Unbreakable Enterprise kernel security update

4.1.12-124.24.1 - pinctrl: amd: Use devmpinctrlregister for pinctrl registration Laxman Dewangan Orabug: 27539246 CVE-2017-18174 - mlock: fix mlock count can not decrease in race condition Yisheng Xie Orabug: 27677611 CVE-2017-18221 - perf/core: Fix the perfcputimemaxpercent check Tan Xiaojun...

Important: git

Issue Overview: Git before 2.19.2 on Linux and UNIX executes commands from the current working directory as if '.' were at the end of $PATH in certain cases involving the runcommand API and run-command.c, because there was a dangerous change from execvp to execv during 2017.CVE-2018-19486 Affecte...

[SECURITY] Fedora 29 Update: tmux-2.8-2.fc29

tmux is a "terminal multiplexer." It enables a number of terminals or windows to be accessed and controlled from a single terminal. tmux is intended to be a simple, modern, BSD-licensed alternative to programs such as GNU Screen...

kernel security update

2.6.18-419.0.0.0.11 - x8664/entry: Don't use IST entry for BP stack orabug 28452062 CVE-2018-8897...

CVE-2018-11565

Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to mentioning the usernames that are already taken by people registered in the system rather than masking that information...

beep: Local privilege escalation

Background The advanced PC speaker beeper. Description A race condition, if setuid, was discovered in beep. Impact A local attacker could escalate privileges. Workaround There is no known workaround at this time. Resolution All beep users should upgrade to the latest version: emerge --sync emerge...

CVE-2018-1083

Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path which leads to code execution in the context of the user who tries to use autocomplete to traverse the before mention...

Security update for java-1_7_0-openjdk (important)

This update for java-170-openjdk fixes the following issues: Security issues fixed in OpenJDK 7u171 January 2018 CPUbsc1076366: - CVE-2018-2579: Improve key keying case - CVE-2018-2588: Improve LDAP logins - CVE-2018-2599: Improve reliability of DNS lookups - CVE-2018-2602: Improve usage messages...

CVE-2017-17511

KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to prefs.c and worldgui.c...

Updated libxfont/libxfont2 packages fix security vulnerability

Fixes open files with ONOFOLLOW. CVE-2017-16611...

libXfont -- permission bypass when opening files through symlinks

the freedesktop.org project reports: A non-privileged X client can instruct X server running under root to open any file by creating own directory with "fonts.dir", "fonts.alias" or any font file being a symbolic link to any other file in the system. X server will then open it. This can be issue...

CVE-2017-1000176

Removed by vendor...

CVE-2016-0634

The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine...

[slackware-security] libsoup

New libsoup packages are available for Slackware 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/libsoup-2.52.2-i586-3slack14.2.txz: Rebuilt. Fixed a chunked decoding buffer overrun that could be exploited against either...

Updated libsamplerate packages fix security vulnerability

It was discovered that libsamplerate contained a global buffer overflow in calcoutputsingle CVE-2017-7697...

openjpeg: Integer overflow in opj_pi_create_decode

An integer overflow, leading to a heap buffer overflow, was found in OpenJPEG. An attacker could create a crafted JPEG2000 image that, when loaded by an application using openjpeg, could lead to a crash or, potentially, code execution...

CVE-2017-5992

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document...

CVE-2016-7410

The dwarfreadlocsection function in dwarfloc.c in libdwarf 20160613 allows attackers to cause a denial of service buffer over-read via a crafted file...

LUNAR - Lockdown UNix Auditing and Reporting

A UNIX security auditing tool based on several security frameworks Introduction This scripts generates a scored audit report of a Unix host's security. It is based on the CIS and other frameworks. Where possible there are references to the CIS and other benchmarks in the code documentation. Why a...

UNIX security auditing tool: lunar

UNIX security auditing tool Lockdown UNix Auditing and Reporting This scripts generates a scored audit report of a Unix host’s security. It is based on the CIS and other frameworks. Why a shell script? I wanted a tool that was able to run on locked down systems where other tools may not be...