DLA-372-1 virtualbox-ose - end of support

Bulletin has no description...

Debian Security Advisory DSA 3403-1 (libcommons-collections3-java - security update)

This update backports changes from the commons-collections 3.2.2 release which disable the deserialisation of the functors classes unless the system property org.apache.commons.collections.enableUnsafeSerialization is set to true . This fixes a vulnerability in unsafe applications deserialising...

[SECURITY] [DSA 3389-1] elasticsearch end-of-life

------------------------------------------------------------------------- Debian Security Advisory DSA-3389-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 01, 2015 https://www.debian.org/security/faq -...

FreeBSD : PolarSSL -- Security Fix Backports (d3216606-2b47-11e5-a668-080027ef73ec)

Paul Bakker reports : PolarSSL 1.2.14 fixes one remotely-triggerable issues that was found by the Codenomicon Defensics tool, one potential remote crash and countermeasures against the 'Lucky 13 strikes back' cache-based attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

[BSA-107] Security Update for horizon

Thomas Goirand uploaded new packages for horizon which fixed the following security problem: CVE-2015-3988: Sunil Yadav from IBM Security Services reported a persistent XSS in Horizon. An authenticated user may conduct a persistent XSS attack by setting a malicious metadata to a Glance image, a...

SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2014:1422-1)

OpenJDK was updated to icedtea 2.5.3 OpenJDK 7u71 fixing security issues and bugs. - Security : - S8015256: Better class accessibility - S8022783, CVE-2014-6504: Optimize C2 optimizations - S8035162: Service printing service - S8035781: Improve equality for annotations - S8036805: Correct linker...

[BSA-104] Security update for libreoffice

Rene Engelhard uploaded new packages for libreoffice which fixed the following security problem: CVE-2015-1774: It was discovered that missing input sanitising in Libreoffices filter for HWP documents may result in the execution of arbitrary code if a malformed document is opened. For the...

[BSA-103] Security Update for shibboleth-sp

Matthew Vernon uploaded new packages for shibboleth-sp which fixed the following security problems: CVE-2015-2684 A denial of service vulnerability was found in the Shibboleth a federated identity framework Service Provider. When processing certain malformed SAML messages generated by an...

Low: Red Hat Security Advisory: python-backports-ssl_match_hostname security update

An updated python-backports-sslmatchhostname package that fixes one security issue is now available for Red Hat Enterprise Linux OpenStack Platform 4.0. Red Hat Product Security has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score, which gives...

USN-2232-4: OpenSSL regression

USN-2232-1 fixed vulnerabilities in OpenSSL. One of the patch backports for Ubuntu 10.04 LTS caused a regression for certain applications. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Jüri Aedla discovered that OpenSSL incorrectly handled invalid...

DSA-2982-1 ruby-activerecord-3.2 - security update

Bulletin has no description...

[BSA-096] Security Update for libreoffice

Rene Engelhard uploaded new packages for libreoffice which fixed the following security problems: CVE-2014-0247 It was discovered that LibreOffice unconditionally executed certain VBA macros, contrary to user expectations. https://security-tracker.debian.org/tracker/CVE-2014-0247 The stable...

[oss-security] CVE request: OpenAFS 1.6.8 TMAY fileserver crashes

New code introduced in OpenAFS 1.6.8 does not properly zero fields in the host structure in the OpenAFS fileserver, leading to some variables in the host structure being left initialized from recycled heap memory. While no mechanism for exploitation is currently known, the affected file server...

openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2014:0180-1)

Fix a file conflict between -devel and -headless package - Update to 2.4.4 bnc858818 - changed from xz to gzipped tarball as the first was not available during update - changed a keyring file due release manager change new one is signed by 66484681 from [email protected], see...

openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:0745-1)

apply aarch64 patches on openSUSE 12.3+, EMAARCH64 is not defined in earlier releases - update to icedtea-2.3.9 bnc816720 - Security fixes - S6657673, CVE-2013-1518: Issues with JAXP - S7200507: Refactor Introspector internals - S8000724, CVE-2013-2417: Improve networking serialization -...

openSUSE Security Update : java-1_6_0-openjdk (openSUSE-SU-2012:1424-1) (ROBOT)

java 1.6.0 openjdk / icedtea was updated to 1.11.5 bnc785433 - Security fixes - S6631398, CVE-2012-3216: FilePermission improved path checking - S7093490: adjust package access in rmiregistry - S7143535, CVE-2012-5068: ScriptEngine corrected permissions - S7167656, CVE-2012-5077: Multiple Seeders...

openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:0377-1)

java-170-openjdk was updated to icedtea-2.3.6 bnc803379 containing various security and bugfixes : - Security fixes - S6563318, CVE-2013-0424: RMI data sanitization - S6664509, CVE-2013-0425: Add logging context - S6664528, CVE-2013-0426: Find log level matching its name or value given at...

openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:0509-1)

java-170-openjdk was updated to icedtea-2.3.7 bnc809386 : - Security fixes - S8007014, CVE-2013-0809: Improve image handling - S8007675, CVE-2013-1493: Improve color conversion - Backports - S8002344: Krb5LoginModule config class does not return proper KDC list from DNS - S8004344: Fix a crash in...

[SECURITY] [DSA 2938-1] Availability of LTS support for Debian 6.0 / squeeze

------------------------------------------------------------------------- Debian Security Advisory DSA-2938-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 27, 2014 http://www.debian.org/security/faq -...

[BSA-095] Security Update for openssh

Colin Watson uploaded new packages for openssh which fixed the following security problems: CVE-2014-2532 DSA-2894-1 Jann Horn discovered that OpenSSH incorrectly handled wildcards in AcceptEnv lines. A remote attacker could use this issue to trick OpenSSH into accepting any environment variable...