SUSE SLED12 / SLES12 Security Update : fuse (SUSE-SU-2018:3219-1)

This update for fuse fixes the following security issue : CVE-2018-10906: fusermount was vulnerable to a restriction bypass when SELinux is active. This allowed non-root users to mount a FUSE file system with the 'allowother' mount option regardless of whether 'userallowother' is set in the fuse...

SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2018:3191-1)

This update for ImageMagick fixes the following issues : Security issues fixed : CVE-2018-18024: Fixed an infinite loop in the ReadBMPImage function of the coders/bmp.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. bsc1111069...

Wireshark 2.6.x < 2.6.4 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 2.6.4. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.6.4 advisory. - In Wireshark 2.6.0 to 2.6.3, the Steam IHS Discovery dissector could consume system memory. This was addressed i...

Solaris 10 (sparc) : 152920-11

JavaSE 6: update 211 patch equivalent to JDK 6u211, 64bit. Date this patch was last updated by Sun : Oct/15/18 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid118132;...

Solaris 10 (sparc) : 152100-91

JavaSE 8: update 191 patch equivalent to. Date this patch was last updated by Sun : Oct/15/18 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid118129; scriptversion"1.4";...

Debian DLA-1544-1 : tomcat7 security update

Sergey Bobrov discovered that when the default servlet returned a redirect to a directory e.g. redirecting to /foo/ when the user requested /foo a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice. For Debian 8 'Jessie', this problem has...

Fedora 27 : python-paramiko (2018-aff51f5e62)

Python Paramiko versions 2.3.2 and 2.4.1 are vulnerable to an authentication bypass in paramiko/authhandler.py. A remote attacker could exploit this vulnerability in Paramiko SSH servers to execute arbitrary code. Note that applications using Paramiko only as a client such as ansible are not...

Fedora 27 : libgit2 (2018-7d993184f6)

Update to 0.26.7 CVE-2018-17456 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 7030...

Fedora 27 : mediawiki (2018-edf90410ea)

https://www.mediawiki.org/wiki/Releasenotes/1.29MediaWiki1.29.3 - T169545, CVE-2018-0503 SECURITY: $wgRateLimits entry for 'user' overrides 'newbie'. - T194605, CVE-2018-0505 SECURITY: BotPasswords can bypass CentralAuth's account lock. - T180551 Fix LanguageSrTest for language converter - T18055...

Fedora 27 : liblouis (2018-9a09435935)

Security fix for CVE-2018-17294 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 7030...

Debian DLA-1530-1 : imagemagick security update

Several security vulnerabilities were discovered in ImageMagick, an image manipulation program, that allow remote attackers to cause denial of service application crash, excessive memory allocation, or other unspecified effects or out of bounds memory access via DCM, PWP, CALS, PICT, BMP, DIB, or...

Fedora 27 : glusterfs (2018-9a4d7ec61e)

3.12.14 GA Security Fix for CVE-2018-10904 Security Fix for CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for CVE-2018-10927 Security Fix for CVE-2018-1092...

Fedora 27 : spamassassin (2018-6ed251c42b)

Fixed some small bugs in the previous package: Initial rules now have the correct version, sought channel config is dropped since it doesn't exist anymore and build / runtime deps adjusted. ---- Update to 3.4.2. Fixes CVE-2017-15705, CVE-2018-11780 and CVE-2018-11781 along with many other bugfixe...

Debian DLA-1522-1 : strongswan security update

Sze Yiu Chau and his team from Purdue University and The University of Iowa found several security issues in the gmp plugin for strongSwan, an IKE/IPsec suite. CVE-2018-16151 The OID parser in the ASN.1 code in gmp allows any number of random bytes after a valid OID. CVE-2018-16152 The...

Debian DLA-1519-1 : python2.7 security update

Multiple vulnerabilities were found in the CPython interpreter which can cause denial of service, information gain, and arbitrary code execution. CVE-2017-1000158 CPython aka Python is vulnerable to an integer overflow in the PyStringDecodeEscape function in stringobject.c, resulting in heap-base...

SUSE SLES12 Security Update : gnutls (SUSE-SU-2018:2825-1)

This update for gnutls fixes the following issues : This update for gnutls fixes the following issues : Security issues fixed : Improved mitigations against Lucky 13 class of attacks 'Just in Time' PRIME + PROBE cache-based side channel attack can lead to plaintext recovery CVE-2018-10846,...

Solaris 10 (sparc) : 126206-13

SunOS 5.10: zebra ripd quagga patch. Date this patch was last updated by Sun : Sep/24/18 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid117683; scriptversion"1.4";...

SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2018:2778-1)

This update for ImageMagick fixes the following issues : The following security vulnerabilities were fixed : CVE-2018-16329: Prevent NULL pointer dereference in the GetMagickProperty function leading to DoS bsc1106858 CVE-2018-16323: ReadXBMImage left data uninitialized when processing an XBM fil...

macOS : Apple Safari < 12 Multiple Vulnerabilities

The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 12. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid117617; scriptversion"1.6"; scriptcvsdate"Date: 2019/11/01"; scriptcveid...

Debian DLA-1507-1 : libapache2-mod-perl2 security update

Jan Ingvoldstad discovered that libapache2-mod-perl2 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because contrary to the documentation there is no configuration option that permits Perl code for the administrator's control of HTTP request processi...