SUSE SLED12 Security Update : xen (SUSE-SU-2017:2327-1)

This update for xen fixes several issues. These security issues were fixed : - CVE-2017-12135: Unbounded recursion in grant table code allowed a malicious guest to crash the host or potentially escalate privileges/leak information XSA-226, bsc1051787. - CVE-2017-12137: Incorrectly-aligned updates...

Android 'su' Privilege Escalation

This module uses the su binary present on rooted devices to run a payload as root. A rooted Android device will contain a su binary often linked with an application that allows the user to run commands as root. This module will use the su binary to execute a command stager as root. The command...

SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2017:2281-1)

This update for java-171-ibm fixes the following issues : - Version update to 7.1-4.10 bsc1053431 - CVE-2017-10111 CVE-2017-10110 CVE-2017-10107 CVE-2017-10101 CVE-2017-10096 CVE-2017-10090 CVE-2017-10089 CVE-2017-10087 CVE-2017-10102 CVE-2017-10116 CVE-2017-10074 CVE-2017-10115 CVE-2017-10067...

SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2017:2141-1)

This update for libxml2 fixes the following issues: Security issues fixed : - CVE-2017-8872: Out-of-bounds read in htmlParseTryOrFinish. bsc1038444 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

CVE-2016-10401

ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root account password is known or a non-root default account exists within an ISP's deployment of these devices...

CVE-2016-10401

ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root account password is known or a non-root default account exists within an ISP's deployment of these devices...

CVE-2016-10401

ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root account password is known or a non-root default account exists within an ISP’s deployment of these devices. Recent assessments: Assessed Attacker Value: 0 Assesse...

CVE-2017-10601

A specific device configuration can result in a commit failure condition. When this occurs, a user is logged in without being prompted for a password while trying to login through console, ssh, ftp, telnet or su, etc., This issue relies upon a device configuration precondition to occur. Typically...

SUSE SLES11 Security Update : xorg-x11-libXdmcp (SUSE-SU-2017:1868-1)

This update for xorg-x11-libXdmcp fixes the following issues : - CVE-2017-2625: The generation of session key in XDM using libXdmcp might have used weak entropy, making the session keys predictable bsc1025046 Note that Tenable Network Security has extracted the preceding description block directl...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1704-1) (Stack Clash)

This Linux kernel update for SUSE Linux Enterprise 12 SP1 fixes the following issues : - A previous security update to address CVE-2017-1000364 caused unintended side-effects in several other tools, most notably Java. These issues have been remedied. bsc1045340 Note that Tenable Network Security...

SUSE SLES11 Security Update : kernel-source (SUSE-SU-2017:1696-1) (Stack Clash)

This Linux kernel update for SUSE Linux Enterprise 11 SP4 fixes the following issues : - A previous security update to address CVE-2017-1000364 caused unintended side-effects in several other tools, most notably Java. These issues have been remedied. bsc1045340, bsc1045406 Note that Tenable Netwo...

SUSE SLES12 Security Update : glibc (SUSE-SU-2017:1614-1) (Stack Clash)

This update for glibc fixes the following issues : - CVE-2017-1000366: Fix a potential privilege escalation vulnerability that allowed unprivileged system users to manipulate the stack of setuid binaries to gain special privileges. bsc1039357 - The incorrectly defined constant OTMPFILE has been...

SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2017:1489-1)

This update for ImageMagick fixes the following issues: Security issues fixed : - CVE-2017-6502: Possible file-descriptor leak in libmagickcore that could be triggered via a specially crafted webp file bsc1028075. - CVE-2017-7943: The ReadSVGImage function in svg.c allowed remote attackers to...

SUSE SLES11 Security Update : samba (SUSE-SU-2017:1391-1) (SambaCry)

This update for samba fixes the following issue : - An unprivileged user with access to the samba server could cause smbd to load a specially crafted shared library, which then had the ability to execute arbitrary code on the server as 'root'. CVE-2017-7494, bso12780, bsc1038231 Note that Tenable...

USN-3276-2: shadow regression

USN-3276-1 intended to fix a vulnerability in su. The solution introduced a regression in su signal handling. This update modifies the security fix. We apologize for the inconvenience. Original advisory details: Sebastian Krahmer discovered integer overflows in shadow utilities. A local attacker...

USN-3276-2 shadow regression

USN-3276-1 intended to fix a vulnerability in su. The solution introduced a regression in su signal handling. This update modifies the security fix. We apologize for the inconvenience. Original advisory details: Sebastian Krahmer discovered integer overflows in shadow utilities. A local attacker...

Ubuntu 14.04 LTS / 16.04 LTS : shadow regression (USN-3276-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3276-2 advisory. USN-3276-1 intended to fix a vulnerability in su. The solution introduced a regression in su signal handling. This update modifies the security fix. W...

openSUSE: Security Advisory for mysql-community-server (openSUSE-SU-2017:1209-1)

The remote host is missing an update for the Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

USN-3276-1: shadow vulnerabilities

Sebastian Krahmer discovered integer overflows in shadow utilities. A local attacker could possibly cause them to crash or potentially gain privileges via crafted input. CVE-2016-6252 Tobias Stöckmann discovered a race condition in su. A local attacker could cause su to send SIGKILL to other...

SUSE SLES11 Security Update : wireshark (SUSE-SU-2017:1174-1)

Wireshark was updated to version 2.0.12, which brings several new features, enhancements and bug fixes. These security issues were fixed : - CVE-2017-7700: In Wireshark the NetScaler file parser could go into an infinite loop, triggered by a malformed capture file. This was addressed in...