Debian DLA-1020-1 : jetty security update

It was discovered that Jetty, a Java servlet engine and webserver, was vulnerable to a timing attack which might reveal cryptographic credentials such as passwords to a local user. For Debian 7 'Wheezy', these problems have been fixed in version 6.1.26-1+deb7u1. We recommend that you upgrade your...

Debian DLA-1017-1 : mpg123 security update

It was discovered that there was a remote denial of service vulnerability in the mpg123 audio library/player. This was caused by a heap-based buffer over-read in the 'convertlatin1' function. For Debian 7 'Wheezy', this issue has been fixed in mpg123 version 1.14.4-1+deb7u2. We recommend that you...

Virtuozzo 7 : readykernel-patch (VZA-2017-063)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - The NFSv4 server in the Linux kernel compiled with CONFIGNFSDPNFS enabled does not properly validate layout type whe...

Ubuntu 14.04 LTS / 16.04 LTS : Thunderbird vulnerabilities (USN-3321-1)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, obtain sensitive information or execute arbitrary...

Debian DLA-1014-1 : libclamunrar security update

It was discovered that there was an arbitrary code execution vulnerability in libcamunrar, a library to add unrar support to the Clam anti-virus software. This was caused by an integer overflow resulting in a negative value of the DestPos variable, which allows the attacker to write out of bounds...

Fedora 25 : globus-ftp-client / globus-gass-cache-program / globus-gass-copy / etc (2017-7591a8e2c9)

globus-ftp-client - Adapt to Perl 5.26 - POSIX::tmpnam no longer available - Remove some redundant tests to reduce test time globus-gass-cache-program - GT6 update globus-gass-copy - Don't attempt sshftp data protection without creds 9.24 - Checksum verification based on contribution from IBM 9.2...

Debian DLA-1011-1 : sudo security update

Todd Miller's sudo version 1.8.20p1 and earlier is vulnerable to an input validation embedded newlines in the getprocessttyname function resulting in information disclosure and command execution. The previous announcement DLA-970-1 was about a similar security issue CVE-2017-1000367 which wasn't...

Fedora 24 : xen (2017-b3bdaf58bc)

xen: various flaws 1463247 blkif responses leak backend stack data XSA-216 page transfer may allow PV guest to elevate privilege XSA-217 Races in the grant table unmap code XSA-218 x86: insufficient reference counts during shadow emulation XSA-219 x86: PKRU and BND leakage between vCPU-s XSA-220...

SUSE SLES11 Security Update : xorg-x11-server (SUSE-SU-2017:1741-1)

This update for xorg-x11-server fixes the following issues: Security issues : - CVE-2017-2624: Prevent timing attack against MIT cookie. bsc1025029, CVE-2017-2624 Non security issues : - Use arc4random to generate cookies. bsc1025084 - XDrawArc performance improvement bsc1019649 - Fix byte swappi...

Fedora 24 : openvpn (2017-5596f2f94d)

Updates to the latest upstream OpenVPN 2.3.17, containing security updates for CVE-2017-7508, CVE-2017-7520 and CVE-2017-7521. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1735-1) (Stack Clash)

This Linux kernel update for SUSE Linux Enterprise 12 fixes the following issues : - A previous security update to address CVE-2017-1000364 caused unintended side-effects in several other tools, most notably Java. These issues have been remedied. bsc1045340 Note that Tenable Network Security has...

Fedora 25 : 1:chromium-native_client (2017-a66e2c5b62)

Chromium 59. Add smaller logo files. Fix lots of security bugs: Security fix for CVE-2017-5070, CVE-2017-5071, CVE-2017-5072, CVE-2017-5073, CVE-2017-5074, CVE-2017-5075, CVE-2017-5086, CVE-2017-5076, CVE-2017-5077, CVE-2017-5078, CVE-2017-5079, CVE-2017-5080, CVE-2017-5081, CVE-2017-5082,...

Ubuntu 12.04 LTS : eglibc vulnerability (USN-3323-2) (Stack Clash)

USN-3323-1 fixed a vulnerability in the GNU C Library. This update provides the corresponding update for Ubuntu 12.04 ESM. It was discovered that the GNU C library did not properly handle memory when processing environment variables for setuid programs. A local attacker could use this in...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1704-1) (Stack Clash)

This Linux kernel update for SUSE Linux Enterprise 12 SP1 fixes the following issues : - A previous security update to address CVE-2017-1000364 caused unintended side-effects in several other tools, most notably Java. These issues have been remedied. bsc1045340 Note that Tenable Network Security...

SUSE SLED12 / SLES12 Security Update : poppler (SUSE-SU-2017:1672-1)

This update for poppler fixes the following issues : - CVE-2017-9406: Fixed a memory leak that occurred while parsing invalid XRef attributes bsc1042803. - CVE-2017-9083: Fixed a memory leak that occurred when the parser tried to recover from a broken input file. bsc1040170 Note that Tenable...

SUSE SLED12 / SLES12 Security Update : cairo (SUSE-SU-2017:1671-1)

This update for cairo fixes the following issues : - CVE-2017-7475: Fixed a segfault in getbitmapsurface due to malformed font bsc1036789. - CVE-2016-9082: fix a segfault when using 4GB images since int values were used for pointer operations bsc1007255. Note that Tenable Network Security has...

Virtuozzo 7 : crit / criu / criu-devel / python-criu / vzkernel / etc (VZA-2017-056)

According to the version of the crit / criu / criu-devel / python-criu / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - A flaw was found in the way memory was being allocated on the stack for user space binaries. If...

Debian DLA-999-1 : openvpn security update

It was discovered that there were multiple out-of-bounds memory read vulnerabilities in openvpn, a popular virtual private network VPN daemon. If clients used a HTTP proxy with NTLM authentication, a man-in-the-middle attacker could cause the client to crash or disclose at most 96 bytes of stack...

Fedora 25 : glibc (2017-79414fefa1) (Stack Clash)

This update addresses CVE-2017-1000366, a vulnerability in the dynamic linker allowing local privilege escalation. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and form...

Ubuntu 12.04 LTS : linux vulnerabilities (USN-3338-1)

It was discovered that the stack guard page for processes in the Linux kernel was not sufficiently large enough to prevent overlapping with the heap. An attacker could leverage this with another vulnerability to execute arbitrary code and gain administrative privileges CVE-2017-1000364 Jesse Hert...