Security update for go1.11 (important)

This new package for go1.11 fixes the following issues: Security issues fixed: - CVE-2018-16873: Fixed a remote code execution in go get, when executed with the -u flag bsc1118897 - CVE-2018-16874: Fixed an arbitrary filesystem write in go get, which could lead to code execution bsc1118898 -...

[SECURITY] [DLA 1562-3] poppler regression update

Package : poppler Version : 0.26.5-2+deb8u7 CVE ID : CVE-2018-16646 Debian Bug : A second regression issue has been resolved in the poppler PDF rendering shared library this time introduced with version 0.26.5-2+deb8u6 see DLA 1562-2. CVE-2018-16646 In Poppler 0.68.0, the Parser::getObj function ...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : poppler regression (USN-3837-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3837-2 advisory. USN-3837-1 fixed vulnerabilities in poppler. A regression was reported regarding the previous update. This update fixes the...

Debian DLA-1591-2 : libphp-phpmailer regression update

A possible regression was found in the recent security update for libphp-phpmailer, announced as DLA 1591-1. During backporting a new variable have accidentally introduced to a conditional statement from a much later version. Thanks to Salvatore Bonaccorso carnil for reporting this. For Debian 8...

SUSE-SU-2018:3808-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2017-14997: ImageMagick allowed remote attackers to cause a denial of service excessive memory allocation because of an integer underflow in ReadPICTImage in coders/pict.c. bsc1112399 - CVE-2018-16644: A regression in the security fix...

Security update for ImageMagick (moderate)

This update for ImageMagick fixes the following issues: - CVE-2017-14997: GraphicsMagick allowed remote attackers to cause a denial of service excessive memory allocation because of an integer underflow in ReadPICTImage in coders/pict.c. bsc1112399 - CVE-2018-16644: An regression in the security...

Debian DLA-1554-2 : 389-ds-base regression update

A regression was found in the recent security update for 389-ds-base the 389 Directory Server, announced as DLA-1554-2, caused by an incomplete fix for CVE-2018-14648. The regression caused the server to crash when processing requests with empty attributes. For Debian 8 'Jessie', this problem has...

SUSE-SU-2018:3465-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2017-14997: GraphicsMagick allowed remote attackers to cause a denial of service excessive memory allocation because of an integer underflow in ReadPICTImage in coders/pict.c. bsc1112399 - CVE-2018-16644: An regression in the security...

[slackware-security] Slackware 14.2 kernel

New kernel packages are available for Slackware 14.2 to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/linux-4.4.157/: Upgraded. This kernel removes the unnecessary vmacacheflushall code which could have led to a use-after-free situation and...

USN-3722-5 clamav regression

USN-3722-1 fixed vulnerabilities in ClamAV. The new package introduced an issue which caused dpkg-reconfigure to enter an infinite loop. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that ClamAV incorrectly handled parsing certain...

OPENSUSE-SU-2018:2327-1 Security update for python-Django

This update for python-Django to 1.11.15 fixes the following issues: This security issue was fixed: - CVE-2018-14574: Prevent open redirect in django.middleware.common.CommonMiddleware bsc1102680. These non-security issues were fixed: - Fixed WKBWriter.write and writehex for empty polygons on GEO...

[SECURITY] [DLA 1437-2] slurm-llnl regression update

Package : slurm-llnl Version : 14.03.9-5+deb8u4 CVE ID : CVE-2018-10995 Debian Bug : 893044 The security update for slurm-llnl introduced a regression in the fix for CVE-2018-10995 which broke accounting. For Debian 8 "Jessie", this problem has been fixed in version 14.03.9-5+deb8u4. We recommend...

[SECURITY] [DLA 1442-2] mailman regression update

Package : mailman Version : 1:2.1.18-2+deb8u4 Debian Bug : 904680 The security update of mailman announced as DLA-1442-1 introduced a regression due to an incomplete fix for CVE-2018-13796 that broke the admin and listinfo overview pages. For Debian 8 "Jessie", this problem has been fixed in...

SUSE SLES11 Security Update : kernel (SUSE-SU-2018:1482-1)

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. This update main focus is a regression fix in SystemV IPC handling. bsc1093600 The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has...

New Relic: User is able to access and create private synthetics locations without upgrading (regression of #276157)

It seems like the fix done for 276157 wasn't enough, as I'm able to bypass it and generate private synthetics locations without approval or the proper plan. This is the page that users see when they navigate to the private synthetics location: F291890 I'm able bypass this by navigating as an Admi...

Debian DLA-1314-1 : simplesamlphp security update

Cure53 discovered that in SimpleSAMLphp, in rare circumstances an invalid signature on the SAML 2.0 HTTP Redirect binding could be considered valid. Additionally this update fixes a regression introduced in DLA-1298 by the backported patch for SSA-201802-01/CVE-2018-7644. For Debian 7 'Wheezy',...

[SECURITY] [DLA 1314-1] simplesamlphp security update

Package : simplesamlphp Version : 1.9.2-1+deb7u4 CVE ID : CVE-2018-7711 Cure53 discovered that in SimpleSAMLphp, in rare circumstances an invalid signature on the SAML 2.0 HTTP Redirect binding could be considered valid. Additionally this update fixes a regression introduced in DLA-1298 by the...

USN-3522-4: Linux kernel (Xenial HWE) regression | Cloud Foundry

Severity Critical Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description USN-3522-2 fixed a vulnerability in the Linux Hardware Enablement kernel for Ubuntu 14.04 LTS to address Meltdown CVE-2017-5754. Unfortunately, that update introduced a regression where a few systems...

USN-3477-4 firefox regression

USN-3477-1 fixed vulnerabilities in Firefox. The update introduced a crash reporting issue where background tab crash reports were sent to Mozilla without user opt-in. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple security issues were...

CVE-2017-16239

In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters for example, the ImagePropertiesFilter or the IsolatedHostsFilter. All setups using Nova Filter...