Ubuntu 14.04 LTS : MySQL vulnerabilities (USN-2384-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2384-1 advisory. Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues. MySQL has been updated to...

USN-2384-1: MySQL vulnerabilities

Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues. MySQL has been updated to 5.5.40. In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the...

RHEL 6 : trousers (RHSA-2014:1507)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:1507 advisory. TrouSerS is an implementation of the Trusted Computing Group's Software Stack TSS specification. You can use TrouSerS to write applications that make...

Amazon Linux AMI : python27 (ALAS-2014-380)

It was reported that Python built-in json module have a flaw insufficient bounds checking, which allows a local user to read current process' arbitrary memory. Quoting the upstream bug report : 'The sole prerequisites of this attack are that the attacker is able to control or influence the two...

Fedora 20 : check-mk-1.2.4p5-2.fc20 (2014-11895)

Do not require any other shell than bash since that's the default shell for the Fedora / RHEL distributions New upstream release providing many security fixes. New upstream release providing many security fixes. Note that Tenable Network Security has extracted the preceding description block...

Updated chromium-browser-stable packages fix security vulnerabilites

Updated chromium-browser-stable packages fix security vulnerabilities: Several security issues and other bugs have been fixed since our previous update. See the upstream release announcements for details. Note that as of version 35, the Chromium browser no longer supports browser plugins, includi...

MGASA-2014-0408 Updated torque packages fix CVE-2014-3684

Updated torque packages fix security vulnerabilities: Chad Vizino reported that within a TORQUE Resource Manager job a non-root user could use a vulnerability in the tmadopt library call to kill processes he/she doesn't own including root-owned ones on any node in a job CVE-2014-3684. This update...

Updated torque packages fix CVE-2014-3684

Updated torque packages fix security vulnerabilities: Chad Vizino reported that within a TORQUE Resource Manager job a non-root user could use a vulnerability in the tmadopt library call to kill processes he/she doesn't own including root-owned ones on any node in a job CVE-2014-3684. This update...

Fedora 19 : cups-1.6.4-10.fc19 (2014-9703)

Upstream patches have been applied to prevent long-running Get-Jobs operations preventing other requests from being handled, and to fix the order of completed jobs in Get-Jobs responses. This update fixes a security flaw potentially leading to a disclosure of information. Note that Tenable Networ...

CentOS 5 : nss (CESA-2014:1246)

Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

OpenVPN vulnerable to Shellshock Bash vulnerability

OpenVPN wasn’t immune to the Heartbleed vulnerability in OpenSSL, and it’s not going to sidestep Shellshock either. Fredrick Stromberg, cofounder of Mullvad, a Swedish VPN company, reported that OpenVPN servers are vulnerable to Shellshock , the vulnerability in Bash plaguing Linux, UNIX and Mac ...

php, php53 security update

CentOS Errata and Security Advisory CESA-2014:1326 Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring...

Scientific Linux Security Update : nss and nspr on SL5.x i386/x86_64 (20140916)

A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. CVE-2013-1740 A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker coul...

openSUSE Security Update : dbus-1 (openSUSE-SU-2014:1239-1)

The DBUS-1 service and libraries were updated to upstream release 1.6.24 fixing security issues and bugs. Upstream changes since dbus 1.6.8 + Security fixes - Do not accept an extra fd in the padding of a cmsg message, which could lead to a 4-byte heap buffer overrun. CVE-2014-3635, fdo83622; Sim...

[oss-security] Re: CVE-2014-6271: remote code execution through bash

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MITRE is currently using CVE-2014-7169 to track the report of the incomplete patch, i.e., incorrect function parsing that's present in builds that are up-to-date with the http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-025 changes. We realize that...

Bash Environment Variable Command Execution

Date: Wed, 24 Sep 2014 17:03:19 +0200 From: Florian Weimer To: [email protected] Subject: Re: CVE-2014-6271: remote code execution through bash Florian Weimer: Chet Ramey, the GNU bash upstream maintainer, will soon release official upstream patches...

openSUSE Security Update : dbus-1 (openSUSE-SU-2014:1228-1)

DBUS-1 was upgraded to upstream release 1.8. This brings the version of dbus to the latest stable release from an unstable snapshot 1.7.4 that is know to have several regressions - Upstream changes since 1.7.4 : + Security fixes : - Do not accept an extra fd in the padding of a cmsg message, whic...

Updated gtk+3.0 packages fix CVE-2014-1949

Updated gtk+3.0 packages fix security vulnerability: Clemens Fries reported that, when using Cinnamon, it was possible to bypass the screensaver lock. An attacker with physical access to the machine could use this flaw to take over the locked desktop session CVE-2014-1949. This was fixed by...

Fedora 20 : perl-Plack-1.0031-1.fc20 (2014-9542)

---------------------------------------------------------------------- ---------- ChangeLog : - Fri Aug 8 2014 Ralf Corsepius - 1.0031-1 - Upstream update. - Thu Jan 16 2014 Ralf Corsepius - 1.0030-3 - Move misplaced %exclude-line from base-package to -Test. - Wed Jan 15 2014 Ralf Corsepius -...

Fedora 19 : perl-Plack-1.0031-1.fc19 (2014-9544)

---------------------------------------------------------------------- ---------- ChangeLog : - Fri Aug 8 2014 Ralf Corsepius - 1.0031-1 - Upstream update. - Thu Jan 16 2014 Ralf Corsepius - 1.0030-3 - Move misplaced %exclude-line from base-package to -Test. - Wed Jan 15 2014 Ralf Corsepius -...