SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2017:2202-1)

This update for freeradius-server fixes the following issues : - update to 3.0.15 bsc1049086 - Bind the lifetime of program name and python path to the module - CVE-2017-10978: FR-GV-201: Check input / output length in makesecret bsc1049086 - CVE-2017-10983: FR-GV-206: Fix read overflow when...

SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:2175-1)

This java-180-openjdk update to version jdk8u141 icedtea 3.5.0 fixes the following issues: Security issues fixed : - CVE-2017-10053: Improved image post-processing steps bsc1049305 - CVE-2017-10067: Additional jar validation steps bsc1049306 - CVE-2017-10074: Image conversion improvements...

Debian DLA-1058-1 : krb5 security update

In MIT Kerberos 5 aka krb5 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests. For Debian 7 'Wheezy', these problems have been fixed in version 1.10.1+dfsg-5+deb7u8. We recommend that you upgrade your krb5 packages. NOTE:...

Fedora 26 : kernel (2017-adc7d95627)

The 4.12.5 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Fedora 26 : git (2017-b1b3ae6666)

Resolve an arbitrary code execution vulnerability via crafted 'ssh://' URL CVE-2017-1000117. From the release announcement : A malicious third-party can give a crafted 'ssh://...' URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's...

Fedora 25 : git (2017-8ba7572cfd)

Resolve an arbitrary code execution vulnerability via crafted 'ssh://' URL CVE-2017-1000117. From the release announcement : A malicious third-party can give a crafted 'ssh://...' URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's...

Debian DLA-1056-1 : cvs security update

It was discovered that there was a command injection vulnerability in the CVS revision control system. For Debian 7 'Wheezy', this issue has been fixed in cvs version 2:1.12.13+real-9+deb7u1. We recommend that you upgrade your cvs packages. Thanks to Thorsten Glaser for preparing and testing this...

Ubuntu 17.04 : linux, linux-raspi2 vulnerabilities (USN-3384-1)

Andrey Konovalov discovered a race condition in the UDP Fragmentation Offload UFO code in the Linux kernel. A local attacker could use this to cause a denial of service or execute arbitrary code. CVE-2017-1000112 Andrey Konovalov discovered a race condition in AFPACKET socket option handling code...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2099-1)

This update for the Linux Kernel 3.12.60-5257 fixes several issues. The following security bugs were fixed : - CVE-2017-7533: A bug in inotify code allowed local users to escalate privilege bsc1050751. - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel allowed remot...

Fedora 25 : 2:freerdp / remmina (2017-ed31e1f941)

Update to latest snapshot that contains fixes for the latest Talos discovered CVEs. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible witho...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2092-1)

This update for the Linux Kernel 3.12.69-606432 fixes several issues. The following security bugs were fixed : - CVE-2017-7533: A bug in inotify code allowed local users to escalate privilege bsc1050751. - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel allowed...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2093-1)

This update for the Linux Kernel 3.12.60-5260 fixes several issues. The following security bugs were fixed : - CVE-2017-7533: A bug in inotify code allowed local users to escalate privilege bsc1050751. - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel allowed remot...

EulerOS 2.0 SP2 : glibc (EulerOS-SA-2017-1147)

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The nssdns implementation of getnetbyname in GNU C Library aka glibc before 2.21, when the DNS backend in the Name Service Switch configuration i...

Fedora 25 : qt5-qtwebkit (2017-c844713925)

Qt5WebKit update to the new, maintained 'annulen branch'. Drop-in replacement for the old unmaintained QtWebKit. ---- Update to annulen-branch of qt5-qtwebkit, which contains a lot of security fixes. Drop-in replacement for the old unmaintained qt5-qtwebkit Note that Tenable Network Security has...

Virtuozzo 7 : readykernel-patch (VZA-2017-069)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - Integer overflow vulnerability in ip6find1stfragopt function was found. Local attacker that has privileges to open r...

Fedora 26 : rt (2017-475aed1bd1)

Security fix for CVE-2016-6127 CVE-2017-5361 CVE-2017-5943 CVE-2017-5944 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora 26 : 2:freerdp / remmina (2017-4bc09c2364)

Update to latest snapshot that contains fixes for the latest Talos discovered CVEs. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible witho...

Debian DLA-1046-1 : lucene-solr security update

lucene-solr handler supports an HTTP API /replication?command=filecontent&file= which is vulnerable to path traversal attack. Specifically, this API does not perform any validation of the user specified filename parameter. This can allow an attacker to download any file readable to Solr server...

SUSE SLED12 / SLES12 Security Update : poppler (SUSE-SU-2017:1998-1)

This update for poppler fixes the following issues: Security issues fixed : - CVE-2017-9775: Fix a stack overflow bug in pdftocairo that could have been exploited in a denial of service attack through a specially crafted PDF document. bsc1045719 - CVE-2017-9776: Fix an integer overflow bug that...

Juniper Junos CLI Local Privilege Escalation (JSA10803)

According to its self-reported version number, the remote Juniper Junos device is affected by an unspecified buffer overflow condition in the CLI component that allows a local attacker who has read-only privileges to execute arbitrary code with root privileges. C Tenable Network Security, Inc...