Fedora 24 : canl-c (2016-9743cce120)

This is a hotfix for proxy DN manipulation vulnerabilities. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additiona...

SUSE SLES12 Security Update : apache2 (SUSE-SU-2016:2090-1) (httpoxy)

This update for apache2 fixes the following issues : - It used to be possible to set an arbitrary $HTTPPROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request CVE-2016-5387. As a result, these server components would...

Fedora 23 : krb5 (2016-f405b25923)

Bump version to 1.14.3 for the convenience of those needing the SNI fix. ---- Require krb5 to set the 'Host:' header when speaking KKDCPP. This fixes use of TLS with SNI. ---- Fix low-impact CVE-2016-3120 where S4U2Self may cause KDC crash when anon is restricted Note that Tenable Network Securit...

SUSE SLES12 Security Update : kernel (SUSE-SU-2016:2002-1)

This update for the Linux Kernel 3.12.51-5234 fixes several issues. The following security bugs were fixed : - CVE-2016-4470: The keyrejectandlink function in security/keys/key.c in the Linux kernel did not ensure that a certain data structure is initialized, which allowed local users to cause a...

SWIFT Warns Banks Of More Cyberattacks

Reports of additional attacks against banks that use SWIFT, the global financial transaction messaging network, came to light Wednesday. The attacks were reportedly persistent, sophisticated and in some cases successful, impacting an undisclosed number of financial institutions. It’s the latest...

Fedora 24 : 1:java-1.8.0-openjdk-aarch32 (2016-c07d18b2a5)

jdk8u102 upstream update, also contains July 2016 security fixes. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

MiniUPnP DNS Rebind Vulnerability

The remote host is running a version of MiniUPnP that is affected by an unspecified flaw that exists in the Domain Name System DNS related to the 'rebinding' interaction. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted web page, to run a...

Fedora 23 : freeipa (2016-7898627d08)

security fix for CVE-2016-5404 related: https://bugzilla.redhat.com/showbug.cgi?id=1367883 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possibl...

SUSE SLED12 / SLES12 Security Update : php5 (SUSE-SU-2016:1633-1)

This update for php5 fixes the following issues : - CVE-2013-7456: imagescale out-of-bounds read bnc982009. - CVE-2016-5093: geticuvalueinternal out-of-bounds read bnc982010. - CVE-2016-5094: Don't create strings with lengths outside of valid range bnc982011. - CVE-2016-5095: Don't create strings...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:1709-1)

The SUSE Linux Enterprise 12 kernel was updated to receive critical security and bugfixes. Security issue fixed : - CVE-2016-4997: A buffer overflow in 32bit compatsetsockopt iptables handling could lead to a local privilege escalation. bsc986362 The update package also includes non-security fixe...

Juniper Junos Denial of Service Vulnerability (CNVD-2016-06867)

Juniper Junos is a Juniper Networks network operating system designed for the company's hardware systems. The operating system provides a secure programming interface and the Junos SDK. Juniper Junos has a denial of service vulnerability that could be exploited by an attacker to cause a denial of...

SUSE SLED12 / SLES12 Security Update : MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss (SUSE-SU-2016:1691-1)

MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nss and mozilla-nspr were updated to fix nine security issues. Mozilla Firefox was updated to version 45.2.0 ESR. mozilla-nss was updated to version 3.21.1. These security issues were fixed : - CVE-2016-2834: Memory safety bugs in NSS MFSA...

SUSE SLED12 / SLES12 Security Update : dhcp (SUSE-SU-2016:1692-1)

This update for dhcp fixes the following issues : - CVE-2016-2774: Fixed a denial of service attack against the DHCP server over the OMAPI TCP socket, which could be used by network adjacent attackers to make the DHCP server non-functional bsc969820. Note that Tenable Network Security has extract...

A simple four-step, teach you do-it-yourself porting Cisco ASA exploits EXTRABACON-vulnerability warning-the black bar safety net

! In the past few days,We carefully analysed by the Shadow Brokers leaked NSA exploit code EXTRABACON it. According to XORcat derived from the initial analysis,the exploit code can use the SNMP service memory corruption vulnerability to bypass the Cisco ASA device authentication. We in the lab fo...

SUSE SLED12 / SLES12 Security Update : libtasn1 (SUSE-SU-2016:1601-1)

This update for libtasn1 fixes the following issues : - Malformed asn1 definitions could have caused a segmentation fault in the asn1 definition parser bsc961491 - CVE-2015-3622: Fixed invalid read in octet string decoding bsc929414 - CVE-2016-4008: Fixed infinite loop while parsing DER...

SUSE SLES11 Security Update : dhcp (SUSE-SU-2016:1735-1)

This update for dhcp fixes the following issues : - CVE-2016-2774: Fixed a denial of service attack against the DHCP server over the OMAPI TCP socket, which could be used by network adjacent attackers to make the DHCP server non-functional bsc969820. Note that Tenable Network Security has extract...

NECROSOFT NScan 0.9.1 Buffer Overflow

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/NECROSCAN-BUFFER-OVERFLOW.txt + ISR: ApparitionSec Vendor: =================== nscan.hypermart.net Product: ====================================== NECROSOFT NScan version =...

Mailbox fishing those things: the Chrome address reverse vulnerability use cases-vulnerability warning-the black bar safety net

First talk about the recently seen one of the more interesting vulnerability, the Google browser chrome address inversion, later we'll said. One day, your mailbox has received an incredible message that may come from your boss or your best friend, do not feel strange, it is likely that you are...

Fedora 24 : pagure (2016-40d5f1d3c2)

CVE-2016-1000037 ---- Update to 2.3.3 Be sure to read UPGRADING.rst Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Debian DLA-599-1 : cracklib2 security update

It was discovered that there was a stack-based buffer overflow when parsing large GECOS fields in cracklib2, a pro-active password checker library. For Debian 7 'Wheezy', this issue has been fixed in cracklib2 version 2.8.19-3+deb7u1. We recommend that you upgrade your cracklib2 packages. NOTE:...