RHEL 6 : polkit (RHSA-2019:0420)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0420 advisory. The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privilege...

Virtuozzo Linux Errata and Bugfix Advisory 2019:0414

Upstream security update. Follow RHBA-2019:0414 for details...

flatpak security update

CentOS Errata and Security Advisory CESA-2019:0375 An update for flatpak is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

RHEL 7 : flatpak (RHSA-2019:0375)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0375 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: potential /proc based...

RHEL 6 : firefox (RHSA-2019:0373)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0373 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

libsndfile -- out-of-bounds read memory access

RedHat reports: It was discovered the fix for CVE-2018-19758 was not complete and still allows a read beyond the limits of a buffer in wavwriteheader function in wav.c. A local attacker may use this flaw to make the application crash...

RHEL 6 : chromium-browser (RHSA-2019:0309)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0309 advisory. Chromium is an open-source web browser, powered by WebKit Blink. This update upgrades Chromium to version 72.0.3626.81. Security Fixes:...

Severe RCE Flaw Disclosed in Popular LibreOffice and OpenOffice Software

It's 2019, and just opening an innocent looking office document file on your system can still allow hackers to compromise your computer. No, I'm not talking about yet another vulnerability in Microsoft Office, but in two other most popular alternatives—LibreOffice and Apache OpenOffice—free, open...

RHEL 7 : systemd (RHSA-2019:0204)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0204 advisory. The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides...

RHEL 7 : kernel (RHSA-2019:0163)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0163 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Use-after-free due to race...

RHEL 7 : kernel (RHSA-2019:0202)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0202 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: userfaultfd bypasses tmpfs file...

bind: Crash from assertion error when debug log level is 10 and log entries meet buffer boundary

While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind-9.9.4-65.el7 - bind-9.9.4-72.el7. No ISC releases are affected. Other packages from other distributions who made the same error may also ...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Security Bulletin: Public disclosed GNU glibc vulnerabilities used by IBM OS Images for RedHat Linux in IBM PureApplication Systems (CVE-2017-16997 CVE-2018-1000001)

Summary There are public disclosed vulnerabilities from GNU glibc that are used by the OS Images for IBM PureApplication System. To address the vulnerabilities in response to CVE-2017-16997 and CVE-2018-1000001, IBM has released Version 2.2.5.3 for IBM PureApplication System, which includes IBM O...

Directory Traversal

redhat-virtualization-host is vulnerable to directory traversal attacks. The vulnerability exists as a directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they...

Remote Code Execution (RCE)

redhat-support-plugin-rhev is vulnerable to remote code execution. It was found that redhat-support-plugin-rhev passed a user-specified path and file name directly to the command line in the log viewer component. This could allow users with the SuperUser role on any Entity to execute arbitrary...

Man-in-the-Middle (MitM)

redhat-upgrade-tool is vulnerable to man-in-the-middle MitM attack. The tool does not implement proper GPG signature verification when performing package installations, allowing an attacker to perform man-in-the-middle attacks against the client...

Unauthorized File Creation

Nagios is vulnerable to symbolic link attack. Due to the flaw in nagios.upgradetov3.sh, it is possible for a local user to create a temporary nagioscfg file with a predictable name in /tmp/.Per: http://rhn.redhat.com/errata/RHSA-2013-1526.html...

OpenSSH CVE-2019-6109 Man in the Middle Security Bypass Vulnerability

Description OpenSSH is prone to a security-bypass vulnerability. Successfully exploiting this issue may allow attackers to bypass certain security restrictions and perform unauthorized actions by conducting a man-in-the-middle attack. This may lead to other attacks. OpenSSH 7.9 version is...

Fedora 29 : nbdkit (2018-c42a144c65)

New upstream version 1.8.2. Fix low priority security issue with TLS: https://www.redhat.com/archives/libguestfs/2018-December/msg00047.html ---- New upstream version 1.8.1. ---- Rebase to new stable version 1.8.0. ---- nbdkit metapackage should depend on versioned -server subpackage etc. ---- Ne...