Debian DLA-655-1 : mpg123 security update

Several security vulnerabilities have been discovered in mpg123, an MPEG layer 1/2/3 audio decoder and player. An attacker could take advantage of these flaws to cause a denial of service against mpg123 or applications using the libmpg123 library with a carefully crafted input file. CVE-2014-9497...

Debian DLA-661-1 : libarchive security update

Agostino Sarubbo of Gentoo discovered several security vulnerabilities in libarchive, a multi-format archive and compression library. An attacker could take advantage of these flaws to cause a buffer overflow or an out of bounds read using a carefully crafted input file. CVE-2016-8687 Agostino...

Oracle Linux 5 : openssl (ELSA-2016-3627)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3627 advisory. - fix CVE-2016-2177 - possible integer overflow - fix CVE-2016-2178 - non-constant time DSA operations - fix CVE-2016-2182 - possible buffer overflow i...

Ubuntu 14.04 LTS : DBD::mysql vulnerabilities (USN-3103-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3103-1 advisory. It was discovered that DBD::mysql incorrectly handled certain memory operations. A remote attacker could use this issue to cause DBD::mysql to crash,...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3626)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-3626 advisory. kernel-uek 4.1.12-61.1.14 - net: add recursion limit to GRO Sabrina Dubroca Orabug: 24829133 CVE-2016-7039 Tenable has extracted the preceding description...

SUSE SLES11 Security Update : xen (SUSE-SU-2016:2507-1) (Bunker Buster)

This update for xen fixes several issues. These security issues were fixed : - CVE-2016-7092: The getpagefroml3e function in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables bsc995785 - CVE-2016-7093: Xe...

UPnP API Listing

According to its UPnP data, the remote device supports a SOAP API over UPnP. Nessus was able to retrieve and parse the UPnP Service Control Protocol Document XML. TRUSTED...

SUSE SLED12 / SLES12 Security Update : X Window System client libraries (SUSE-SU-2016:2505-1)

This update for the X Window System client libraries fixes a class of privilege escalation issues. A malicious X Server could send specially crafted data to X clients, which allowed for triggering crashes, or privilege escalation if this relationship was untrusted or crossed user or permission...

Ubuntu 16.04 LTS : Tracker vulnerability (USN-3101-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3101-1 advisory. It was discovered that Tracker incorrectly handled certain malformed GIF images. If a user or automated system were tricked into downloading a specially-crafted G...

Fedora 24 : libdwarf (2016-328754be1c)

Update to 20160929 upstream release Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Fedora 24 : libXfixes (2016-ff5a2f4839)

Security fix for CVE-2016-7944 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

SUSE SLED12 Security Update : libreoffice (SUSE-SU-2016:2472-1)

LibreOffice was updated to version 5.1.5.2, bringing enhancements and bug fixes. - CVE-2016-4324: Parsing the Rich Text Format character style index was insufficiently checked for validity. Documents could be constructed which dereference an iterator to the first entry of an empty STL container...

Debian DLA-648-1 : c-ares security update

Gzob Qq discovered that the query-building functions in c-ares, an asynchronous DNS request library would not correctly process crafted query names, resulting in a heap buffer overflow and potentially leading to arbitrary code execution. For Debian 7 'Wheezy', these problems have been fixed in...

Fedora 23 : curl (2016-80f4f71eff)

reject negative string lengths in curleasyunescape CVE-2016-7167 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Oracle Linux 6 : kernel (ELSA-2016-2006)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2006 advisory. - net tcp: make challenge acks less predictable Florian Westphal 1355606 1355607 CVE-2016-5696 - usbhid hiddev: validate numvalues for HIDIOCGUSAGES,...

Ubuntu 14.04 LTS / 16.04 LTS : PHP vulnerabilities (USN-3095-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3095-1 advisory. Taoguang Chen discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue...

Debian DLA-644-1 : libav security update

Multiple vulnerabilities have been found in libav : CVE-2015-1872 The ffmjpegdecodesof function in libavcodec/mjpegdec.c in Libav before 0.8.18 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service out-of-bounds...

Debian DLA-641-1 : ruby-activesupport-3.2 security update

Active Support in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters. For Debian 7 'Wheezy', these problems...

Oracle Linux 6 / 7 : python-twisted-web (ELSA-2016-1978)

The remote Oracle Linux 6 / 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2016-1978 advisory. 8.2.0-5 - Rebase HTTPoxy patch and bump release for rebuild Resolves: rhbz1358789 8.2.0-4 - Fix HTTPoxy CVE-2016-1000111 Resolves: rhbz1358789 Tenable has...

Ubuntu 16.04 LTS : Systemd vulnerability (USN-3094-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3094-1 advisory. Andrew Ayer discovered that Systemd improperly handled zero-length notification messages. A local unprivileged attacker could use this to cause a denial of servic...