CVE-2018-1000104

CVE-2018-1000104 affects Jenkins Coverity Plugin at 1.10.0 and earlier, where CIMInstance.java stores passwords in plaintext. An attacker with local file-system access or control of a Jenkins administrator’s browser (e.g., a malicious extension) can retrieve the keystore and private key passwords...

Fedora 27 : gd (2017-ac3dd4ecf8)

Version 2.2.5 - 2017-08-30 - Security - Double-free in gdImagePngPtr. CVE-2017-6362 - Buffer over-read into uninitialized memory. CVE-2017-7890 - Fixed - Fix 109: XBM reading fails with printed error - Fix 338: Fatal and normal libjpeg/ibpng errors not distinguishable - Fix 357: 2.2.4: Segfault i...

Fedora 24 : tcpreplay (2017-7980b5e846)

Here is what is fixed in this release : - Fix reporting of rates 1Mbps 348 - Option --unique-ip not working properly 346 ---- Features and fixes include : - MAC rewriting capabilities by Pedro Arthur 313 - Fix several issues identified by Coverity 305 - Packet distortion --fuzz-seed option by...

OracleVM 3.3 / 3.4 : openjpeg (OVMSA-2017-0048)

The remote OracleVM system is missing necessary patches to address critical security updates : - Revert previous changes in patch for CVE-2016-5159 - Fix double free in patch for CVE-2016-5139 - Fix memory leaks and invalid read in ciobytein Related: 1419775 - Add two more allocation checks to...

openjpeg security update

1.5.1-16 - Revert previous changes in patch for CVE-2016-5159 - Fix memory leaks Related: 1419772 1.5.1-15 - Add two more allocation checks to patch for CVE-2016-5159 Related: 1419772 1.5.1-14 - Fix CWE-825 errors in patch for CVE-2016-5158 Related: 1419772 1.5.1-13 - Add patches for CVE-2016-513...

openjpeg security update

1.3-16 - Revert previous changes in patch for CVE-2016-5159 - Fix double free in patch for CVE-2016-5139 - Fix memory leaks and invalid read in ciobytein Related: 1419775 1.3-15 - Add two more allocation checks to patch for CVE-2016-5159 Related: 1419775 1.3-14 - Add patches for CVE-2016-5139,...

openSUSE Security Update : pacemaker (openSUSE-2016-1447)

This update for pacemaker fixes the following issues : - remote: Allow cluster and remote LRM API versions to diverge bsc1009076 - libcrmcommon: fix CVE-2016-7035 improper IPC guarding bsc1007433 - sysconfig: minor tweaks typo, wording - spec: more robust check for systemd being in use - spec:...

file security, bug fix, and enhancement update

5.04-30 - fix CVE-2014-3538 unrestricted regular expression matching 5.04-29 - fix 1284826 - try to read ELF header to detect corrupted one 5.04-28 - fix 1263987 - fix bugs found by coverity in the patch 5.04-27 - fix CVE-2014-3587 incomplete fix for CVE-2012-1571 - fix CVE-2014-3710 out-of-bound...

grub2 security, bug fix, and enhancement update

2.02-0.29.0.1 - Fix comparison in patch for 18504756 - Remove symlink to grub environment file during uninstall on EFI platforms bug 19231481 - update Oracle Linux certificates Alexey Petrenko - Put 'with' in menuentry instead of 'using' bug 18504756 - Use different titles for UEK and RHCK kernel...

Fedora 21 : 389-ds-base-1.3.3.13-1.fc21 (2015-15128)

389-ds-base-1.3.3.13-1.fc21 - release 1.3.3.13 - Ticket 48265 - Complex filter in a search request doen't work as expected. regression - Ticket 47981 - COS cache doesn't properly mark vattr cache as invalid when there are multiple suffixes - Ticket 48252 - db2index creates index entry from delete...

Oracle Linux 6 : freeradius (ELSA-2015-1287)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1287 advisory. 2.2.6-4 - Move OpenSSL init out of version check Resolves: Bug1189394 radiusd segfaults after update - Comment-out ippool-dhcp.conf inclusion Resolves: Bug11893...

freeradius security, bug fix, and enhancement update

2.2.6-4 - Move OpenSSL init out of version check Resolves: Bug1189394 radiusd segfaults after update - Comment-out ippool-dhcp.conf inclusion Resolves: Bug1189386 radiusd fails to start after 'clean' installation 2.2.6-3 - Disable OpenSSL version check Resolves: Bug1189011 2.2.6-2 - Fix a number ...

FreeBSD : testdisk -- buffer overflow with malicious disk image (c67069dc-0986-11e5-bb90-002590263bf5)

CGSecurity TestDisk Changelog reports : Various fix including security fix, thanks to : - Coverity scan Static Analysis of source code - afl-fuzz security-oriented fuzzer. - Denis Andzakovic from Security Assessment for reporting an exploitable Stack Buffer Overflow. Denis Andzakovic reports : A...

testdisk -- buffer overflow with malicious disk image

CGSecurity TestDisk Changelog reports: Various fix including security fix, thanks to: Coverity scan Static Analysis of source code afl-fuzz security-oriented fuzzer. Denis Andzakovic from Security Assessment for reporting an exploitable Stack Buffer Overflow. Denis Andzakovic reports: A buffer...

libreoffice security, bug fix, and enhancement update

libabw 0.0.2-1 - new upstream release 0.0.2 - generate man pages for the tools 0.0.1-1 - new upstream release libcmis 0.4.1-5 - Related: rhbz1132065 coverity: fix mismatching exceptions 0.4.1-4 - a few use-after-free fixes for the C wrapper 0.4.1-3 - Resolves: rhbz1132065 rebase to 0.4.1 libetony...

ipa security, bug fix, and enhancement update

4.1.0-18.0.1 - Replace login-screen-logo.png 20362818 - Drop subscription-manager requires for OL7 - Drop redhat-access-plugin-ipa requires for OL7 - Blank out header-logo.png product-name.png 4.1.0-18 - Fix ipa-pwd-extop global configuration caching 1187342 - group-detach does not add correct...

Updated pngcrush package fixes security vulnerability

pngcrush-1.7.84 fixes defects reported by Coverity-scan, so it should be more resistant to crashes due to malformed input files, such as the one presented in CVE-2015-2158...

DEBIAN-CVE-2015-1031

Multiple use-after-free vulnerabilities in Privoxy before 3.0.22 allow remote attackers to have unspecified impact via vectors related to 1 the unmap function in list.c or 2 "two additional unconfirmed use-after-free complaints made by Coverity scan." NOTE: some of these details are obtained from...

CVE-2015-1031

Multiple use-after-free vulnerabilities in Privoxy before 3.0.22 allow remote attackers to have unspecified impact via vectors related to 1 the unmap function in list.c or 2 "two additional unconfirmed use-after-free complaints made by Coverity scan." NOTE: some of these details are obtained from...

CVE-2015-1031

Multiple use-after-free vulnerabilities in Privoxy before 3.0.22 allow remote attackers to have unspecified impact via vectors related to 1 the unmap function in list.c or 2 "two additional unconfirmed use-after-free complaints made by Coverity scan." NOTE: some of these details are obtained from...