SUSE SLES11 Security Update : curl (SUSE-SU-2016:2714-1)

This update for curl fixes the following security issues : - CVE-2016-8624: invalid URL parsing with '' bsc1005646 - CVE-2016-8623: Use-after-free via shared cookies bsc1005645 - CVE-2016-8621: curlgetdate read out of bounds bsc1005642 - CVE-2016-8619: double-free in krb5 code bsc1005638 -...

Ubuntu 16.04 LTS : OpenJDK 8 vulnerabilities (USN-3121-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3121-1 advisory. It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy function in certain cases. An attacker...

Debian DLA-689-1 : qemu-kvm security update

Multiple vulnerabilities have been discovered in qemu-kvm, a full virtualization solution on x86 hardware based on Quick EmulatorQemu. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2016-7909 Quick EmulatorQemu built with the AMD PC-Net II emulator suppor...

Default Password 'tech' for 'tech' Account

The account 'tech' on the remote host has the default password 'tech'. A remote attacker can exploit this issue to gain administrative access to the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "tech"; password = "tech"; include'deprecatednasllevel.inc';...

SUSE SLED12 / SLES12 Security Update : python3 (SUSE-SU-2016:2653-1) (httpoxy)

This update provides Python 3.4.5, which brings many fixes and enhancements. The following security issues have been fixed : - CVE-2016-1000110: CGIHandler could have allowed setting of HTTPPROXY environment variable based on user-supplied Proxy request header. bsc989523 - CVE-2016-0772: A...

SUSE SLES11 Security Update : gtk2 (SUSE-SU-2016:2532-1)

This update for gtk2 fixes the following security issues : - CVE-2016-6352: Some crashes were fixed, including a out of bounds write in the OneLine32 function that could be used by attackers to crash GTK/GDK programs. - CVE-2013-7447: Avoid overflow when allocating a cairo pixbuf bsc966682. Note...

SUSE SLES11 Security Update : kernel (SUSE-SU-2016:2614-1) (Dirty COW)

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to fix one security issue. This security bug was fixed : - CVE-2016-5195: Local privilege escalation using MAPPRIVATE. It is reportedly exploited in the wild bsc1004418. Note that Tenable Network Security has extracted the preceding...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:2592-1) (Dirty COW)

The SUSE Linux Enterprise 12 SP1 kernel was updated to fix two issues. This security bug was fixed : - CVE-2016-5195: Local privilege escalation using MAPPRIVATE. It is reportedly exploited in the wild bsc1004418. The update package also includes non-security fixes. See advisory for details. Note...

SUSE SLED12 / SLES12 Security Update : kdump (SUSE-SU-2016:2553-1)

This update for kdump provides several fixes and enhancements : - Refresh kdumprd if /etc/hosts or /etc/nsswitch.conf is changed. bsc943214 - Add a separate systemd service to rebuild kdumprd at boot. bsc943214 - Improve network setup in the kdump environment by reading configuration from wicked ...

SUSE SLES12 Security Update : kernel (SUSE-SU-2016:2636-1) (Dirty COW)

This update for the Linux Kernel 3.12.51-5231 fixes several issues. The following security bugs were fixed : - CVE-2016-5195: A local privilege escalation using MAPPRIVATE was fixed, which is reportedly exploited in the wild bsc1004419. - CVE-2016-4997: The compat IPTSOSETREPLACE and...

Oracle Linux 7 : kernel (ELSA-2016-2098)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2098 advisory. - 3.10.0-327.36.3.OL7 - Oracle Linux certificates Alexey Petrenko 3.10.0-327.36.3 - mm remove gupflags FOLLWRITE games from getuserpages Alexander Gordeev 13851...

Oracle Linux 5 : bind97 (ELSA-2016-2094)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2094 advisory. - Fix CVE-2016-2848 - Fix CVE-2016-2776 - Fix CVE-2016-1285 and CVE-2016-1286 - Fix CVE-2015-8704 - Fix CVE-2015-8000 - Fix CVE-2015-5722 - Fix CVE-2015-5477...

Oracle Linux 5 / 6 : bind (ELSA-2016-2093)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2093 advisory. - Fix CVE-2016-2848 - Fix CVE-2016-2776 - Fix issue with patch for CVE-2016-1285 and CVE-2016-1286 found by test suite - Fix CVE-2016-1285 and CVE-2016-1286...

Fedora 24 : php-pecl-zip (2016-b9cb75981a)

Version 1.13.5 - Fixed bug php72660 NULL pointer dereference in zendvirtualcwd. Laruence - Fixed bug php68302 impossible to compile php with zip support. cmb - Fixed bug php70752 Depacking with wrong password leaves 0 length files. cmb Note that Tenable Network Security has extracted the precedin...

Ubuntu 16.04 LTS : Linux kernel vulnerability (USN-3106-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3106-1 advisory. It was discovered that a race condition existed in the memory manager of the Linux kernel when handling copy-on-write breakage of private read-only memory mapping...

Debian DLA-668-1 : libass security update

Several vulnerabilities were discovered in libass, a library for manipulating the SubStation Alpha SSA subtitle file format. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2016-7969 Mode 0/3 line wrapping equalization in specific cases which could result in...

Debian DLA-669-1 : dwarfutils security update

Several vulnerabilities were discovered in dwarfutils, a tool and library for reading/consuming and writing/producing DWARF debugging information. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2015-8538 A specially crafted ELF file can cause a segmentation...

Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerability (USN-3106-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3106-2 advisory. USN-3106-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE...

Debian DLA-663-1 : tor security update

It has been discovered that Tor treats the contents of some buffer chunks as if they were a NUL-terminated string. This issue could enable a remote attacker to crash a Tor client, hidden service, relay, or authority. This update aims to defend against this general class of security bugs. For Debi...

Debian DLA-666-1 : guile-2.0 security update

Several vulnerabilities were discovered in GNU Guile, an implementation of the Scheme programming language. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2016-8605: The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that...