SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2015:1504-1)

Mozilla Firefox was updated to 38.2.1 ESR, fixing two severe security bugs. bsc943608 - MFSA 2015-94/CVE-2015-4497 bsc943557: Use-after-free when resizing canvas element during restyling - MFSA 2015-95/CVE-2015-4498 bsc943558: Add-on notification bypass through data URLs Note that Tenable Network...

SUSE-SU-2015:1504-1 Security update for MozillaFirefox

Mozilla Firefox was updated to 38.2.1 ESR, fixing two severe security bugs. bsc943608 MFSA 2015-94/CVE-2015-4497 bsc943557: Use-after-free when resizing canvas element during restyling MFSA 2015-95/CVE-2015-4498 bsc943558: Add-on notification bypass through data URLs...

Attacking ECMAScript Engines with Redefinition

Posted by Natalie Silvanovich = function return n; ECMAScript has a property where almost all functions and variables can be dynamically redefined. This can lead to vulnerabilities in situations where native code assumes a function or variable behaves a certain way when accessed or does not have...

SUSE-SU-2015:1324-1 Security update for the SUSE Linux Enterprise 12 kernel

The SUSE Linux Enterprise 12 kernel was updated to 3.12.44 to receive various security and bugfixes. These features were added: - mpt2sas: Added Reply Descriptor Post Queue RDPQ Array support bsc854824. - mpt3sas: Bump mpt3sas driver version to 04.100.00.00 bsc854817. Following security bugs were...

Security update for xen (important)

Xen was updated to 4.4.2 to fix multiple vulnerabilities and non-security bugs. The following vulnerabilities were fixed: CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu XSA-128 boo931625 CVE-2015-4104: PCI MSI mask bits inadvertently exposed to guests XSA-129...

SUSE SLED12 / SLES12 Security Update : tigervnc, fltk (SUSE-SU-2015:0939-1)

tigervnc and fltk were updated to fix security issues and non-security bugs. This security issue was fixed : - CVE-2015-0255: Information leak in the XkbSetGeometry request of X servers bnc915810. The update package also includes non-security fixes. See advisory for details. Note that Tenable...

SUSE SLED12 / SLES12 Security Update : Security Update for Linux Kernel (SUSE-SU-2015:0658-1)

The SUSE Linux Enterprise Server 12 kernel was updated to 3.12.39 to receive various security and bugfixes. Following security bugs were fixed : - CVE-2015-0777: The XEN usb backend could leak information to the guest system due to copying uninitialized memory. - CVE-2015-2150: Xen and the Linux...

SUSE SLES10 Security Update : kernel (SUSE-SU-2014:0773-1)

The SUSE Linux Enterprise Server 10 Service Pack 4 LTSS kernel has been updated to fix various security issues and several bugs. The following security issues have been addressed : CVE-2013-6382: Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local...

SUSE SLES11 Security Update : kernel (SUSE-SU-2015:0652-1)

The SUSE Linux Enterprise 11 Service Pack 1 LTSS kernel was updated to fix security issues on kernels on the x8664 architecture. The following security bugs have been fixed : - CVE-2013-4299: Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allowed...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2015:0178-1)

The SUSE Linux Enterprise 12 kernel was updated to 3.12.36 to receive various security and bugfixes. Following security bugs were fixed : - CVE-2014-8559: The dwalk function in fs/dcache.c in the Linux kernel through 3.17.2 did not properly maintain the semantics of renamelock, which allowed loca...

SUSE-SU-2015:0939-1 Security update for tigervnc, fltk

tigervnc and fltk were updated to fix security issues and non-security bugs. This security issue was fixed: - CVE-2015-0255: Information leak in the XkbSetGeometry request of X servers bnc915810. These non-security issues were fixed: - vncviewer-tigervnc does not display mouse cursor shape change...

openSUSE Security Update : libreoffice (openSUSE-2015-357)

LibreOffice was updated to 4.3.7 to fix one security issue and a number of bugs. The following vulnerability was fixed : - CVE-2015-1774: Specially crafted HWP documents could have led to an application crash or possibly the execution of arbitrary code boo919409 The following non-security bugs we...

FreeBSD : Several vulnerabilities found in PHP (1e232a0c-eb57-11e4-b595-4061861086c1)

The PHP project reports : The PHP development team announces the immediate availability of PHP 5.4.40. 14 security-related bugs were fixed in this release, including CVE-2014-9709, CVE-2015-2301, CVE-2015-2783, CVE-2015-1352. All PHP 5.4 users are encouraged to upgrade to this version. The PHP...

openSUSE Security Update : xen (openSUSE-2015-314)

Xen was updated to 4.3.4 to fix multiple vulnerabities and non-security bugs. The following vulnerabilities were fixed : - Long latency MMIO mapping operations are not preemptible XSA-125 CVE-2015-2752 bnc922705 - Unmediated PCI command register access in qemu XSA-126 CVE-2015-2756 bnc922706 -...

Security update for xen (important)

Xen was updated to 4.3.4 to fix multiple vulnerabities and non-security bugs. The following vulnerabilities were fixed: - Long latency MMIO mapping operations are not preemptible XSA-125 CVE-2015-2752 bnc922705 - Unmediated PCI command register access in qemu XSA-126 CVE-2015-2756 bnc922706 -...

SUSE-SU-2015:0701-1 Security update for xen

Xen was updated 4.4.201 to address three security issues and functional bugs. The following vulnerabilities were fixed: - Long latency MMIO mapping operations are not preemptible XSA-125, CVE-2015-2752, bnc922705 - Unmediated PCI command register access in qemu XSA-126, CVE-2015-2756, bnc922706 -...

openSUSE: Security Advisory for osc (openSUSE-SU-2015:0486-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for osc (important)

osc was updated to fix a security issue and some non-security bugs. osc was updated to 0.151.0, fixing the following vulnerability: fixed shell command injection via crafted service files CVE-2015-0778 boo901643 The following non-security bugs were fixed: fix times when data comes from OBS backen...

SUSE-SU-2015:0487-1 Security update for osc

osc was updated to fix a security issue and some non-security bugs. osc was updated to 0.151.0, fixing the following vulnerability: fixed shell command injection via crafted service files CVE-2015-0778 boo901643 The following non-security bugs were fixed: fix times when data comes from OBS backen...

Google Project Zero Vulnerability Disclosure Grace Period

Google’s unwavering vulnerability disclosure deadlines are the latest chapter in a decades-long debate about how to best inform affected users that there’s a security problem with their software. Since the start of the year, Google’s 90-day clock has most notably ticked down to zero on a trio of...