Debian DLA-405-1 : tiff security update

Several security flaws have been found and solved in libtiff, a library that provides support for handling Tag Image File Format TIFF. These flaws concern out of bounds reads and writes in the LogL16Decode, LogLuvDecode24, LogLuvDecode32, LogLuvDecodeTile, LogL16Encode, LogLuvEncode24,...

Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2877-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2877-1 advisory. A bad cast was discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a...

Oracle Linux 5 / 6 / 7 : firefox (ELSA-2016-0071)

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2016-0071 advisory. 38.6.0-1.0.1 - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat files 38.6.0-...

Ubuntu 14.04 LTS : MySQL vulnerabilities (USN-2881-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2881-1 advisory. Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to...

Oracle Linux 5 / 6 / 7 : java-1.6.0-openjdk (ELSA-2016-0067)

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0067 advisory. 1.6.0.38-1.13.10.0.0.1 - Add oracle-enterprise.patch 1:1.6.0.38-1.13.10.0 - Add patch to replace -fno-strict-overflow with -fwrapv on older RHE...

Debian DLA-402-1 : tiff security update

Two security flaws have been found and solved in libtiff, library that provides support for handling Tag Image File Format TIFF. These flaws concern out of bounds reads in the TIFFRGBAImage interface, when parsing unsupported values related to LogLUV and CIELab. CVE-2015-8665 was reported by...

SUSE SLED12 / SLES12 Security Update : gdk-pixbuf (SUSE-SU-2016:0225-1)

This update for gdk-pixbuf fixes the following security issues : - CVE-2015-7552: various overflows, including heap overflow in flipping bmp files bsc958963 The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the precedin...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:0186-1)

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive a security fix. Following security bug was fixed : - A reference leak in keyring handling with joinsessionkeyring could lead to local attackers gain root privileges. bsc962075, CVE-2016-0728. Note that Tenable Network Security has...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:0205-1)

The SUSE Linux Enterprise 12 kernel was updated to receive a security fix. Following security bug was fixed : - A reference leak in keyring handling with joinsessionkeyring could lead to local attackers gain root privileges. bsc962075, CVE-2016-0728. Note that Tenable Network Security has extract...

Ubuntu 14.04 LTS : rsync vulnerability (USN-2879-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2879-1 advisory. It was discovered that rsync incorrectly handled invalid filenames. A malicious server could use this issue to write files outside of the intended destination...

Oracle Linux 6 : java-1.8.0-openjdk (ELSA-2016-0050)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0050 advisory. 1:1.8.0.71-1.b15 - Add patch to turn off strict overflow on IndicRearrangementProcessor,2.cpp - Resolves: rhbz1295751 1:1.8.0.71-0.b15 - January 2016...

Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2016-0053)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0053 advisory. 1.7.0.95-2.6.4.0.0.1 - Update DISTRONAME in specfile 1:1.7.0.95-2.6.4.0 - Remove reference to jre/lib/audio. - Resolves: rhbz1295765 1:1.7.0.95-2.6.4.0...

Juniper Junos IGMPv3 Protocol Multicast DoS (JSA10714)

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability due to a flaw in the IGMPv3 implementation. An unauthenticated, remote attacker can exploit this, via a specially crafted IGMPv3 packet, to affect service availability o...

SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2016:0178-1)

This update for libxml2 fixes the following security issue : - CVE-2015-8710: Parsing short unclosed HTML comment could cause uninitialized memory access, which allowed remote attackers to read contents from previous HTTP requests depending on the application bsc960674 Note that Tenable Network...

Ubuntu 14.04 LTS : eCryptfs vulnerability (USN-2876-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2876-1 advisory. Jann Horn discovered that mount.ecryptfsprivate would mount over certain directories in the proc filesystem. A local attacker could use this to escalate their...

Ubuntu 14.04 LTS : Linux kernel vulnerability (USN-2870-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2870-1 advisory. Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A...

Ubuntu 12.04 LTS : linux-lts-trusty vulnerability (USN-2870-2)

Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code with administrative privilege...

Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerability (USN-2871-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2871-2 advisory. Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:0168-1)

The SUSE Linux Enterprise 12 kernel was updated to receive various security and bugfixes. Following security bugs were fixed : - CVE-2015-7550: A local user could have triggered a race between read and revoke in keyctl bnc958951. - CVE-2015-8539: A negatively instantiated user key could have been...

Ubuntu 15.10 : linux-raspi2 vulnerability (USN-2872-3)

Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code with administrative privilege...