kernel security, bug fix, and enhancement update

3.10.0-229.20.1.OL7 - Oracle Linux certificates Alexey Petrenko 3.10.0-229.20.1 - Revert: crypto nx - Check for bogus firmware properties Phillip Lougher 1247127 1190103 - Revert: crypto nx - Moving NX-AES-CBC to be processed logic Phillip Lougher 1247127 1190103 - Revert: crypto nx - Moving...

md-health.com XSS vulnerability

Open Bug Bounty ID: OBB-93758 Description| Value ---|--- Affected Website:| md-health.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Shee...

USN-2777-1 linux-lts-utopic vulnerabilities

It was discovered that virtio networking in the Linux kernel did not handle fragments correctly, leading to kernel memory corruption. A remote attacker could use this to cause a denial of service system crash or possibly execute code with administrative privileges. CVE-2015-5156 Benjamin Randazzo...

Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2751-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2751-1 advisory. Benjamin Randazzo discovered an information leak in the md multiple device driver when the bitmapinfo.file is disabled. A local privileged attacker could...

Ubuntu 15.04 : linux vulnerabilities (USN-2752-1)

Benjamin Randazzo discovered an information leak in the md multiple device driver when the bitmapinfo.file is disabled. A local privileged attacker could use this to obtain sensitive information from the kernel. CVE-2015-5697 Marc-Andre Lureau discovered that the vhost driver did not properly...

USN-2751-1 linux-lts-vivid vulnerabilities

Benjamin Randazzo discovered an information leak in the md multiple device driver when the bitmapinfo.file is disabled. A local privileged attacker could use this to obtain sensitive information from the kernel. CVE-2015-5697 Marc-André Lureau discovered that the vhost driver did not properly...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2748-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2748-1 advisory. Benjamin Randazzo discovered an information leak in the md multiple device driver when the bitmapinfo.file is disabled. A local privileged attacker could...

Debian DLA-310-1 : linux-2.6 security update

This update fixes the CVEs described below. CVE-2015-0272 It was discovered that NetworkManager would set IPv6 MTUs based on the values received in IPv6 RAs Router Advertisements, without sufficiently validating these values. A remote attacker could exploit this attack to disable IPv6 connectivit...

Amazon Linux: Security Advisory (ALAS-2013-233)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 12.04 LTS : linux vulnerability (USN-2731-1)

Benjamin Randazzo discovered an information leak in the md multiple device driver when the bitmapinfo.file is disabled. A local privileged attacker could use this to obtain sensitive information from the kernel. Note that Tenable Network Security has extracted the preceding description block...

Ubuntu: Security Advisory (USN-2732-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-3329-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-3329-1 : linux - security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak. - CVE-2015-1333 Colin Ian King discovered a flaw in the addkey function of the Linux kernel's keyring subsystem. A local user can exploit this flaw to...

Unbreakable Enterprise kernel security update

kernel-uek 3.8.13-98.1.1 - md: use kzalloc when bitmap is disabled Benjamin Randazzo Orabug: 21563041 CVE-2015-5697...

kernel security, bug fix, and enhancement update

2.6.32-573 - security selinux: dont waste ebitmap space when importing NetLabel categories Paul Moore 1130197 - x86 Revert Add driver auto probing for x86 features v4 Prarit Bhargava 1231280 - net bridge: netfilter: dont call iptables on vlan packets if sysctl is off Florian Westphal 1236551 - ne...

AirLive IP Monitor Command Injection Vulnerability

Airlive is an IP surveillance network solution provider and security product vendor. An OS command injection vulnerability exists in the cgitest.cgi binary file when the AirLive MD-3025, BU-3026, BU-2015 cameras process certain parameters. An attacker can exploit this vulnerability to inject...

AirLive Multiple Products OS Command Injection (Jul 2015) - Active Check

There is an OS Command Injection in the cgitest.cgi binary file in the AirLive MD-3025, BU-3026 and BU-2015 cameras when handling certain parameters. That specific CGI file can be requested without authentication, unless the user specified in the configuration of the camera that every communicati...

Debian DLA-118-1 : linux-2.6 security update

Non-maintainer upload by the Squeeze LTS and Kernel Teams. New upstream stable release 2.6.32.65, see http://lkml.org/lkml/2014/12/13/81 for more information. The stable release 2.6.32.65 includes the following new commits compared to the previous 2.6.32-48squeeze9 package : - USB: whiteheat: Add...

kernel security and bug fix update

3.10.0-229.1.2 - Oracle Linux certificates Alexey Petrenko 3.10.0-229.1.2 - infiniband core: Prevent integer overflow in ibumemget address arithmetic Doug Ledford 1181177 1179347 CVE-2014-8159 3.10.0-229.1.1 - crypto testmgr: mark rfc4106gcmaes as fipsallowed Jarod Wilson 1197751 1185400 - virt...

kernel security and bug fix update

2.6.32-504.8.1 - crypto crc32c: Kill pointless CRYPTOCRC32CX8664 option Jarod Wilson 1175509 1036212 - crypto testmgr: add larger crc32c test vector to test FPU path in crc32cintel Jarod Wilson 1175509 1036212 - crypto tcrypt: Added speed test in tcrypt for crc32c Jarod Wilson 1175509 1036212 -...