September 19, 2017—KB4038774 (Preview of Monthly Rollup)

None None...

Ubuntu: Security Advisory (USN-3360-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3360-1: Linux kernel vulnerabilities

It was discovered that the Linux kernel did not properly initialize a Wake- on-Lan data structure. A local attacker could use this to expose sensitive information kernel memory. CVE-2014-9900 It was discovered that the Linux kernel did not properly restrict access to /proc/iomem. A local attacker...

Product update: Virtuozzo 7.0 Update 4 Hotfix 1 (7.0.4-1091)

The new update for Virtuozzo 7.0.4 provides stability and usability bug fixes. Vulnerability id: PSBM-66625, PSBM-66445 guest.fs counters were reported in kilobytes for containers and in bytes for virtual machines. Vulnerability id: PSBM-66556 Backup location changed to default after update to...

libtiff: TIFFFlushData1 heap-buffer-overflow

tifwrite.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1 that didn't reset the tifrawcc and tifrawcp members. Reported as MSVR 35095, aka "TIFFFlushData1 heap-buffer-overflow."...

UBUNTU-CVE-2016-9534

tifwrite.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1 that didn't reset the tifrawcc and tifrawcp members. Reported as MSVR 35095, aka "TIFFFlushData1 heap-buffer-overflow."...

The vulnerability of the Vte Terminal allows a perpetrator to cause a service failure.

The vulnerability of the Vte Terminal arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure a long cycle and exhaustion of processor resources by entering a control sequence with a high value...

CVE-2016-6257

The CVE relates to Lenovo Ultraslim dongles used with Liteon keyboards/mice where the firmware does not enforce incrementing AES counters, enabling an attacker in close proximity to inject encrypted keyboard input (KeyJack injection attack). Affected components are the Ultraslim Wireless keyboard...

CVE-2016-6257

The firmware in Lenovo Ultraslim dongles, as used with Lenovo Liteon SK-8861, Ultraslim Wireless, and Silver Silk keyboards and Liteon ZTM600 and Ultraslim Wireless mice, does not enforce incrementing AES counters, which allows remote attackers to inject encrypted keyboard input into the system b...

The vulnerability of the Firefox browser, which allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.

Overfilling the buffer in the Speex decoder of the Web Audio subsystem in Mozilla Firefox allows malicious actors to execute arbitrary code using specially crafted AudioBuffer channel counters and decoding frequencies...

DEBIAN-CVE-2015-7513

arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration, which allows guest OS users to cause a denial of service divide-by-zero error and host OS crash via a zero value, related to the kvmvmioctlsetpit and kvmvmioctlsetpit2 functions...

UBUNTU-CVE-2015-7513

arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration, which allows guest OS users to cause a denial of service divide-by-zero error and host OS crash via a zero value, related to the kvmvmioctlsetpit and kvmvmioctlsetpit2 functions...

OracleVM 3.3 : net-snmp (OVMSA-2015-0099)

The remote OracleVM system is missing necessary patches to address critical security updates : - Add Oracle ACFS to hrStorage John Haxby orabug 18510373 - Quicker loading of IP-MIB::ipAddrTable 1191393 - Quicker loading of IP-MIB::ipAddressTable 1191393 - Fixed snmptrapd crash when '-OQ' paramete...

CVE-2015-2609

Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via vectors related to CPU performance counters drivers...

Design/Logic Flaw

Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via vectors related to CPU performance counters drivers...

CVE-2015-2609

Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via vectors related to CPU performance counters drivers...

CVE-2015-2609

CVE-2015-2609 affects Oracle Solaris 11.2 via the CPU performance counters drivers component, enabling local attackers to cause system hangs or crashes (local DoS). The related NASL plugin confirms a patch in the jul2015 CPU SRU11_2_10_5_0 addressing CVE-2015-2609 (and other CPU vulnerabilities) ...

Oracle Solaris Critical Patch Update : jul2015_SRU11_2_10_5_0

This Solaris system is missing necessary patches to address critical security updates : - Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: NFSv4. Supported versions that are affected are 10 and 11.2. Difficult to exploit vulnerability requiring logon to...

Oracle Solaris Critical Patch Update : jul2014_SRU11_1_17_5_0

This Solaris system is missing necessary patches to address a critical security update : - Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite subcomponent: CPU performance counters CPC drivers. Supported versions that are affected are 10 and 11.1. Easily exploitable...

Oracle Solaris Critical Patch Update : oct2013_SRU11_1_9_5_1

This Solaris system is missing necessary patches to address a critical security update : - Vulnerability in the Solaris component of Oracle and Sun Systems Products Suite subcomponent: CPU performance counters CPC drivers. Supported versions that are affected are 10 and 11.1. Easily exploitable...