openSUSE Security Update : pax-utils (openSUSE-2017-332)

This update for pax-utils fixes the following issues : - bsc1026959: out of bounds read in scanelf could have unspecified impact pax-utils was updated to 1.2.2, fixing missing miscellaneous fd and memory leak issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

UBUNTU-CVE-2017-6820

rcubeutils.php in Roundcube before 1.1.8 and 1.2.x before 1.2.4 is susceptible to a cross-site scripting vulnerability via a crafted Cascading Style Sheets CSS token sequence within an SVG element...

CVE-2016-9814

The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service memory consumption by leveraging...

CVE-2016-9814: Undefined Security Weakness

The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service memory consumption by leveraging...

Fedora 25 : 3:mariadb (2017-801e01d1ed)

Important change : - Most of the utilities were move to the new sub-package 'server-utils' Other enhancements: see changelog - CVE fixes, SPECfile fixes, patches revision, tests blacklist revisions - Preparation and testing of the Cracklib plugin to be added Note that Tenable Network Security has...

Updated shadow-utils packages fix security vulnerabilities

It was found that shadow-utils-4.2.1 had a potentially unsafe use of getlogin with the concern that the utmp entry might have a spoofed username associated with a correct uid CVE-2016-6251. It was found that shadow-utils-4.2.1 had an incorrect integer handling problem where it looks like the int...

MGASA-2017-0024 Updated shadow-utils packages fix security vulnerabilities

It was found that shadow-utils-4.2.1 had a potentially unsafe use of getlogin with the concern that the utmp entry might have a spoofed username associated with a correct uid CVE-2016-6251. It was found that shadow-utils-4.2.1 had an incorrect integer handling problem where it looks like the int...

CVE-2016-7545

SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call...

OracleVM 3.3 / 3.4 : bind (OVMSA-2017-0033)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2016-9147 ISC change 4510 - Fix regression introduced by CVE-2016-8864 ISC change 4530 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted fro...

OracleVM 3.2 : bind (OVMSA-2017-0034)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2016-9147 ISC change 4510 - Fix regression introduced by CVE-2016-8864 ISC change 4530 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted fro...

GLSA-201701-09 : Xdg-Utils: Command injection

The remote host is affected by the vulnerability described in GLSA-201701-09 Xdg-Utils: Command injection An eval injection vulnerability was discovered in Xdg-Utils. Impact : A context-dependent attacker could execute arbitrary code via the URL argument to xdg-open. Workaround : There is no know...

Xdg-Utils: Command injection

Background Xdg-Utils is a set of tools allowing all applications to easily integrate with the Free Desktop configuration. Description An eval injection vulnerability was discovered in Xdg-Utils. Impact A context-dependent attacker could execute arbitrary code via the URL argument to xdg-open...

exFAT: Multiple vulnerabilities

Background A full-featured exFAT file system implementation for Unix-like systems. Description Two vulnerabilities were found in exFAT. A malformed input can cause a write heap overflow or cause an endless loop. Impact Remote attackers could execute arbitrary code or cause Denial of Service...

GLSA-201612-08 : LinuxCIFS utils: Buffer overflow

The remote host is affected by the vulnerability described in GLSA-201612-08 LinuxCIFS utils: Buffer overflow A stack-based buffer overflow was discovered in cifskey.c or cifscreds.c in LinuxCIFS, as used in pamcifscreds. Impact : A remote attacker could exploit this vulnerability to cause an...

Fedora Update for ecryptfs-utils FEDORA-2016-70b5173c05

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

libguestfs and virt-p2v security, bug fix, and enhancement update

libguestfs 1:1.32.7-3 - Rebase to libguestfs 1.32 in RHEL 7.3 resolves: rhbz1218766 - The full tests are now run after the package has been built. - New tool and subpackage: virt-dib safe diskimage-builder replacement. - New subpackage libguestfs-inspect-icons to reduce dependencies of main pkg s...

RedHat Update for powerpc-utils-python RHSA-2016:2607-02

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Moderate: Red Hat Security Advisory: powerpc-utils-python security update

An update for powerpc-utils-python is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

powerpc-utils-python: arbitrary code execution due to unpickling untrusted input

It was found that the amsvis command of the powerpc-utils-python package did not verify unpickled data before processing it. This could allow an attacker who can connect to an amsvis server process or cause an amsvis client process to connect to them to execute arbitrary code as the user running...

OracleVM 3.2 : bind (OVMSA-2016-0153)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2016-8864 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory OVMSA-2016-0153. include'deprecatednasllevel.inc...