VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0013) (remote check)

The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries : - Java Runtime Environment JRE - libuser - Netscape Portable Runtime NS...

Fedora 23 : pacemaker-1.1.13-3.fc23 (2015-f9864ecd8f)

Security fix for CVE-2015-1867: issue allegedly present in pacemaker-1.1.12, fixed in pacemaker-1.1.13. pacemaker-1.1.13-3.fc21,22,23 - Update to Pacemaker-1.1.13 post-release + patches sync - Add nagios-plugins-metadata subpackage enabling support of selected Nagios plugins as resources recogniz...

Fedora 23 : snappy-player-1.0-7.20151010git166a98.fc23 (2015-bae05abd06)

snappy-player-1.0-7.20151010git166a98.fc23 - Update to commit 166a98 - Hardened build activated on F23 snappy-player-1.0-7.20151010git166a98.fc21 - Update to commit 166a98 - Hardened build activated on F23 snappy- player-1.0-7.20151010git166a98.fc22 - Update to commit 166a98 - Hardened build...

Fedora 22 : nodejs-0.10.42-4.fc22 (2016-8925b6119f)

Security fix for CVE-2016-2216, CVE-2016-2086 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora 22 : kernel-4.2.6-200.fc22 (2015-cd94ad8d7c)

The 4.2.6 stable update contains a number of important fixes across the tree. kernel-4.2.6-200.fc22 - Fix incorrect size calculations in megaraid with 64K pages rhbz 1269300 - CVE-2015-8104 kvm: DoS infinite loop in microcode DB exception rhbz 1278496 1279691 - CVE-2015-5307 kvm: DoS infinite loo...

Fedora 23 : telegram-cli-1.3.1-7.20150730git2052f4.fc23 (2015-802cb89674)

telegram-cli-1.3.1-7.20150730git2052f4.fc22 - Hardened builds on F23 telegram-cli-1.3.1-7.20150730git2052f4.fc23 - Hardened builds on F23 telegram-cli-1.3.1-7.20150730git2052f4.el7 - Hardened builds on F23 telegram-cli-1.3.1-7.20150730git2052f4.el6 - Hardened builds on F23 Note that Tenable Netwo...

Fedora 23 : php-horde-horde-5.2.9-1.fc23 (2016-5d0e7f15ef)

horde 5.2.9 jan SECURITY: Fix XSS vulnerability in menu bar exposed by few applications Bug 14213. jan Add more detailed user DN settings to Kolab group configuration Request 11737. jan Fix returning to last page after problem reporting from AJAX pages Bug 12112. jan Fix custom database...

Fedora 23 : metis-5.1.0-7.fc23 (2015-8cf7bff87b)

metis-5.1.0-7.el7 - Rebuild for cmake 3.4.0 - Hardened builds on F23 metis-5.1.0-7.fc22 - Rebuild for cmake 3.4.0 - Hardened builds on F23 metis-5.1.0-7.fc21 - Rebuild for cmake 3.4.0 - Hardened builds on F23 metis-5.1.0-7.el6 - Rebuild for cmake 3.4.0 - Hardened builds on F23 metis-5.1.0-7.fc23 ...

Fedora 22 : prosody-0.9.9-2.fc22 (2016-e289f41b76)

Prosody 0.9.9 ============= A summary of changes: Security fixes -------------- Fix path traversal vulnerability in modhttpfiles CVE-2016-1231 Fix use of weak PRNG in generation of dialback secrets CVE-2016-1232 Bugs ---- Improve handling of CNAME records in DNS Fix traceback when deleting a user...

FreeProxy Internet Suite 4.10 - Denial of Service

FreeProxy Internet Suite 4.10 - Denial of Service Exploit Title: Freeproxy Internet Suite 4.10 Remote DoS Date: 01/03/2016 Exploit Author: Guillaume Kaddouch Twitter: @gkweb76 Blog: https://networkfilter.blogspot.com GitHub: https://github.com/gkweb76/exploits Vendor Homepage:...

Debian DLA-442-1 : lxc security update

Brief introduction CVE-2013-6441 The template script lxc-sshd used to mount itself as /sbin/init in the container using a writable bind-mount. This update resolved the above issue by using a read-only bind-mount instead preventing any form of potentially accidental damage. CVE-2015-1335 On...

Debian DLA-434-1 : gtk+2.0 security update

Gustavo Grieco discovered different security issues in Gtk+2.0's gdk-pixbuf. CVE-2015-4491 Heap overflow when processing BMP images which may allow to execute of arbitrary code via malformed images. CVE-2015-7673 Heap overflow when processing TGA images which may allow execute arbitrary code or...

Debian DLA-427-1 : nss security update

The smpdiv function in Mozilla Network Security Services NSS before 3.21, improperly divides numbers, which might make it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging use of the 1 mpdiv or 2 mpexptmod function. For the oldoldstable distribution squeeze,...

Mousejack Attacks Abuse Vulnerable Wireless Keyboard, Mouse Dongles

Wireless keyboards and mice are the latest peripherals to put enterprise networks and user data at risk. Researchers at Bastille Networks today said that non-Bluetooth devices from seven manufacturers including Logitech, Dell and Lenovo are vulnerable to so-called Mousejack attacks that would all...

FTC Shares Security Tips for ASUS Wireless Routers

The Federal Trade Commission FTC has provided network security tips for vulnerable ASUS-branded wireless routers. Major security flaws in these routers may have exposed customers' sensitive information to malicious actors. FTC urges consumers to download the latest security updates for their...

SUSE SLED12 / SLES12 Security Update : dhcp (SUSE-SU-2016:0541-1)

This update for dhcp fixes the following issues : - CVE-2015-8605: A remote attacker could have used badly formed packets with an invalid IPv4 UDP length field to cause a DHCP server, client, or relay program to terminate abnormally bsc961305 The following bugs were fixed : - bsc936923: Improper...

Debian DLA-423-1 : krb5 security update

CVE-2015-8629 It was discovered that an authenticated attacker can cause kadmind to read beyond the end of allocated memory by sending a string without a terminating zero byte. Information leakage may be possible for an attacker with permission to modify the database. CVE-2015-8631 It was...

F5 Networks BIG-IP : OpenSSL vulnerability (SOL33209124) (deprecated)

ssl/s2srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the getclientmasterkey and...

CVE-2016-2509

CVE-2016-2509 concerns Belden Hirschmann Classic Platform switches. The password-sync feature on affected devices (L2B prior to 05.3.07; L2E, L2P, L3E, L3P prior to 09.0.06) can set the SNMP community to the same string as the administrator password, enabling remote attackers to obtain sensitive ...

Debian DLA-419-1 : gtk+2.0 security update

Gtk+2.0, a graphical user interface library, was susceptible to an integer overflow in its gdkcairosetsourcepixbuf function when allocating a large block of memory. For Debian 6 'Squeeze', this issue has been fixed in gtk+2.0 version 2.20.1-2+deb6u1. We recommend you to upgrade your gtk+2.0...