Fedora 29 : expat (2019-672ae0f060)

This update of expat fixes the following security issue : - CVE-2019-15903 -- Fix heap overflow triggered by XMLGetCurrentLineNumber or XMLGetCurrentColumnNumber, and deny internal entities closing the doctype The following bug fixes are also included : - Fix cases where XMLStopParser did not hav...

EulerOS 2.0 SP8 : postgresql (EulerOS-SA-2019-2090)

According to the version of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was discovered in postgresql where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, wit...

EulerOS 2.0 SP8 : openldap (EulerOS-SA-2019-2087)

According to the version of the openldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN database admin privileges for...

EulerOS 2.0 SP8 : php (EulerOS-SA-2019-2089)

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - When PHP EXIF extension is parsing EXIF information from an image, e.g. via exifreaddata function, in PHP versions 7.1.x below 7.1.31, 7.2.x below...

Fedora 29 : ibus (2019-5bf13218a5)

Security fix for CVE-2019-14822 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

SUSE SLED15 / SLES15 Security Update : u-boot (SUSE-SU-2019:2475-1)

This update for u-boot fixes the following issues : Security issues fixed : CVE-2019-13106: Fixed stack-based buffer overflow via a crafted ext4 filesystem that may lead to code execution bsc1144656. CVE-2019-13104: Fixed an underflow that could cause memcpy to overwrite a very large amount of da...

SUSE SLED15 / SLES15 Security Update : python-numpy (SUSE-SU-2019:2462-1)

This update for python-numpy fixes the following issues : Non-security issues fixed : Updated to upstream version 1.16.1. bsc1149203 jscSLE-8532 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

Fedora 30 : libnbd (2019-749d828945)

New upstream version 1.0.2. Contains fix for NBD Protocol Downgrade Attack CVE-2019-14842. ---- Add upstream patch to fix nbdsh for nbdkit tests. ---- New stable version 1.0.1. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

Fedora 29 : znc (2019-154930f99b)

Fixes CVE-2019-12816 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security,...

Debian DLA-1928-1 : php5 security update

An update has been made to php5, a server-side, HTML-embedded scripting language. Specficially, as reported in 805222, the ability to build extensions in certain older versions of PHP within Debian has been hindered by an upstream change which first appeared in PHP 5.6.15. This update applies a f...

Debian DLA-1931-2 : libgcrypt20 regression update

It was discovered that the fix to address an ECDSA timing attack in the libgcrypt20 cryptographic library was incomplete. For Debian 8 'Jessie', this issue has been fixed in libgcrypt20 version 1.6.3-2+deb8u8. Thanks to Albert Chin-A-Young for the report. We recommend that you upgrade your...

EulerOS 2.0 SP3 : libxml2 (EulerOS-SA-2019-2013)

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libxml2 in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or...

EulerOS 2.0 SP3 : libssh (EulerOS-SA-2019-2067)

According to the version of the libssh package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without...

EulerOS 2.0 SP3 : openssl1.1.0f (EulerOS-SA-2019-2005)

According to the version of the openssl1.1.0f packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in...

EulerOS 2.0 SP3 : samba (EulerOS-SA-2019-2018)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Samba 4.9.x before 4.9.9 and 4.10.x before 4.10.5 has a NULL pointer dereference, leading to Denial of Service. This is related to the AD DC DNS...

EulerOS 2.0 SP3 : libexif (EulerOS-SA-2019-2036)

According to the versions of the libexif package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Most digital cameras produce EXIF files, which are JPEG files with extra tags that contain information about the image. The EXIF library allows...

EulerOS 2.0 SP5 : golang (EulerOS-SA-2019-1967)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an...

EulerOS 2.0 SP5 : icu (EulerOS-SA-2019-1969)

According to the versions of the icu packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows...

EulerOS 2.0 SP5 : gvfs (EulerOS-SA-2019-1968)

According to the versions of the gvfs packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not...

Debian DLA-1929-1 : php-pecl-http security update

A vulnerability has been discovered in php-pecl-http, the peclhttp module for PHP 5 Extended HTTP Support. A type confusion vulnerability in the mergeparam function allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests. For Debian 8 'Jessie', this problem has...