openSUSE Security Update : apache2 (openSUSE-2017-865)

This update for apache2 fixes the following issues : Security issue fixed : - CVE-2017-9788: Uninitialized memory reflection in modauthdigest. bsc1048576 Bug fixes : - Include individual sysconfig.d files instead of the whole sysconfig.d directory. - Include sysconfig.d/include.conf after...

Security update for evince (important)

This update for evince fixes the following issues: - CVE-2017-1000083: Remote attackers could have used the comicbook mode of evince to inject shell code. bsc1046856, bgo784630 This update was imported from the SUSE:SLE-12-SP2:Update update project...

REDDOXX Appliance Arbitrary File Disclosure

Advisory: Unauthenticated Arbitrary File Disclosure in REDDOXX Appliance RedTeam Pentesting discovered an arbitrary file disclosure vulnerability in the REDDOXX appliance software, which allows unauthenticated attackers to download arbitrary files from the affected system. Details ======= Product...

SUSE-SU-2017:1923-1 Security update for Linux Kernel Live Patch 4 for SLE 12 SP2

This update for the Linux Kernel 4.4.38-93 fixes several issues. The following security bugs were fixed: - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be 'jumped' over the stack guard...

SUSE-SU-2017:1914-1 Security update for Linux Kernel Live Patch 3 for SLE 12 SP2

This update for the Linux Kernel 4.4.21-90 fixes several issues. The following security bugs were fixed: - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be 'jumped' over the stack guard...

SUSE-SU-2017:1907-1 Security update for Linux Kernel Live Patch 1 for SLE 12 SP2

This update for the Linux Kernel 4.4.21-81 fixes several issues. The following security bugs were fixed: - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be 'jumped' over the stack guard...

SUSE-SU-2017:1903-1 Security update for Linux Kernel Live Patch 8 for SLE 12 SP2

This update for the Linux Kernel 4.4.59-9220 fixes several issues. The following bugs were fixed: - CVE-2017-1000364: The previous fix for the stack gap increase tracked by CVE-2017-1000364 had a regression, which is fixed by this follow up patch. bsc1039496...

EulerOS 2.0 SP2 : icu (EulerOS-SA-2017-1129)

According to the version of the icu packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Stack-based buffer overflow in the uresgetByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode ICU before 54.1 fo...

openSUSE Security Update : sudo (openSUSE-2017-744)

This update for sudo fixes the following security issue : - CVE-2017-1000368: A follow-up fix to CVE-2017-1000367, the Linux process name could also contain a newline, which could be used to trick sudo to read/write to an arbitrary open terminal. bsc1042146 Also the following non security bug was...

Security update for sudo (important)

This update for sudo fixes the following security issue: - CVE-2017-1000368: A follow-up fix to CVE-2017-1000367, the Linux process name could also contain a newline, which could be used to trick sudo to read/write to an arbitrary open terminal. bsc1042146 Also the following non security bug was...

Security update for glibc (important)

This update for glibc fixes the following issues: - CVE-2017-1000366: Fix a potential privilege escalation vulnerability that allowed unprivileged system users to manipulate the stack of setuid binaries to gain special privileges. bsc1039357 - A bug in glibc that could result in deadlocks between...

EulerOS 2.0 SP2 : ImageMagick (EulerOS-SA-2017-1112)

According to the versions of the ImageMagick packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service CPU consumption via a crafted DDS...

CVE-2017-0288

Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka "Windows Graphics Information Disclosure Vulnerability". This...

Information disclosure

Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka "Graphics Uniscribe Information Disclosure Vulnerability". Thi...

EulerOS 2.0 SP2 : irssi (EulerOS-SA-2017-1113)

According to the version of the irssi package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service use-after-free and possibly execute arbitrary code via...

EulerOS 2.0 SP2 : samba (EulerOS-SA-2017-1105)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using...

openSUSE Security Update : libxml2 (openSUSE-2017-663)

This update for libxml2 fixes the following issues : - CVE-2017-9047, CVE-2017-9048: The function xmlSnprintfElementContent in valid.c was vulnerable to a stack-based buffer overflow bsc1039063, bsc1039064 - CVE-2017-9049: The function xmlDictComputeFastKey in dict.c was vulnerable to a heap-base...

EulerOS 2.0 SP2 : rpcbind (EulerOS-SA-2017-1103)

According to the version of the rpcbind package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that due to the way rpcbind uses libtirpc libntirpc, a memory leak can occur when parsing specially crafted XDR messages. An attacker...

openSUSE Security Update : sudo (openSUSE-2017-636)

This update for sudo fixes the following issues : CVE-2017-1000367 : - Due to incorrect assumptions in /proc/pid/stat parsing, a local attacker can pretend that his tty is any file on the filesystem, thus gaining arbitrary file write access on SELinux-enabled systems. bsc1039361 - Fix FQDN for...

Security update for rpcbind (important)

This update for rpcbind fixes the following issues: - CVE-2017-8779: A crafted UDP package could lead rcpbind to remote denial-of-service bsc1037559 This update was imported from the SUSE:SLE-12-SP2:Update update project...