SUSE-SU-2018:0586-1 Security update for the Linux Kernel (Live Patch 12 for SLE 12 SP2)

This update for the Linux Kernel 4.4.74-9235 fixes several issues. The following security issue was fixed: - CVE-2017-18075: crypto/pcrypt.c in the Linux kernel mishandled freeing instances, allowing a local user able to access the AFALG-based AEAD interface CONFIGCRYPTOUSERAPIAEAD and pcrypt...

openSUSE Security Update : systemd (openSUSE-2018-216)

This update for systemd fixes the following issues : Security issue fixed : - CVE-2017-18078: tmpfiles: refuse to chown/chmod files which are hardlinked, unless protectedhardlinks sysctl is on. This could be used by local attackers to gain privileges bsc1077925 Non Security issues fixed : - core:...

openSUSE Security Update : glibc (openSUSE-2018-184)

This update for glibc fixes the following issues : Security issues fixed : - CVE-2017-8804: Fix memory leak after deserialization failure in xdrbytes, xdrstring bsc1037930 - CVE-2017-12132: Reduce EDNS payload size to 1200 bytes bsc1051791 - CVE-2018-6485,CVE-2018-6551: Fix integer overflows in...

Security update for glibc (important)

This update for glibc fixes the following issues: Security issues fixed: - CVE-2017-8804: Fix memory leak after deserialization failure in xdrbytes, xdrstring bsc1037930 - CVE-2017-12132: Reduce EDNS payload size to 1200 bytes bsc1051791 - CVE-2018-6485,CVE-2018-6551: Fix integer overflows in...

Description of the security update for Outlook 2010: February 13, 2018

Description of the security update for Outlook 2010: February 13, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common...

Microsoft Windows Kernel CVE-2018-0830 Local Information Disclosure Vulnerability

Description Microsoft Windows is prone to a local information-disclosure vulnerability. Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version...

EulerOS 2.0 SP2 : gdk-pixbuf2 (EulerOS-SA-2018-1046)

According to the versions of the gdk-pixbuf2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An exploitable heap overflow vulnerability exists in the gdkpixbufjpegimageloadincrement functionality of Gdk-Pixbuf 2.36.6. A specially...

Microsoft Office CVE-2018-0851 Memory Corruption Vulnerability

Description Microsoft Office is prone to a memory-corruption vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. Technologies Affected Microsoft...

EulerOS 2.0 SP2 : rsync (EulerOS-SA-2018-1050)

According to the version of the rsync package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The parsearguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers...

Security update for freetype2 (important)

This update for freetype2 fixes the following security issues: - CVE-2016-10244: Make sure that the parsecharstrings function in type1/t1load.c does ensure that a font contains a glyph name to prevent a DoS through a heap-based buffer over-read or possibly have unspecified other impact via a...

openSUSE Security Update : freetype2 (openSUSE-2018-156)

This update for freetype2 fixes the following security issues : - CVE-2016-10244: Make sure that the parsecharstrings function in type1/t1load.c does ensure that a font contains a glyph name to prevent a DoS through a heap-based buffer over-read or possibly have unspecified other impact via a...

openSUSE Security Update : spice-vdagent (openSUSE-2018-144)

This update for spice-vdagent provides the following fixes : This security issue was fixed : - CVE-2017-15108: Properly escape save directory that is passed to the shell to prevent local attacker with access to the session the agent runs from injecting arbitrary commands to be executed bsc1070724...

openSUSE Security Update : libXfont (openSUSE-2018-124)

This update for libXfont fixes several issues. These security issues were fixed : - CVE-2017-13720: Improper check for end of string in PatterMatch caused invalid reads bsc1054285 - CVE-2017-13722: Malformed PCF file could have caused DoS or leak information bsc1049692 - Prevent the X server from...

EulerOS 2.0 SP2 : java-1.8.0-openjdk (EulerOS-SA-2018-1028)

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Multiple flaws were found in the Hotspot and AWT components of OpenJDK. An untrusted Java application or applet could use these flaw...

EulerOS 2.0 SP2 : xdg-user-dirs (EulerOS-SA-2018-1025)

According to the version of the xdg-user-dirs package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that the system umask policy is not being honored when creating XDG user directories /Desktop etc on first login. This could lea...

EulerOS 2.0 SP2 : dracut (EulerOS-SA-2018-1021)

According to the version of the dracut packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions a commonly us...

EulerOS 2.0 SP2 : ncurses (EulerOS-SA-2018-1006)

According to the version of the ncurses packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Stack-based buffer overflow in the ncwriteentry function in tinfo/writeentry.c in ncurses 6.0 allows attackers to cause a denial of service...

EulerOS 2.0 SP2 : evince (EulerOS-SA-2018-1010)

According to the version of the evince packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91.CVE-2017-1000159 Note that Tenable Networ...

Security update for glibc (important)

This update for glibc fixes the following issues: - A privilege escalation bug in the realpath function has been fixed. CVE-2018-1000001, bsc1074293 - A memory leak and a buffer overflow in the dynamic ELF loader has been fixed. CVE-2017-1000408, CVE-2017-1000409, bsc1071319 - An issue in the cod...

Security update for qemu (important)

This update for qemu fixes the following issues: This update for qemu fixes the following issues: A mitigation for a security flaw has been applied: - CVE-2017-5715: QEMU was updated to allow passing through new MSR and CPUID flags from the host VM to the CPU, to allow enabling/disabling branch...