line. If a user or automated syst...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2016-3646)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3646 advisory. - aacraid: Check size values after double-fetch from user Dave Carroll Orabug: 25060055 CVE-2016-6480 CVE-2016-6480 - audit: fix a double fetch in...

Fedora 25 : 1:java-1.8.0-openjdk-aarch32 (2016-55ec95ac45)

October 2016 CPU fixes: http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722 .htmlAppendixJAVA Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format...

Oracle Linux 5 / 6 / 7 : nss / and / nss-util (ELSA-2016-2779)

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2779 advisory. - Mozilla 1314604 / Red Hat CVE-2016-8635 - Remove patch for CVE-2016-1950, which is included in the release Tenable has extracted the precedin...

Debian DLA-708-1 : mysql-5.5 security update

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.53, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see th...

Fedora 25 : phpMyAdmin (2016-49e1e93a66)

phpMyAdmin 4.6.4 2016-08-16 ============================= This release includes many security fixes of various levels of severity. Upstream recommends all users upgrade to this release immediately. For full information on the vulnerabilities fixed and mitigation factors for users who are unable t...

Fedora 25 : ca-certificates (2016-541495b486)

This is an update to the Mozilla CA certificates list version 2.10, which has been published as part of Mozilla NSS 3.27. For additional details, please refer to the NSS 3.27 release notes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS3.27 releasenotes Note: This package versi...

Fedora 25 : ca-certificates (2016-d1408c3ba3)

This is an update to the Mozilla CA certificates list version 2.9, which has been published as part of Mozilla NSS 3.26. This update reverts the CA list to the unmodified upstream CA list. The legacy CA modifications, which had previously been shipped with Fedora, have been reverted to an empty...

Fedora 25 : php-pecl-zip (2016-ea58a428a1)

Version 1.13.5 - Fixed bug php72660 NULL pointer dereference in zendvirtualcwd. Laruence - Fixed bug php68302 impossible to compile php with zip support. cmb - Fixed bug php70752 Depacking with wrong password leaves 0 length files. cmb Note that Tenable Network Security has extracted the precedin...