Fedora 23 : phpMyAdmin (2016-7fc142da66)

phpMyAdmin 4.6.5.1 2016-11-26 =============================== A patch-level release fixing two small issues : - an issue affecting a small number of users using $cfg'Servers'$i'hidedb' or $cfg'Servers'$i'onlydb'. - an issue affecting the create table dialog where the partition selection tool was...

Ubuntu 12.04 LTS : openjdk-6 vulnerabilities (USN-3154-1)

It was discovered that OpenJDK did not restrict the set of algorithms used for Jar integrity verification. An attacker could use this to modify without detection the content of a JAR file, affecting system integrity. CVE-2016-5542 It was discovered that the JMX component of OpenJDK did not...

Fedora 25 : xen (2016-999e1a6927)

xen : various security flaws 1397383 x86 null segments not always treated as unusable XSA-191, CVE-2016-9386 x86 task switch to VM86 mode mis-handled XSA-192, CVE-2016-9382 x86 segment base write emulation lacking canonical address checks XSA-193, CVE-2016-9385 guest 32-bit ELF symbol table load...

Debian DLA-733-1 : openafs security update

It was discovered that there was an information leak vulnerability in openafs, a distributed filesystem. Due to incomplete initialization or clearing of reused memory, OpenAFS directory objects are likely to contain 'dead' directory entry information. For Debian 7 'Wheezy', this issue has been...

Fedora 23 : xen (2016-68b71978a1)

xen : various security flaws 1397383 x86 null segments not always treated as unusable XSA-191, CVE-2016-9386 x86 task switch to VM86 mode mis-handled XSA-192, CVE-2016-9382 x86 segment base write emulation lacking canonical address checks XSA-193, CVE-2016-9385 x86 64-bit bit test instruction...

Mozilla Thunderbird < 45.5.1 nsSMILTimeContainer.cpp SVG Animation RCE (macOS)

The version of Mozilla Thunderbird installed on the remote macOS or Mac OS X host is prior to 45.5.1. It is, therefore, affected by a use-after-free error in dom/smil/nsSMILTimeContainer.cpp when handling SVG animations. An unauthenticated, remote attacker can exploit this issue, via a specially...

Debian DLA-731-2 : imagemagick regression update

The update for imagemagick issued as DLA-731-1 caused regressions when decoding properties of certain images. Updated packages are now available to address this problem. For reference, the original advisory text follows. Several issues have been discovered in ImageMagick, a popular set of program...

SUSE SLES11 Security Update : vim (SUSE-SU-2016:2938-1)

This update for vim fixes the following security issues : - Fixed CVE-2016-1248, an arbitrary command execution vulnerability bsc1010685 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automaticall...

Debian DLA-724-1 : mcabber security update

It was discovered that there was a 'roster push attack' 0 in mcabber, a console-based Jabber XMPP client. For Debian 7 'Wheezy', this issue has been fixed in mcabber version 0.10.1-3+deb7u1. We recommend that you upgrade your mcabber packages. 0...

Debian DLA-722-1 : irssi security update

An information disclosure vulnerability was found in irssi. CVE-2016-7553 Other users on the same machine as the user running irssi with buf.pl loaded may be able to retrieve the whole window contents after /UPGRADE. Furthermore, this dump of the windows contents is never removed afterwards. For...

SUSE SLED12 / SLES12 Security Update : sudo (SUSE-SU-2016:2893-1)

This update for sudo fixes the following issues : - fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality : - noexec bypass via system and popen CVE-2016-7032, bsc1007766 - noexec bypass via wordexp CVE-2016-7076, bsc1007501 Note that Tenable Network Security h...

SUSE SLED12 / SLES12 Security Update : tar (SUSE-SU-2016:2896-1)

This update for tar fixes the following issues : - Fix the POINTYFEATHER vulnerability - GNU tar archiver can be tricked into extracting files and directories in the given destination, regardless of the path names specified on the command line bsc1007188 CVE-2016-6321 - Fix Amanda integration iss...

Fedora 24 : perl-DBD-MySQL (2016-54fd3bf412)

Security fix for CVE-2016-1249 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

SUSE SLED12 / SLES12 Security Update : bash (SUSE-SU-2016:2872-1) (Shellshock)

This update for bash fixes the following issues : - CVE-2016-7543: Local attackers could have executed arbitrary commands via specially crafted SHELLOPTS+PS4 variables bsc1001299 - CVE-2016-0634: Malicious hostnames could have allowed arbitrary command execution when $HOSTNAME was expanded in the...

Debian DLA-717-1 : moin security update

Several cross-site scripting vulnerabilities were discovered in moin, a Python clone of WikiWiki. A remote attacker can conduct cross-site scripting attacks via the GUI editor's attachment dialogue CVE-2016-7146 and the GUI editor's link dialogue CVE-2016-9119. For Debian 7 'Wheezy', these proble...

Debian DLA-708-1 : mysql-5.5 security update

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.53, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly incompatible changes. Please see th...

Fedora 25 : phpMyAdmin (2016-49e1e93a66)

phpMyAdmin 4.6.4 2016-08-16 ============================= This release includes many security fixes of various levels of severity. Upstream recommends all users upgrade to this release immediately. For full information on the vulnerabilities fixed and mitigation factors for users who are unable t...

Fedora 25 : ca-certificates (2016-541495b486)

This is an update to the Mozilla CA certificates list version 2.10, which has been published as part of Mozilla NSS 3.27. For additional details, please refer to the NSS 3.27 release notes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS3.27 releasenotes Note: This package versi...

Fedora 25 : ca-certificates (2016-d1408c3ba3)

This is an update to the Mozilla CA certificates list version 2.9, which has been published as part of Mozilla NSS 3.26. This update reverts the CA list to the unmodified upstream CA list. The legacy CA modifications, which had previously been shipped with Fedora, have been reverted to an empty...

Fedora 25 : php-pecl-zip (2016-ea58a428a1)

Version 1.13.5 - Fixed bug php72660 NULL pointer dereference in zendvirtualcwd. Laruence - Fixed bug php68302 impossible to compile php with zip support. cmb - Fixed bug php70752 Depacking with wrong password leaves 0 length files. cmb Note that Tenable Network Security has extracted the precedin...