Ubuntu 17.04 / 17.10 : exim4 vulnerability (USN-3493-1)

It was discovered that Exim incorrectly handled memory in the ESMTP CHUNKING extension. A remote attacker could use this issue to cause Exim to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the...

Fedora 26 : mediawiki (2017-59251d350d)

https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November /000216.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible witho...

Debian DLA-1187-1 : openjdk-7 security update

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in impersonation of Kerberos services, denial of service, unauthorized access, sandbox bypass or HTTP header injection. For Debian 7 'Wheezy', these problems have been fixed in versio...

Debian DLA-1186-1 : xorg-server security update

Several vulnerabilities have been discovered in the X.Org X server. An attacker who's able to connect to an X server could cause a denial of service or potentially the execution of arbitrary code. For Debian 7 'Wheezy', these problems have been fixed in version 2:1.12.4-6+deb7u8. We recommend tha...

SUSE SLED12 / SLES12 Security Update : file (SUSE-SU-2017:3048-1)

The GNU file utility was updated to version 5.22. Security issues fixed : - CVE-2014-9621: The ELF parser in file allowed remote attackers to cause a denial of service via a long string. bsc913650 - CVE-2014-9620: The ELF parser in file allowed remote attackers to cause a denial of service via a...

Debian DLA-1181-1 : xen security update

Multiple vulnerabilities have been discovered in the Xen hypervisor : CVE-2017-15588 Jann Horn discovered a race condition that can cause a stale TLB entry which might result in privilege escalation, denial of service or information leak. CVE-2017-15589 Roger Pau Monn discovered a hypervisor stac...

Ubuntu 17.04 : linux, linux-raspi2 vulnerability (USN-3484-1)

It was discovered that the KVM subsystem in the Linux kernel did not properly keep track of nested levels in guest page tables. A local attacker in a guest VM could use this to cause a denial of service host OS crash or possibly execute arbitrary code in the host OS. Note that Tenable Network...

Fedora 26 : qt5-qtwebengine (2017-9a7e562fca)

An update of QtWebEngine to the security and bugfix release 5.9.2, including : Chromium Snapshot : - Security fixes from Chromium up to version 61.0.3163.79 Including: CVE-2017-5092, CVE-2017-5093, CVE-2017-5095, CVE-2017-5097, CVE-2017-5099, CVE-2017-5102, CVE-2017-5103, CVE-2017-5107,...

Debian DLA-1174-1 : konversation security update

It was discovered that there was a denial of service vulnerability in the konversation IRC client related to parsing of color formatting codes. For Debian 7 'Wheezy', this issue has been fixed in konversation version 1.4-1+deb7u2. We recommend that you upgrade your konversation packages. NOTE:...

Virtuozzo 7 : OVMF / am_storage / anaconda / anaconda-core / etc (VZA-2017-103)

According to the version of the OVMF / amstorage / anaconda / anaconda-core / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - Downloadable ISO images of Virtuozzo as well as their MD5 and SHA256 checksums can now be verified...

Fedora 25 : lame (2017-38830f1443)

Update to 3.100 1470202, 1505107 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 703...

Tenable SecurityCenter OpenSSL 1.0.2 < 1.0.2m Multiple Vulnerabilities

The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of OpenSSL. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid104639; scriptversion"1.7";...

Virtuozzo 7 : wpa_supplicant (VZLSA-2017-2907)

An update for wpasupplicant is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Fedora 25 : libgcrypt (2017-8cd171f540)

Minor security update release 1.7.9. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

SUSE SLES11 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2017:2872-2)

This update for MozillaFirefox and mozilla-nss fixes the following issues: Mozilla Firefox was updated to ESR 52.4 bsc1060445 - MFSA 2017-22/CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces - MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating...

SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2017:2971-1)

This update for samba fixes several issues. These security issues were fixed : - CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file, leaking information from the server to the client bsc1058624. - CVE-2017-12150: Always enforce smb signing when it is configured...

Debian DLA-1169-1 : postgresql-common security update

A security vulnerability has been found in postgresql-common, Debian's PostgreSQL database cluster management tools. CVE-2017-8806 It was discovered that the pgctlcluster, pgcreatecluster and pgupgradecluster commands handled symbolic links insecurely which could result in local denial of service...

SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2017:2949-1)

This update for ImageMagick fixes the following issues: Security issues fixed : - CVE-2017-15033: A denial of service attack memory leak was fixed in ReadYUVImage in coders/yuv.c bsc1061873 - CVE-2017-11446: An infinite loop in ReadPESImage was fixed. bsc1049379 - CVE-2017-12433: A memory leak in...

Debian DLA-1164-1 : mupdf security update

Two security issues were discovered in mupdf, a lightweight PDF viewer. CVE-2017-14687 MuPDF allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. This occurs because of mishandling of XML tag name comparisons. CVE-2017-15587 An integer...

Debian DLA-1165-1 : libpam4j security update

It was discovered that libpam4j, a Java binding for libpam.so, does not call pamacctmgmt. As a consequence, the PAM account is not properly verified. Any user with a valid password but with deactivated or disabled account was able to log in. For Debian 7 'Wheezy', these problems have been fixed i...