Debian DLA-181-1 : xerces-c security update

Anton Rager and Jonathan Brossard from the Salesforce.com Product Security Team and Ben Laurie of Google discovered a denial of service vulnerability in xerces-c, a validating XML parser library for C++. The parser mishandles certain kinds of malformed input documents, resulting in a segmentation...

Tenable Passive Vulnerability Scanner Installed (macOS credentialed check)

Binary data pvsinstalledmacosx.nbin...

Fedora 21 : nx-libs-3.5.0.29-1.fc21 (2015-3948)

Update to 3.5.0.29 : - further reduction of code size by Mike Gabriel - /.x2go/config/keystrokes.cfg, /etc/x2go/keystrokes.cfg and /etc/nxagent/keystrokes.cfg are now respected thanks to Horst Schirmeier - security fixes for CVE-2011-2895, CVE-2011-4028, CVE-2013-4396, CVE-2013-6462, CVE-2014-020...

Oracle Linux 7 : ipa / and / slapi-nis (ELSA-2015-0728)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0728 advisory. - CVE-2015-0283 ipa: slapi-nis: infinite loop in getgrnamr and getgrgidr 1202997 - Fix CVE-2015-0283 Tenable has extracted the preceding description...

Fedora 22 : dokuwiki-0-0.24.20140929c.fc22 (2015-3079)

This update fixes CVE-2015-2172 - There's a security hole in the ACL plugins remote API component. The plugin failes to check for superuser permissions before executing ACL addition or deletion. This means everybody with permissions to call the XMLRPC API also has permissions to set up their own...

Fedora 22 : xerces-c-3.1.2-1.fc22 (2015-4226)

Update to xerces-c 3.1.2, fixing CVE-2015-0252. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Debian DLA-27-1 : file security update

Fix various denial of service attacks : CVE-2014-3487 The cdfreadpropertyinfo function does not properly validate a stream offset, which allows remote attackers to cause a denial of service application crash via a crafted CDF file. CVE-2014-3480 The cdfcountchain function in cdf.c in does not...

Debian DLA-95-1 : clamav security update

Two bugs were discovered in clamav and are fixed by this release. One issue is in clamscan, the command line anti-virus scanner included in the package, which could lead to crashes when scanning certain files. CVE-2013-6497 The second issue is in libclamav which caused a heap buffer overflow when...

Debian DLA-104-1 : pdns-recursor security update

Florian Maury from ANSSI discovered a flaw in pdns-recursor, a recursive DNS server : a remote attacker controlling maliciously-constructed zones or a rogue server could affect the performance of pdns-recursor, thus leading to resource exhaustion and a potential denial of service. NOTE: Tenable...

Debian DLA-106-1 : getmail4 security update

Several vulnerabilities have been discovered in getmail4, a mail retriever with support for POP3, IMAP4 and SDPS, that could allow man-in-the-middle attacks. CVE-2014-7273 The IMAP-over-SSL implementation in getmail 4.0.0 through 4.43.0 does not verify X.509 certificates from SSL servers, which...

Debian DLA-113-1 : bsd-mailx security update

It was discovered that bsd-mailx, an implementation of the 'mail' command, had an undocumented feature which treats syntactically valid email addresses as shell commands to execute. Users who need this feature can re-enable it using the 'expandaddr' in an appropriate mailrc file. This update also...

Debian DLA-88-1 : ruby1.8 security update

This update fixes multiple local and remote denial of service and remote code execute problems : CVE-2011-0188 Properly allocate memory, to prevent arbitrary code execution or application crash. Reported by Drew Yao. CVE-2011-2686 Reinitialize the random seed when forking to prevent CVE-2003-0900...

Debian DLA-98-1 : openvpn security update

Dragana Damjanovic discovered that an authenticated client could crash an OpenVPN server by sending a control packet containing less than four bytes as payload. For the oldstable distribution squeeze, this problem has been fixed in version 2.1.3-2+squeeze3 in squeeze-lts. We recommend that you...

Debian DLA-47-1 : lua5.1 security update

Fix stack overflow in vararg functions. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Debian DLA-127-1 : pyyaml security update

Jonathan Gray and Stanislaw Pitucha found an assertion failure in the way wrapped strings are parsed in Python-YAML, a YAML parser and emitter for Python. An attacker able to load specially crafted YAML input into an application using python-yaml could cause the application to crash. NOTE: Tenabl...

Debian DLA-109-1 : libyaml-libyaml-perl security update

Jonathan Gray and Stanislaw Pitucha found an assertion failure in the way wrapped strings are parsed in LibYAML, a fast YAML 1.1 parser and emitter library. An attacker able to load specially crafted YAML input into an application using libyaml could cause the application to crash. This update...

Ubuntu 14.04 LTS : Batik vulnerability (USN-2548-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2548-1 advisory. Nicolas Gregoire and Kevin Schaller discovered that Batik would load XML external entities by default. If a user or automated system were tricked into opening a...

Debian DLA-144-1 : polarssl security update

A vulnerability was discovered in PolarSSL, a lightweight crypto and SSL/TLS library. A remote attacker could exploit this flaw using specially crafted certificates to mount a denial of service against an application linked against the library application crash, or potentially, to execute arbitra...

Debian DLA-87-1 : dbus security update

This updates fixes multiple local denial of services discovered by Alban Crequy and Simon McVittie. CVE-2014-3477 Fix a denial of service failure to obtain bus name in newly-activated system services that not all users are allowed to access. CVE-2014-3638 Reduce maximum number of pending replies...

Debian DLA-74-1 : ppp security update

This updates fixes a potential integer overflow in option parsing. A user in the group 'dip' could provide a specially crafted configuration file of more than 2G and generate an integer overflow. This may enable an attacker to overwrite the heap and thereby corrupt security-relevant variables. Se...