SUSE SLES11 Security Update : quagga (SUSE-SU-2018:0457-1)

This update for quagga fixes the following issues : - The Quagga BGP daemon contained a bug in the ASPATH size calculation that could have been exploited to facilitate a remote denial-of-service attack via specially crafted BGP UPDATE messages. CVE-2017-16227, bsc1065641 - The Quagga BGP daemon d...

Debian DLA-1281-1 : advancecomp security update

Joonun Jang discovered that the advzip tool in advancecomp, a collection of recompression utilities, was prone to a heap-based buffer overflow. This might allow an attacker to cause a denial of service application crash or other unspecified impact via a crafted file. For Debian 7 'Wheezy', these...

Fedora 26 : kernel (2018-57e732b89f)

The 4.14.18 stable update contains a number of important fixes across the tree, including some additional spectre mitigation. ---- The 4.14.17 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description bloc...

SUSE SLED12 / SLES12 Security Update : ghostscript (SUSE-SU-2018:0407-1)

This update for ghostscript fixes several issues. These security issues were fixed : - CVE-2017-9835: The gsallocrefarray function allowed remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact via a crafted...

Debian DLA-1275-1 : uwsgi security update

It was discovered that the uwsgiexpandpath function in utils.c in Unbit uWSGI, an application container server, has a stack-based buffer overflow via a large directory length that can cause a denial of service application crash or stack corruption. For Debian 7 'Wheezy', these problems have been...

ProFTPD < 1.3.5b / 1.3.6x < 1.3.6rc2 weak Diffie-Hellman key

The remote host is using ProFTPD, a free FTP server for Unix and Linux. According to its banner, the version of ProFTPD installed on the remote host is prior to 1.3.5b or 1.3.6x prior to 1.3.6rc2 and is affected by an issue in the modtls module, which might cause a weaker than intended...

Debian DLA-1272-1 : mailman security update

The mailman package has a Cross-site scripting XSS vulnerability in the web UI before 2.1.26 which allows remote attackers to inject arbitrary web script or HTML via a user-options URL For Debian 7 'Wheezy', these problems have been fixed in version 1:2.1.15-1+deb7u3 We recommend that you upgrade...

SUSE SLED12 / SLES12 Security Update : libvirt (SUSE-SU-2018:0385-1)

This update for libvirt provides several fixes. This security issue was fixed : - CVE-2018-5748: Prevent resource exhaustion via qemuMonitorIORead method which allowed to cause DoS bsc1076500. These security issues were fixed : - Add a qemu hook script providing functionality similar to Xen's...

Ubuntu 17.10 : python-django vulnerabilities (USN-3559-1)

It was discovered that Django incorrectly handled certain requests. An attacker could possibly use this to access sensitive information. CVE-2017-12794, CVE-2018-6188. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory...

FreeBSD : w3m - multiple vulnerabilities (e72d5bf5-07a0-11e8-8248-0021ccb9e74d)

Tatsuya Kinoshita reports : CVE-2018-6196 table.c: Prevent negative indent value in feedtableblocktag. CVE-2018-6197 form.c: Prevent invalid columnPos call in formUpdateBuffer. CVE-2018-6198 config.h.dist, config.h.in, configure, configure.ac, main.c, rc.c: Make temporary directory safely when...

SUSE SLES11 Security Update : Recommended update for libsndfile (SUSE-SU-2018:0351-1)

This update for libsndfile fixes a memory leak in an error path.bsc1038856 - CVE-2017-16942: A divide-by-zero error exists in the function wavw64readfmtchunk in wavw64.c, which may lead to DoS when playing a crafted audio file. bsc1069874 - CVE-2017-14634: In libsndfile 1.0.28, a divide-by-zero...

SUSE SLES12 Security Update : openvswitch (SUSE-SU-2018:0311-1)

This update for openvswitch fixes the following issues : - CVE-2017-9263: While parsing an OpenFlow role status message, there is a call to the abort functio for undefined role status reasons in the function ofpprintrolestatusmessage in lib/ofp-print.c that may be leveraged toward a remote DoS...

Fedora 26 : moodle (2018-7e086e3309)

CVE-2018-1042/CVE-2018-1043/CVE-2018-1044/CVE-2018-1045 fixes. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

pfSense < 2.2.3 Multiple Vulnerabilities (SA-15_07) (Logjam)

According to its self-reported version number, the remote pfSense install is prior to 2.2.3. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid106495;...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0276-1)

This update for the Linux Kernel 3.12.69-606432 fixes several issues. The following security issues were fixed : - CVE-2017-15868: The bnepaddconnection function in net/bluetooth/bnep/core.c in did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0267-1)

This update for the Linux Kernel 3.12.74-606466 fixes one issue. The following security issue was fixed : - CVE-2017-15868: The bnepaddconnection function in net/bluetooth/bnep/core.c in did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a crafted...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0266-1)

This update for the Linux Kernel 3.12.74-606457 fixes several issues. The following security issues were fixed : - CVE-2017-15868: The bnepaddconnection function in net/bluetooth/bnep/core.c in did not ensure that an l2cap socket is available, which allowed local users to gain privileges via a...

SUSE SLES11 Security Update : xorg-x11-libs (SUSE-SU-2018:0246-1)

This update for xorg-x11-libs fixes several issues. These security issues were fixed : - CVE-2017-16612: Heap overflows due to an integer overflow while parsing images and a signedness issue while parsing comments bsc1065386. - CVE-2017-13720: Improper check for end of string in PatterMatch cause...

Debian DLA-1257-1 : openssh security update

OpenSSH was found to be vulnerable to out of order NEWKEYS messages which could crash the daemon, resulting in a denial of service attack. For Debian 7 'Wheezy', these problems have been fixed in version 1:6.0p1-4+deb7u7. We recommend that you upgrade your openssh packages. NOTE: Tenable Network...

EulerOS 2.0 SP1 : ruby (EulerOS-SA-2018-1029)

According to the version of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The lazyinitialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernelopen, which might allow Command Injection attacks, as demonstrated by a...