EulerOS 2.0 SP1 : libXpm, libXdmcp, libICE (EulerOS-SA-2017-1211)

According to the versions of the libXpm, libXdmcp, libICE packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An integer overflow flaw leading to a heap-based buffer overflow was found in libXpm. An attacker could use this flaw to crash...

EulerOS 2.0 SP1 : libnl3 (EulerOS-SA-2017-1161)

According to the version of the libnl3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An integer overflow leading to a heap-buffer overflow was found in the libnl library. An attacker could use this flaw to cause an application...

EulerOS 2.0 SP2 : libtasn1 (EulerOS-SA-2017-1172)

According to the versions of the libtasn1 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A heap-based buffer overflow flaw was found in the way the libtasn1 library decoded certain DER-encoded inputs. A specially crafted DER-encode...

Debian DLA-1091-1 : unrar-free security update

It was discovered that there was a directory traversal vulnerability in unrar-free, a unarchiver for .rar files, where pathnames of the form '../filename' were unpacked into the parent directory. For Debian 7 'Wheezy', this issue has been fixed in unrar-free version 1:0.0.1+cvs20071127-2+deb7u1. ...

SUSE SLED12 / SLES12 Security Update : postgresql94 (SUSE-SU-2017:2355-1)

This update for postgresql94 fixes the following issues : - CVE-2017-7547: Further restrict visibility of pgusermappings.umoptions, to protect passwords stored as user mapping options. bsc1051685 - CVE-2017-7546: Disallow empty passwords in all password-based authentication methods. bsc1051684 -...

Fedora 26 : libidn2 (2017-2d4ead8da9)

Libidn2 2.0.4 released 2017-08-30 =================================== - Fix integer overflow in bidi.c/isBidi - Fix integer overflow in punydecode.c/decodedigit - Improve docs - Fix idnafree to idnfree - Update fuzzer corpora Note that Tenable Network Security has extracted the preceding...

Fedora 25 : libidn2 (2017-57722ccd30)

Libidn2 2.0.4 released 2017-08-30 =================================== - Fix integer overflow in bidi.c/isBidi - Fix integer overflow in punydecode.c/decodedigit - Improve docs - Fix idnafree to idnfree - Update fuzzer corpora Note that Tenable Network Security has extracted the preceding...

Debian DLA-1072-1 : mercurial security update

Two significant vulnerabilities were found in the Mercurial version control system which could lead to shell injection attacks and out-of-tree file overwrite. CVE-2017-1000115 Mercurial's symlink auditing was incomplete prior to 4.3, and could be abused to write to files outside the repository...

SUSE SLED12 / SLES12 Security Update : icu (SUSE-SU-2017:2318-1)

icu was updated to fix two security issues. These security issues were fixed : - CVE-2014-8147: The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode ICU used an integer data type that is...

Debian DLA-1076-1 : php5 security update

The finishnesteddata function in ext/standard/varunserializer.re in PHP is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP. For Debian 7 'Wheezy', these problems have been fixed in version...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:2286-1)

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.82 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-1000111: Fixed a race condition in net-packet code that could be exploited to cause out-of-bounds memory access bsc1052365. - CVE-2017-100011...

SUSE SLED12 / SLES12 Security Update : libzypp (SUSE-SU-2017:2264-1)

The Software Update Stack was updated to receive fixes and enhancements. libzypp : - CVE-2017-7435, CVE-2017-7436, CVE-2017-9269: Fix GPG check workflows, mainly for unsigned repositories and packages. bsc1045735, bsc1038984 - Fix gpg-pubkey release creation time computation. bsc1036659 - Update...

Fedora 25 : kernel (2017-73f71456d7)

The 4.12.8 stable kernel update contains a number of important fixes across the tree. ---- The 4.12.5 kernel rebase contains new features and many bug fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

Fedora 26 : kernel (2017-4336d64e21)

The 4.12.8 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

SUSE SLES11 Security Update : freeradius-server (SUSE-SU-2017:2244-1)

This update for freeradius-server fixes the following issues: Security issues fixed : - CVE-2017-10981: DHCP - Fix memory leak in frdhcpdecode. bnc1049086 - CVE-2017-10982: Fix buffer over-read in frdhcpdecodeoptions. bsc1049086 - CVE-2017-10983: Fix read overflow when decoding option 63...

SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2017:2243-1)

This update for freeradius fixes the following issues: Security issues fixed : - CVE-2017-10988: Decode 'signed' attributes correctly. bnc1049086 - CVE-2017-10987: Check for option overflowing the packet. bnc1049086 - CVE-2017-10985: Fix infinite loop and memory exhaustion with 'concat' attribute...

Juniper Junos snmpd SNMP Packet Handling RCE (JSA10793)

According to its self-reported version number and configuration, the remote Juniper Junos device is affected by a remote code execution vulnerability in the snmpd daemon due to improper handling of SNMP packets. An unauthenticated, remote attacker can exploit this, via a specially crafted SNMP...

Juniper Junos rpd MPLS Ping Packet Handling DoS (JSA10795)

According to its self-reported version number and configuration, the remote Juniper Junos device is affected by a denial of service vulnerability in the rpd daemon due to improper handling of MPLS ping packets. An unauthenticated, remote attacker can exploit this, via a specially crafted MPLS pin...

Debian DLA-1063-1 : extplorer security update

CVE-2017-12756 Fix command inject in transfer from another server in extplorer 2.1.9 and prior allows attacker to inject command via the userfile0 parameter. For Debian 7 'Wheezy', these problems have been fixed in version 2.1.0b6+dfsg.3-4+deb7u5. We recommend that you upgrade your extplorer...

Fedora 26 : bodhi (2017-48f0384090)

Update to 2.9.1, which addresses CVE-2017-1002152. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...