Updated pure-ftpd packages fix security vulnerability

Fixes loading the configuration file...

Sophos PureMessage for UNIX Cross-Site Scripting Vulnerability

Sophos PureMessage for UNIX is a Unix-based antivirus software from Sophos UK, which is designed to protect against viruses, spam, and other security threats that attack users by e-mail. A cross-site scripting vulnerability exists in versions of Sophos PureMessage prior to 6.3.2 for UNIX-based...

CVE-2017-1000476

ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allows attackers to cause a denial of service...

CVE-2017-1000420

Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite...

CVE-2017-17915

In GraphicsMagick 1.4 snapshot-20171217 Q8, there is a heap-based buffer over-read in ReadMNGImage in coders/png.c, related to accessing one byte before testing whether a limit has been reached...

bro -- out of bounds write allows remote DOS

Frank Meier: Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service crash and possibly other exploitation...

CVE-2017-14860

There is a heap-based buffer over-read in the Exiv2::Jp2Image::readMetadata function of jp2image.cpp in Exiv2 0.26. A Crafted input will lead to a denial of service attack...

CVE-2017-14849

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules...

CVE-2017-14867

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code i...

CVE-2017-14625

ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixeloutputcreate in coders/sixel.c...

CVE-2017-1002150

python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection...

CVE-2017-12953

The gig::Instrument::UpdateRegionKeyTable function in gig.cpp in libgig 4.0.0 allows remote attackers to cause a denial of service invalid memory write and application crash via a crafted gig file...

rkhunter Remote Code Execution Vulnerability

rkhunter is a Unix-based scanning tool. The tool is used to scan for rootkits, backdoor programs, and other local vulnerabilities. A security vulnerability exists in versions of rkhunter prior to 1.4.4. A remote attacker can exploit this vulnerability to execute arbitrary code...

GitLab -- Various security issues

GitLab reports: Please reference CVE/URL list for details...

CVE-2016-8568

The gitcommitmessage function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service out-of-bounds read via a cat-file command with a crafted object file...

CVE-2016-7569

Directory traversal vulnerability in docker2aci before 0.13.0 allows remote attackers to write to arbitrary files via a .. dot dot in the embedded layer data in an image...

CVE-2016-4807

Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user admin...

IBM AIX Local Elevation of Privilege Vulnerability (CNVD-2016-13013)

IBM AIX Advanced Interactive eXecutive is a UNIX operating system developed by IBM. A security vulnerability exists in IBM AIX versions 6.1, 7.1 and 7.2. A local attacker can exploit this vulnerability to gain root privileges on the target system...

hostapd -- multiple vulnerabilities

Jouni Malinen reports: EAP-pwd missing last fragment length validation. 2015-7 - CVE-2015-5315 psk configuration parameter update allowing arbitrary data to be written. 2016-1 - CVE-2016-4476...

BMC Software BladeLogic Server Automation Suite RSCD Agent Information Disclosure Vulnerability

BMC Software BladeLogic Server Automation Suite is a solution for managing the lifecycle of servers and applications from BMC Software, USA. An information disclosure vulnerability exists in the RSCD Agent of the BMC Software BladeLogic Server Automation Suite for Linux and Unix platforms. A remo...