CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

Debian Security Advisory DSA 3688-1 (nss - security update)

Several vulnerabilities were discovered in NSS, the cryptography library developed by the Mozilla project. CVE-2015-4000 David Adrian et al. reported that it may be feasible to attack Diffie-Hellman-based cipher suites in certain circumstances, compromising the confidentiality and integrity of da...

CVE-2016-7161

Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU aka Quick Emulator allows attackers to execute arbitrary code on the QEMU host via a large ethlite packet...

SUSE-SU-2016:2431-1 Security update for MozillaFirefox

MozillaFirefox was updated to 45.4.0 ESR to fix the following issues bsc999701: The following security issue were fixed: MFSA 2016-86/CVE-2016-5270: Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString MFSA 2016-86/CVE-2016-5272: Bad cast in nsImageGeometryMixin MFSA...

SUSE-SU-2016:2434-1 Security update for MozillaFirefox

MozillaFirefox was updated to version 45.4.0 ESR to fix the following issues: Security issues fixed: bsc999701 MFSA 2016-86: CVE-2016-5270: Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString CVE-2016-5272: Bad cast in nsImageGeometryMixin CVE-2016-5276: Heap-use-after-free in...

CVE-2016-1243

Stack-based buffer overflow in the extractTree function in unADF allows remote attackers to execute arbitrary code via a long pathname...

Mozilla: Memory safety bugs fixed in Firefox ESR 45.4 (MFSA 2016-85, MFSA 2016-86)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4 and Thunderbird 45.4 allow remote attackers to cause a denial of service memory corruption and application crash or possibly execute arbitrary code via unknown vectors...

CVE-2016-3624

The cvtClump function in the rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service out-of-bounds write by setting the "-v" option to -1...

CVE-2016-3622

The fpAcc function in tifpredict.c in the tiff2rgba tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service divide-by-zero error via a crafted TIFF image...

openSUSE Security Update : openssl (openSUSE-2016-1134)

This update for openssl fixes the following issues : OpenSSL Security Advisory 22 Sep 2016 bsc999665 Severity: High - OCSP Status Request extension unbounded memory growth CVE-2016-6304 bsc999666 Severity: Low - Pointer arithmetic undefined behaviour CVE-2016-2177 bsc982575 - Constant time flag n...

SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:2404-1)

This update for mariadb to 1.0.0.27 fixes the following issues: Security issue fixed : - CVE-2016-6662: A malicious user with SQL and filesystem access could create a my.cnf in the datadir and, under certain circumstances, execute arbitrary code as mysql or even root user. bsc998309 - release not...

SUSE SLES12 Security Update : openssl (SUSE-SU-2016:2387-1)

This update for openssl fixes the following issues: OpenSSL Security Advisory 22 Sep 2016 bsc999665 Severity: High - OCSP Status Request extension unbounded memory growth CVE-2016-6304 bsc999666 Severity: Low - Pointer arithmetic undefined behaviour CVE-2016-2177 bsc982575 - Constant time flag no...

openSUSE Security Update : gtk2 (openSUSE-2016-1118)

This gtk2 update to version 2.24.31 fixes the following issues : Security issues fixed : - CVE-2013-7447: Fixed integer overflow in image handling boo966682. Bugs fixed : - Changes from version 2.24.31 : + Backport many file chooser entry fixes and cleanups. + Don't crash if invisible files are...

CVE-2016-5172

The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code...

[slackware-security] pidgin

New pidgin packages are available for Slackware 13.0, 13.1, 13.37, 14.0, and 14.1 to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/pidgin-2.11.0-i486-1slack14.1.txz: Upgraded. NOTE: These packages provide updates to pidgin-2.11.0, since the previous...

CVE-2016-6525

Heap-based buffer overflow in the pdfloadmeshparams function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a denial of service crash or execute arbitrary code via a large decode array...

CVE-2015-8871

Use-after-free vulnerability in the opjj2kwritemco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors...

Mozilla Patches Certificate Pinning Vulnerability in Firefox

As expected, Mozilla patched a highly scrutinized flaw in its automated update process for add-ons in Firefox, specifically around the expiration of certificate pins. The vulnerability allowed attackers to intercept encrypted browser traffic, inject a malicious NoScript extension update and gain...

SUSE SLES11 Security Update : mysql (SUSE-SU-2016:2343-1)

This mysql update to verson 5.5.52 fixes the following issues: Security issues fixed : - CVE-2016-3477: Fixed unspecified vulnerability in subcomponent parser bsc989913. - CVE-2016-3521: Fixed unspecified vulnerability in subcomponent types bsc989919. - CVE-2016-3615: Fixed unspecified...

Apple Squashes 68 Security Bugs With Sierra Release

With the release of macOS Sierra 10.12 Tuesday, Apple snuffed out dozens of lingering security vulnerabilities in OS X El Capitan and Yosemite. Along with updates to its OS, Apple addressed security bugs in its Safari web browser and macOS Server in separate security bulletins, also released...