Ubuntu 15.10 : linux vulnerability (USN-2872-1)

Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code with administrative privilege...

Debian DLA-393-1 : srtp security update

Prevent potential DoS attack due to lack of bounds checking on RTP header CSRC count and extension header length. Credit goes to Randell Jesup and the Firefox team for reporting this issue. As there is no aead mode available in the Squeeze version, only srtpunprotect needed to be patched NOTE:...

SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2016:0118-1)

This update for openssh fixes the following issues : - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature bsc961642 - CVE-2016-0778: A malicious or compromised server could could trigger a...

Debian DLA-390-1 : dbconfig-common security update

It was discovered that dbconfig-common could, depending on the local umask, make PostgreSQL database backups that were readable by other users than the database owner. The issue is fixed in version 1.8.46+squeeze.1. Access rights to existing database backups not only for PostgreSQL will be limite...

SUSE SLED11 / SLES11 Security Update : openssh (SUSE-SU-2016:0120-1)

This update for openssh fixes the following issues : - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature bsc961642 - CVE-2016-0778: A malicious or compromised server could could trigger a...

SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:0121-1)

MariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements. The following CVEs have been fixed : - 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870,...

Ubuntu 14.04 LTS : OpenSSH vulnerabilities (USN-2869-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2869-1 advisory. It was discovered that the OpenSSH client experimental support for resuming connections contained multiple security issues. A malicious server could use...

SUSE SLES10 Security Update : java-1_6_0-ibm (SUSE-SU-2016:0113-1) (Bar Mitzvah) (FREAK)

This version update for java-160-ibm to version 6.0.16.15 fixes the following issues : CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844 CVE-2015-4860 CVE-2015-4871 CVE-2015-4872 CVE-2015-4882 CVE-2015-4883...

Ubuntu 14.04 LTS : DHCP vulnerability (USN-2868-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2868-1 advisory. Sebastian Poehn discovered that the DHCP server, client, and relay incorrectly handled certain malformed UDP packets. A remote attacker could use this issue to...

Debian DLA-383-1 : claws-mail security update

'DrWhax' of the Tails project reported that Claws Mail is missing range checks in some text conversion functions. A remote attacker could exploit this to run arbitrary code under the account of a user that receives a message from them using Claws Mail. CVE-2015-8614 There were no checks on the...

Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2860-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2860-1 advisory. A race condition was discovered in the MutationObserver implementation in Blink. If a user were tricked in to opening a specially crafted website, an...

Ubuntu 14.04 LTS : GnuTLS vulnerability (USN-2865-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2865-1 advisory. Karthikeyan Bhargavan and Gaetan Leurent discovered that GnuTLS incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3501)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3501 advisory. - KEYS: Don't permit requestkey to construct a new keyring David Howells Orabug: 22373442 CVE-2015-7872 - KEYS: Fix crash when attempt to garbage...

Ubuntu 14.04 LTS : Firefox vulnerability (USN-2866-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2866-1 advisory. Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform...

Oracle Linux 6 : samba (ELSA-2016-0011)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0011 advisory. - related: 1290706 - Update patch for CVE-2015-5330 - resolves: 1290706 - CVE-2015-5299 - related: 1290706 - CVE-2015-5296 - related: 1290706 -...

Ubuntu 14.04 LTS : libpng vulnerabilities (USN-2861-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2861-1 advisory. It was discovered that libpng incorrectly handled certain small bit-depth values. If a user or automated system using libpng were tricked into opening a...

Ubuntu 14.04 LTS : ldb vulnerabilities (USN-2856-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2856-1 advisory. Thilo Uttendorfer discovered that the ldb incorrectly handled certain zero values. A remote attacker could use this issue to cause applications using ldb...

Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerability (USN-2857-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2857-2 advisory. Nathan Williams discovered that overlayfs in the Linux kernel incorrectly handled setattr operations. A local unprivileged attacker could use this to create files...

Ubuntu 14.04 LTS : Linux kernel (Wily HWE) vulnerability (USN-2858-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2858-2 advisory. Nathan Williams discovered that overlayfs in the Linux kernel incorrectly handled setattr operations. A local unprivileged attacker could use this to create files...

Ubuntu 15.10 : linux vulnerability (USN-2858-1)

Nathan Williams discovered that overlayfs in the Linux kernel incorrectly handled setattr operations. A local unprivileged attacker could use this to create files with administrative permission attributes and execute arbitrary code with elevated privileges. Note that Tenable Network Security has...