Fedora 25 : php-horde-horde (2016-c5b434fc32)

horde 5.2.12 - jan SECURITY: Add CSRF protection tokens to portal layout forms Reported by Florian Kllich. - jan Fix double loading of hooks.php. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted ...

Fedora 25 : wordpress (2016-34403df2af)

See upstream announcement : - WordPress 4.6.1 Security and Maintenance Release Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora 25 : 2:qemu (2016-3d3218ec41)

CVE-2016-7155: pvscsi: OOB read and infinite loop bz 1373463 - CVE-2016-7156: pvscsi: infinite loop when building SG list bz 1373480 - CVE-2016-7156: pvscsi: infinite loop when processing IO requests bz 1373480 - CVE-2016-7170: vmwarevga: OOB stack memory access bz 1374709 - CVE-2016-7157:...

Debian DLA-707-1 : sudo security update

It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system, popen or wordexp C library functions with a user-supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw...

VMSA-2016-0020:vRealize Operations update addresses REST API deserialization vulnerability

VMSA-2016-0020 vRealize Operations update addresses REST API deserialization vulnerability. VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2016-0020 VMware Security Advisory Severity: Important VMware Security Advisory Synopsis: vRealize Operations update addresses REST API...

Oracle Linux 7 : glibc (ELSA-2016-2573)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2573 advisory. - CVE-2016-3075: Stack overflow in nssdnsgetnetbynamer 1321993 - Fix CVE-2015-7547: getaddrinfo stack-based buffer overflow 1296031. Tenable has extracted the...

Ubuntu 16.04 LTS : Linux kernel (Qualcomm Snapdragon) vulnerability (USN-3128-3)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3128-3 advisory. Ondrej Kozina discovered that the keyring interface in the Linux kernel contained a buffer overflow when displaying timeout events via the /proc/keys interface. A...

Ubuntu 16.04 LTS : Linux kernel vulnerability (USN-3128-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3128-1 advisory. Ondrej Kozina discovered that the keyring interface in the Linux kernel contained a buffer overflow when displaying timeout events via the /proc/keys interface. A...

Tenable Nessus < 6.9.1 XSS Vulnerability

Tenable Nessus is prone to a stored cross-site scripting XSS vulnerability SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Oracle Linux 7 : resteasy-base (ELSA-2016-2604)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2604 advisory. 3.0.6-4 - Resolves: rhbz1378619 - disable SerializerProvider by default 3.0.6-3 - Resolves: rhbz1357624 - fail to build with java 8 3.0.6-2 - Resolves:...

SUSE SLES11 Security Update : jasper (SUSE-SU-2016:2776-1)

This update for jasper fixes the following issues: Security fixes : - CVE-2016-8887: NULL pointer dereference in jp2colrdestroy jp2cod.c bsc1006836 - CVE-2016-8886: memory allocation failure in jasmalloc jasmalloc.c bsc1006599 - CVE-2016-8884,CVE-2016-8885: two NULL pointer dereferences in...

Oracle Linux 7 : util-linux (ELSA-2016-2605)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2605 advisory. 2.23.2-33.0.1 - fix Oracle bug 23001516 - backport lscpu: correct the Virtualization type on Xen DomU PV guest - Reviewed-by: Joe Jin 2.23.2-33 - improve patch...

Oracle Linux 7 : kernel (ELSA-2016-2574)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2574 advisory. - mm remove gupflags FOLLWRITE games from getuserpages Larry Woodman 1385124 CVE-2016-5195 - net add recursion limit to GRO Sabrina Dubroca 1374191...

SUSE SLED12 / SLES12 Security Update : util-linux (SUSE-SU-2016:2764-1)

This update for util-linux fixes a number of bugs and one minor security issue. The following minor vulnerability was fixed : - CVE-2016-5011: Infinite loop DoS in libblkid while parsing DOS partition bsc988361 The following bugs were fixed : - bsc987176: When mounting a subfolder of a CIFS share...

Oracle Linux 5 / 6 / 7 : java-1.7.0-openjdk (ELSA-2016-2658)

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2658 advisory. 1:1.7.0.121-2.6.8.0.0.1 - Update DISTRONAME in specfile 1:1.7.0.121-2.6.8.0 - Turn off HotSpot bootstrap to see if it resolves build issues. -...

MS16-142: Cumulative Security Update for Internet Explorer (3198467)

The version of Internet Explorer installed on the remote Windows host is missing Cumulative Security Update 3198467. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these...

Debian DLA-701-1 : memcached security update

Multiple vulnerabilites have been found in memcached, a high-performance memory object caching system. A remote attacker could take advantage of these flaws to cause a denial of service daemon crash, or potentially to execute arbitrary code. CVE-2013-7291 It was discovered that memcached, when...

Debian DLA-704-1 : openjdk-7 security update

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in information disclosure, denial of service and arbitrary code execution. For Debian 7 'Wheezy', these problems have been fixed in version 7u111-2.6.7-2deb7u1. We recommend that you...

Debian DLA-699-1 : xen security update

Xen does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it. For Debian 7 'Wheezy', thes...

Debian DLA-698-1 : qemu security update

Several vulnerabilities were discovered in qemu, a fast processor emulator. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2016-7909 Quick EmulatorQemu built with the AMD PC-Net II emulator support is vulnerable to an infinite loop issue. It could occur...