SUSE SLED11 / SLES11 Security Update : ntp (SUSE-SU-2015:2058-1)

This ntp update provides the following security and non security fixes : - Update to 4.2.8p4 to fix several security issues bsc951608 : - CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK - CVE-2015-7855: decodenetnum will ASSERT botch instead of returni...

SUSE SLED11 / SLES11 Security Update : xscreensaver (SUSE-SU-2015:2054-1)

The xscreensaver package was updated to fix the following security and non security issues : - CVE-2015-8025: Fixed a crash when hot-swapping monitors while locked bsc952062. - Added xscreensaver-insignalhandlerp.patch needed for fix of signal handling. - Refresh xscreensaver-stars.patch. Note th...

Ubuntu 14.04 LTS : libpng vulnerabilities (USN-2815-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2815-1 advisory. Mikulas Patocka discovered that libpng incorrectly handled certain large fields. If a user or automated system using libpng were tricked into opening a...

Debian DLA-344-1 : nspr security update

Google security engineer Ryan Sleevi found a vulnerability in the NetScape Portable Runtime Library NSPR. NSPR allocated memory without specific checks, making it possible for remote attackers to cause a Denial of Service or execute arbitrary code. For Debian 6 'Squeeze', this issue have been fix...

Ubuntu 14.04 LTS : NVIDIA graphics drivers vulnerability (USN-2814-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2814-1 advisory. It was discovered that the NVIDIA graphics drivers incorrectly sanitized user mode inputs. A local attacker could use this issue to possibly gain root privileges...

Nessus 5.x < 5.2.12 / 6.x < 6.4 Multiple OpenSSL Vulnerabilities

According to its version, the installation of Tenable Nessus running on the remote host is version 5.x prior to 5.2.12 or 6.x prior to 6.4. It is, therefore, affected by multiple denial of service vulnerabilities in the bundled OpenSSL component : - A denial of service vulnerability exists when...

Ubuntu 15.04 / 15.10 : lxcfs vulnerabilities (USN-2813-1)

It was discovered that LXCFS incorrectly enforced directory escapes. A local attacker could use this issue to possibly escalate privileges. CVE-2015-1342 It was discovered that LXCFS incorrectly checked certain permissions. A local attacker could use this issue t possibly escalate privileges...

SUSE SLED12 / SLES12 Security Update : libsndfile (SUSE-SU-2015:2000-1)

The libsndfile package was updated to fix the following security issue : - CVE-2014-9756: Fixed a divide by zero problem that can lead to a Denial of Service DoS bsc953521. - CVE-2015-7805: Fixed heap overflow issue bsc953516. - CVE-2015-8075: Fixed heap overflow issue bsc953519. Note that Tenabl...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2015-3098)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-3098 advisory. - virtio-net: drop NETIFFFRAGLIST Jason Wang Orabug: 22145600 CVE-2015-5156 - RDS: fix race condition when sending a message on unbound socket...

SUSE SLES11 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2015:1978-1)

This Mozilla Firefox, NSS and NSPR update fixes the following security and non security issues. - mozilla-nspr was updated to version 4.10.10 bsc952810 - MFSA 2015-133/CVE-2015-7183 bmo1205157 NSPR memory corruption issues - mozilla-nss was updated to 3.19.2.1 bsc952810 - MFSA...

Ubuntu 14.04 LTS : wpa_supplicant and hostapd vulnerabilities (USN-2808-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2808-1 advisory. It was discovered that wpasupplicant incorrectly handled WMM Sleep Mode Response frame processing. A remote attacker could use this issue to perform...

Ubuntu 14.04 LTS : Linux kernel (Wily HWE) vulnerability (USN-2807-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2807-1 advisory. Ben Serebrin discovered that the KVM hypervisor implementation in the Linux kernel did not properly catch Alignment Check exceptions. An attacker in a guest virtu...

Ubuntu 14.04 LTS : Linux kernel vulnerability (USN-2801-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2801-1 advisory. Ben Serebrin discovered that the KVM hypervisor implementation in the Linux kernel did not properly catch Alignment Check exceptions. An attacker in a guest virtu...

Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2795-1)

It was discovered that in certain situations, a directory could be renamed outside of a bind mounted location. An attacker could use this to escape bind mount containment and gain access to sensitive information. CVE-2015-2925 Moein Ghasemzadeh discovered that the USB WhiteHEAT serial driver...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3094)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-3094 advisory. kernel-uek 2.6.32-400.37.12uek - virtio-net: drop NETIFFFRAGLIST Jason Wang Orabug: 22145596 CVE-2015-5156 Tenable has extracted the preceding description...

IBM WebSphere RCE Java Deserialization Vulnerability

This module exploits a vulnerability in IBM's WebSphere Application Server. An unsafe deserialization call of unauthenticated Java objects exists to the Apache Commons Collections ACC library, which allows remote arbitrary code execution. Authentication is not required in order to exploit this...

Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2798-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2798-1 advisory. It was discovered that in certain situations, a directory could be renamed outside of a bind mounted location. An attacker could use this to escape bind...

Ubuntu 14.04 LTS : NSS vulnerabilities (USN-2791-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2791-1 advisory. Tyson Smith and David Keeler discovered that NSS incorrectly handled decoding certain ASN.1 data. An remote attacker could use this issue to cause NSS to...

SUSE SLED12 / SLES12 Security Update : krb5 (SUSE-SU-2015:1897-1)

krb5 was updated to fix three security issues. These security issues were fixed : - CVE-2015-2695: Applications which call gssinquirecontext on a partially-established SPNEGO context could have caused the GSS-API library to read from a pointer using the wrong type, generally causing a process...

SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2015:1908-1)

xen was updated to version 4.4.3 to fix nine security issues. These security issues were fixed : - CVE-2015-4037: The slirpsmb function in net/slirp.c created temporary files with predictable names, which allowed local users to cause a denial of service instantiation failure by creating...