SUSE SLED12 / SLES12 Security Update : kdump (SUSE-SU-2016:2553-1)

This update for kdump provides several fixes and enhancements : - Refresh kdumprd if /etc/hosts or /etc/nsswitch.conf is changed. bsc943214 - Add a separate systemd service to rebuild kdumprd at boot. bsc943214 - Improve network setup in the kdump environment by reading configuration from wicked ...

SUSE SLES11 Security Update : kernel (SUSE-SU-2016:2614-1) (Dirty COW)

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to fix one security issue. This security bug was fixed : - CVE-2016-5195: Local privilege escalation using MAPPRIVATE. It is reportedly exploited in the wild bsc1004418. Note that Tenable Network Security has extracted the preceding...

Amazon Linux: Security Advisory (ALAS-2016-742)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES12 Security Update : kernel (SUSE-SU-2016:2636-1) (Dirty COW)

This update for the Linux Kernel 3.12.51-5231 fixes several issues. The following security bugs were fixed : - CVE-2016-5195: A local privilege escalation using MAPPRIVATE was fixed, which is reportedly exploited in the wild bsc1004419. - CVE-2016-4997: The compat IPTSOSETREPLACE and...

[SECURITY] [DLA 677-1] nss security update

Package : nss Version : 3.26-1+debu7u1 The Network Security Service NSS libraries uses environment variables to configure lots of things, some of which refer to file system locations. Others can be degrade the operation of NSS in various ways, forcing compatibility modes and so on. Previously,...

About the security content of macOS Sierra 10.12.1, Security Update 2016-002 El Capitan, and Security Update 2016-006 Yosemite

About the security content of macOS Sierra 10.12.1, Security Update 2016-002 El Capitan, and Security Update 2016-006 Yosemite This document describes the security content of macOS Sierra 10.12.1, Security Update 2016-002 El Capitan, and Security Update 2016-006 Yosemite. About Apple security...

Fedora 24 : php-pecl-zip (2016-b9cb75981a)

Version 1.13.5 - Fixed bug php72660 NULL pointer dereference in zendvirtualcwd. Laruence - Fixed bug php68302 impossible to compile php with zip support. cmb - Fixed bug php70752 Depacking with wrong password leaves 0 length files. cmb Note that Tenable Network Security has extracted the precedin...

Debian DLA-668-1 : libass security update

Several vulnerabilities were discovered in libass, a library for manipulating the SubStation Alpha SSA subtitle file format. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2016-7969 Mode 0/3 line wrapping equalization in specific cases which could result in...

EMC Legato Networker Remote Exec Service Stack Overflow RCE

The EMC Legato Networker application running on the remote host is affected by a stack overflow condition in the Networker Remote Exec Service nsrexecd.exe, specifically within the sprintf function, when handling poll or kill requests. An unauthenticated, remote attacker can exploit this, via a...

Debian DLA-669-1 : dwarfutils security update

Several vulnerabilities were discovered in dwarfutils, a tool and library for reading/consuming and writing/producing DWARF debugging information. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2015-8538 A specially crafted ELF file can cause a segmentation...

Debian DLA-666-1 : guile-2.0 security update

Several vulnerabilities were discovered in GNU Guile, an implementation of the Scheme programming language. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2016-8605: The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that...

Debian DLA-663-1 : tor security update

It has been discovered that Tor treats the contents of some buffer chunks as if they were a NUL-terminated string. This issue could enable a remote attacker to crash a Tor client, hidden service, relay, or authority. This update aims to defend against this general class of security bugs. For Debi...

Debian DLA-655-1 : mpg123 security update

Several security vulnerabilities have been discovered in mpg123, an MPEG layer 1/2/3 audio decoder and player. An attacker could take advantage of these flaws to cause a denial of service against mpg123 or applications using the libmpg123 library with a carefully crafted input file. CVE-2014-9497...

Debian DLA-661-1 : libarchive security update

Agostino Sarubbo of Gentoo discovered several security vulnerabilities in libarchive, a multi-format archive and compression library. An attacker could take advantage of these flaws to cause a buffer overflow or an out of bounds read using a carefully crafted input file. CVE-2016-8687 Agostino...

Old SSH Vulnerability at Center of Credential-Stuffing Attacks

Connected devices aren’t just for DDoS attacks anymore. Researchers at Akamai this week exposed how attackers are using a 12-year-old SSH vulnerability in combination with weak or default credentials to compromise an array of IOT and home networking devices. Those connected things are then being...

SUSE SLES11 Security Update : xen (SUSE-SU-2016:2507-1) (Bunker Buster)

This update for xen fixes several issues. These security issues were fixed : - CVE-2016-7092: The getpagefroml3e function in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables bsc995785 - CVE-2016-7093: Xe...

SUSE SLED12 / SLES12 Security Update : X Window System client libraries (SUSE-SU-2016:2505-1)

This update for the X Window System client libraries fixes a class of privilege escalation issues. A malicious X Server could send specially crafted data to X clients, which allowed for triggering crashes, or privilege escalation if this relationship was untrusted or crossed user or permission...

Microsoft Windows Graphics Component CVE-2016-3209 Information Disclosure Vulnerability

Description Microsoft Windows is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. Technologies Affected Microsoft .NET Framework 3.0 SP2 Microsoft .NET Framework 3.5 Microsoft .NET Framewo...

FreeBSD -- Multiple portsnap vulnerabilities

Problem Description: Flaws in portsnap's verification of downloaded tar files allows additional files to be included without causing the verification to fail. Portsnap may then use or execute these files. Impact: An attacker who can conduct man in the middle attack on the network at the time when...

Fedora 24 : libdwarf (2016-328754be1c)

Update to 20160929 upstream release Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...