Debian DLA-177-1 : openssl security update

Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2015-0209 It was discovered that a malformed EC private key might result in memory corruption. CVE-2015-0286 Stephen...

Debian DLA-74-1 : ppp security update

This updates fixes a potential integer overflow in option parsing. A user in the group 'dip' could provide a specially crafted configuration file of more than 2G and generate an integer overflow. This may enable an attacker to overwrite the heap and thereby corrupt security-relevant variables. Se...

Debian DLA-144-1 : polarssl security update

A vulnerability was discovered in PolarSSL, a lightweight crypto and SSL/TLS library. A remote attacker could exploit this flaw using specially crafted certificates to mount a denial of service against an application linked against the library application crash, or potentially, to execute arbitra...

Debian DLA-87-1 : dbus security update

This updates fixes multiple local denial of services discovered by Alban Crequy and Simon McVittie. CVE-2014-3477 Fix a denial of service failure to obtain bus name in newly-activated system services that not all users are allowed to access. CVE-2014-3638 Reduce maximum number of pending replies...

Debian DLA-133-1 : unrtf security update

CVE-2014-9274 : check that accesses to color table stay within bounds Patches taken from upstream commits : - CVE-2014-9274: b0cef89a170a66bc48f8dd288ce562ea8ca91f7a CVE-2014-9275 : various crashes . - CVE-2014-9275: 1df886f2e65f7c512a6217588ae8d94d4bcbc63d 3c7ff3f888de0f0d957fe67b6bd4bec9c0d475f...

Debian DLA-114-1 : heirloom-mailx security update

Two security vulnerabilities were discovered in Heirloom mailx, an implementation of the 'mail' command : CVE-2004-2771 mailx interprets interprets shell meta-characters in certain email addresses. CVE-2014-7844 An unexpected feature of mailx treats syntactically valid email addresses as shell...

Debian DLA-163-1 : bind9 security update

Jan-Piet Mens discovered that the BIND DNS server would crash when processing an invalid DNSSEC key rollover, either due to an error on the zone operator's part, or due to interference with network traffic by an attacker. This issue affects configurations with the directives 'dnssec-validation...

Debian DLA-80-1 : libxml2 security update

Sogeti found a denial of service flaw in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption denial of service...

Debian DLA-84-1 : curl security update

Symeon Paraschoudis discovered that the curleasyduphandle function in cURL, an URL transfer library, has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending, while performing a HTTP POST operation. This bug requires CURLOPTCOPYPOSTFIELDS and...

Debian DLA-119-1 : subversion security update

Evgeny Kotkov discovered a NULL pointer dereference while processing REPORT requests in moddavsvn, the Subversion component which is used to serve repositories with the Apache web server. A remote attacker could abuse this vulnerability for a denial of service. We recommend that you upgrade your...

Debian DLA-173-1 : putty security update

MATTA-2015-002 Florent Daigniere discovered that PuTTY did not enforce an acceptable range for the Diffie-Hellman server value, as required by RFC 4253, potentially allowing an eavesdroppable connection to be established in the event of a server weakness. 779488 CVE-2015-2157 Patrick Coleman...

Debian DLA-89-1 : nss security update

In nss, a set of libraries designed to support cross-platform development of security-enabled client and server applications, Tyson Smith and Jesse Schwartzentruber discovered a use-after-free vulnerability that allows remote attackers to execute arbitrary code by triggering the improper removal ...

Oracle Linux 6 : openssl (ELSA-2015-0715)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0715 advisory. - update fix for CVE-2015-0287 to what was released upstream - fix CVE-2015-0209 - potential use after free in d2iECPrivateKey - fix CVE-2015-0286 -...

Mozilla Firefox ESR < 31.5.2

The version of Firefox ESR installed on the remote Windows host is prior to 31.5.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2015-29 advisory. - Pwn2Own asm.js exploitCVE-2015-0817 CVE-2015-0817 Note that Nessus has not tested for this issue but has instead relied on...

Oracle Linux 7 : openssl (ELSA-2015-0716)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0716 advisory. - update fix for CVE-2015-0287 to what was released upstream - fix CVE-2015-0209 - potential use after free in d2iECPrivateKey - fix CVE-2015-0286 -...

Fedora 20 : csync2-1.34-15.fc20 / duplicity-0.6.25-3.fc20 / librsync-1.0.0-1.fc20 / etc (2015-3366)

Changes in librsync 1.0.0 2015-01-23 ====================================== - SECURITY: CVE-2014-8242: librsync previously used a truncated MD4 'strong' check sum to match blocks. However, MD4 is not cryptographically strong. It's possible that an attacker who can control the contents of one part...

Oracle Linux 6 / 7 : unzip (ELSA-2015-0700)

The remote Oracle Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2015-0700 advisory. 6.0-2 - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140 CVE-2014-8141 Resolves: 1196132 1196120 1196124 1196128 Tenable has extracted the preceding...

Fedora 21 : libmspack-0.5-0.1.alpha.fc21 (2015-3249)

updated to bugfix release 0.5alpha Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

Fedora 22 : freexl-1.0.0i-1.fc22 (2015-3517)

Four potentially harmful bugs causing crashes and stack corruption were detected in FreeXL by American Fuzzy Lop and are solved in this release. Please note: such issues are never realistically expected to be encountered in real world XLS spreadsheets, anyway some purposely forged XLS document...

Fedora 22 : libssh2-1.5.0-1.fc22 (2015-3757)

This update, to the current upstream release version, contains numerous bug fixes and enhancements as described in the RELEASE-NOTES file. These include a security fix for CVE-2015-1782 : A malicious attacker could man in the middle a real server and cause libssh2-using clients to crash denial of...