Fedora 22 : drupal6-6.37-1.fc22 (2015-14444)

"Maintenance and security release of the Drupal 6 series. This release fixes security vulnerabilities. Sites are urged to upgrade immediately after reading the notes below and the security announcement: Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2015-003 No other fixes are...

Ubuntu 14.04 LTS : libvdpau vulnerabilities (USN-2729-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2729-1 advisory. Florian Weimer discovered that libvdpau incorrectly handled certain environment variables. A local attacker could possibly use this issue to gain...

Ubuntu 14.04 LTS : Linux kernel vulnerability (USN-2734-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2734-1 advisory. It was discovered that an integer overflow error existed in the SCSI generic sg driver in the Linux kernel. A local attacker with write permission to a SCSI gener...

Oracle Linux 7 : spice (ELSA-2015-1714)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1714 advisory. 0.12.4-9.1 - Avoid race conditions reading monitor configs from guest. This race could trigger memory corruption host-side Resolves: rhbz1239127 Tenable has...

Oracle Linux 6 / 7 : libXfont (ELSA-2015-1708)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1708 advisory. - CVE-2015-1802: missing range check in bdfReadProperties bug 1258892 - CVE-2015-1803: crash on invalid read in bdfReadCharacters bug 1258892 Tenab...

Oracle Linux 6 : spice-server (ELSA-2015-1715)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1715 advisory. 0.12.4-12.1 - Avoid race conditions reading monitor configs from guest. This race could trigger memory corruption host-side Resolves: rhbz1239124 Tenable has...

SUSE SLED11 / SLES11 Security Update : Recommended update for openldap2 (SUSE-SU-2015:1482-1) (Logjam)

openldap2 was updated to fix one security issue. This security issue was fixed : - CVE-2015-4000: The Logjam Attack / weakdh.org bsc937766. The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description blo...

HP LoadRunner < 12.50 Scenario File Local Code Execution

The version of HP LoadRunner installed on the remote host is prior to 12.50. It is, therefore, affected by a local code execution vulnerability due to an overflow condition that is triggered when handling scenario files .lrs. A local attacker can exploit this, via a specially crafted scenario fil...

SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2015:1476-1)

Mozilla Firefox was updated to version 38.2.1 ESR to fix several critical and non critical security vulnerabilities. - Firefox was updated to 38.2.1 ESR bsc943608 - MFSA 2015-94/CVE-2015-4497 bsc943557 Use-after-free when resizing canvas element during restyling - MFSA 2015-95/CVE-2015-4498...

Ubuntu 15.04 : gnutls28 vulnerabilities (USN-2727-1)

It was discovered that GnuTLS incorrectly handled parsing CRL distribution points. A remote attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. CVE-2015-3308 Kurt Roeckx discovered that GnuTLS incorrectly handled a long DistinguishedName DN entry in a...

Oracle Linux 6 / 7 : jakarta-taglibs-standard (ELSA-2015-1695)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1695 advisory. - Resolves: CVE-2015-0254 - Apply correction for previous CVE-2015-0254 patch prevent XXE in - Resolves: CVE-2015-0254 Tenable has extracted the preceding...

Fedora 23 : mediawiki-1.25.2-2.fc23 (2015-13920)

T94116 SECURITY: Compare API watchlist token in constant time T97391 SECURITY: Escape error message strings in thumb.php T106893 SECURITY: Don't leak autoblocked IP addresses on Special:DeletedContributions T102562 Fix InstantCommons parameters to handle the new HTTPS-only policy of Wikimedia...

Fedora 22 : php-ZendFramework2-2.4.7-1.fc22 / php-guzzle-Guzzle-3.9.3-5.fc22 (2015-13529)

Zend Framework Upstream ChangeLogs: Version 2.4.7 Version 2.4.6 Version 2.4.5 Version 2.4.4 Version 2.4.3 Version 2.4.2 Version 2.4.1 Version 2.4.0 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Oracle Linux 5 / 6 / 7 : firefox (ELSA-2015-1693)

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2015-1693 advisory. 38.2.1-1.0.1 - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat files 38.2.1-...

Debian DLA-301-1 : python-django security update

denial of service possibility in logout view by filling session store Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view provided it wasn't decorated with django.contrib.auth.decorators.loginrequired as done in the admin. This could allow a...

SUSE SLED12 / SLES12 Security Update : p7zip (SUSE-SU-2015:1433-1)

This update fixes the following security issue : - CVE-2015-1038: directory traversal vulnerability bnc912878 This could for the overwriting of arbitrary files through uncompressing a crafted archive, with the privileges of the user running 7z Note that Tenable Network Security has extracted the...

Tenable SecurityCenter Multiple Apache Vulnerabilities (TNS-2015-11)

The Tenable SecurityCenter application installed on the remote host contains a bundled version of Apache HTTP Server prior to 2.4.16. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the chunked transfer coding implementation in httpfilters.c. due to a failure to...

SUSE SLED11 / SLES11 Security Update : glibc (SUSE-SU-2015:1424-1)

This update for glibc provides fixes for security and non-security issues. These security issues have been fixed : - CVE-2015-1781: Buffer length after padding in resolv/nssdns/dns-host.c. bsc927080 - CVE-2013-2207: ptchown did not properly check permissions for tty files, which allowed local use...

SUSE SLED11 / SLES11 Security Update : tiff (SUSE-SU-2015:1420-1)

tiff was updated to fix six security issues found by fuzzing initiatives. These security issues were fixed : - CVE-2014-8127: Out-of-bounds write bnc914890. - CVE-2014-8128: Out-of-bounds write bnc914890. - CVE-2014-8129: Out-of-bounds write bnc914890. - CVE-2014-8130: Out-of-bounds write...

Fedora 21 : xfsprogs-3.2.2-2.fc21 (2015-12406)

Gabriel Vlasiu reported that xfsmetadump, part of the xfsprogs suite of tools for the XFS filesystem, did not properly obfuscate data. xfsmetadump properly obfuscates active metadata, but the rest of the space within that fs block comes through in the clear. This could lead to exposure of stale...