Command injection

PHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b contains a Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in function pgpexec phkp.php:98 that can result in It is possible to manipulate gpg-keys or execute commands remotely...

PT-2018-9601

Name of the Vulnerable Software and Affected Versions: PHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b Description: The issue is related to an improper neutralization of special elements used in a command, which can lead to command injection. This can result in the...

PT-2018-2928

Name of the Vulnerable Software and Affected Versions gnupg affected versions not specified Description The issue is related to a data encryption utility, gpg, from the gnupg package, and is connected to null pointer dereference errors. Exploitation of this issue could allow an attacker to cause ...

openSUSE: Security Advisory for libzypp (openSUSE-SU-2018:2739-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE-SU-2018:2716-2 Security update for libzypp, zypper

This update for libzypp, zypper provides the following fixes: Update libzypp to version 16.17.20 Security issues fixed: - PackageProvider: Validate delta rpms before caching bsc1091624, bsc1088705, CVE-2018-7685 - PackageProvider: Validate downloaded rpm package signatures before caching...

SUSE SLED12 / SLES12 Security Update : libzypp, zypper (SUSE-SU-2018:2814-1)

This update for libzypp, zypper fixes the following issues : Update libzypp to version 16.17.20 : Security issues fixed : PackageProvider: Validate deta rpms before caching bsc1091624, bsc1088705, CVE-2018-7685 PackageProvider: Validate downloaded rpm package signatures before caching bsc1091624,...

openSUSE Security Update : libzypp / zypper (openSUSE-2018-1017)

This update for libzypp, zypper, libsolv provides the following fixes : Security fixes in libzypp : - CVE-2018-7685: PackageProvider: Validate RPMs before caching bsc1091624, bsc1088705 - CVE-2017-9269: Be sure bad packages do not stay in the cache bsc1045735 Changes in libzypp : - Update to...

SUSE-SU-2018:2716-1 Security update for libzypp, zypper

This update for libzypp, zypper provides the following fixes: Update libzypp to version 16.17.20 Security issues fixed: - PackageProvider: Validate delta rpms before caching bsc1091624, bsc1088705, CVE-2018-7685 - PackageProvider: Validate downloaded rpm package signatures before caching...

SUSE-SU-2018:2555-1 Security update for libzypp, zypper

This update for libzypp, zypper provides the following fixes: libzypp security fixes: - CVE-2018-7685: Validate RPMs before caching bsc1091624, bsc1088705 - CVE-2017-9269: Be sure bad packages do not stay in the cache bsc1045735 - CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix repo gpg check...

CVE-2018-0501

The mirror:// method implementation in Advanced Package Tool APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail...

Design/Logic Flaw

The mirror:// method implementation in Advanced Package Tool APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail...

CVE-2018-0501

The mirror:// method implementation in Advanced Package Tool APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail...

CVE-2018-0501

The CVE-2018-0501 detail: APT’s mirror:// handling in 1.6.x (pre-1.6.4) and 1.7.x (pre-1.7.0~alpha3) mishandles GPG verification for the InRelease file of a fallback mirror (mirrorfail). Impact: remote MITM could install altered packages when using mirror:// entries. Remediation: upgrade to 1.6.4...

CVE-2018-0501

The mirror:// method implementation in Advanced Package Tool APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail...

CVE-2018-0501

The mirror:// method implementation in Advanced Package Tool APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail...

Debian DSA-4277-1 : mutt - security update

Several vulnerabilities were discovered in Mutt, a text-based mailreader supporting MIME, GPG, PGP and threading, potentially leading to code execution, denial of service or information disclosure when connecting to a malicious mail/NNTP server. C Tenable Network Security, Inc. The descriptive te...

CVE-2018-0501

The mirror:// method implementation in Advanced Package Tool APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail...

[SECURITY] [DSA 4277-1] mutt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4277-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 17, 2018 https://www.debian.org/security/faq -...

CVE-2017-2623

It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certifica...

Default credentials

It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certifica...