Debian DLA-634-1 : dropbear security update

It was discovered that there were two issues in dropbear, a lightweight SSH2 server and client : - CVE-2016-7406: Potential issues in exit message formatting. - CVE-2016-7407: Overflows when parsing OpenSSH's ASN.1 key format. For Debian 7 'Wheezy', this issue has been fixed in dropbear version...

Fedora 23 : xen (2016-1c3374bcb9)

x86: Disallow L3 recursive pagetable for 32-bit PV guests XSA-185, CVE-2016-7092 1374470 x86: Mishandling of instruction pointer truncation during emulation XSA-186, CVE-2016-7093 1374471 x86 HVM: Overflow of shctxt-segreg XSA-187, CVE-2016-7094 1374473 Note that Tenable Network Security has...

Fedora 23 : wordpress (2016-91bfe9ddb8)

See upstream announcements : - WordPress 4.6 Pepper - WordPress 4.6.1 Security and Maintenance Release Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as muc...

Debian DLA-631-1 : unadf security update

It was discovered that there were two vulnerabilities in unadf, a tool to extract files from an Amiga Disk File dump .adf : - CVE-2016-1243: stack-based buffer overflow caused by blindly trusting on pathname lengths of archived files. Stack allocated buffer sysbuf was filled with sprintf without...

Ubuntu 12.04 LTS : linux vulnerability (USN-3082-1)

Chiachih Wu, Yuan-Tsung Lo, and Xuxian Jiang discovered that the legacy ABI for ARM OABI had incomplete access checks for epollwait2 and semtimedop2. A local attacker could use this to possibly execute arbitrary code. Note that Tenable Network Security has extracted the preceding description bloc...

Fedora 24 : xen (2016-7d2c67d1f5)

x86: Disallow L3 recursive pagetable for 32-bit PV guests XSA-185, CVE-2016-7092 1374470 x86: Mishandling of instruction pointer truncation during emulation XSA-186, CVE-2016-7093 1374471 x86 HVM: Overflow of shctxt-segreg XSA-187, CVE-2016-7094 1374473 Note that Tenable Network Security has...

SUSE SLED12 / SLES12 Security Update : wpa_supplicant (SUSE-SU-2016:2305-1)

This update for wpasupplicant fixes the following issues : - CVE-2015-4141: WPS UPnP vulnerability with HTTP chunked transfer encoding. bnc930077 - CVE-2015-4142: Integer underflow in AP mode WMM Action frame processing. bnc930078 - CVE-2015-4143: EAP-pwd missing payload length validation...

SUSE SLES11 Security Update : libidn (SUSE-SU-2016:2291-1)

This update for libidn fixes the following issues : - CVE-2016-6262 and CVE-2015-8948: Out-of-bounds-read when reading one zero byte as input bsc990189 - CVE-2016-6261: Out-of-bounds stack read in idnatoascii4i bsc990190 - CVE-2016-6263: stringpreputf8nfkcnormalize reject invalid UTF-8 bsc990191 ...

Ubuntu 12.04 LTS : openjdk-6 vulnerabilities (USN-3077-1)

A vulnerability was discovered in the OpenJDK JRE related to data integrity. An attacker could exploit this to expose sensitive data over the network or possibly execute arbitrary code. CVE-2016-3458 Multiple vulnerabilities were discovered in the OpenJDK JRE related to availability. An attacker...

Fedora 23 : phpMyAdmin (2016-06e4de8210)

phpMyAdmin 4.6.4 2016-08-16 ============================= This release includes many security fixes of various levels of severity. Upstream recommends all users upgrade to this release immediately. For full information on the vulnerabilities fixed and mitigation factors for users who are unable t...

SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2016:2280-1)

This update for openssh fixes the following issues : - Prevent user enumeration through the timing of password processing bsc989363, CVE-2016-6210 -preventtiminguserenumeration - Allow lowering the DH groups parameter limit in server as well as when GSSAPI key exchange is used bsc948902 - limit...

MS16-105: Cumulative Security Update for Microsoft Edge (3183043)

The version of Microsoft Edge installed on the remote Windows host is missing Cumulative Security Update 3183043. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these...

Debian DLA-619-1 : qemu-kvm security update

qemu-kvm built with the VirtFS, host directory sharing via Plan 9 File System 9pfs support, is vulnerable to a directory/path traversal issue. It could occur while creating or accessing files on a shared host directory. A privileged user inside guest could use this flaw to access undue files on t...

Debian DLA-616-1 : curl security update

It was discovered that libcurl built on top of NSS Network Security Services incorrectly re-used client certificates if a certificate from file was used for one TLS connection but no certificate set for a subsequent TLS connection. For Debian 7 'Wheezy', this problem has been fixed in version...

Debian DLA-613-1 : roundcube security update

Multiple CSRF and XSS issues allow remote attackers to hijack the authentication and execute roundcube operations without the consent of the user. In some cases, this could result in data loss or data theft. CVE-2014-9587 Multiple cross-site request forgery CSRF vulnerabilities in allow remote...

Fedora 24 : mediawiki (2016-af3b0af887)

https://www.mediawiki.org/wiki/Releasenotes/1.26MediaWiki1.26.4 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

SUSE SLES12 Security Update : mariadb (SUSE-SU-2016:2248-1)

This update for mariadb fixes the following issues : - CVE-2016-3477: Unspecified vulnerability in subcomponent parser bsc991616 - CVE-2016-3521: Unspecified vulnerability in subcomponent types bsc991616 - CVE-2016-3615: Unspecified vulnerability in subcomponent dml bsc991616 - CVE-2016-5440:...

SUSE SLED12 / SLES12 Security Update : wget (SUSE-SU-2016:2226-1)

This update for wget fixes the following issues : - Fix for HTTP to a FTP redirection file name confusion vulnerability bsc984060, CVE-2016-4971. - Work around a libidn vulnerability bsc937096, CVE-2015-2059. - Fix for wget fails with basicauth: Failed writing HTTP request: Bad file descriptor...

SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:2218-1)

This update for mariadb fixes the following issues : - CVE-2016-3477: Unspecified vulnerability in subcomponent parser bsc991616 - CVE-2016-3521: Unspecified vulnerability in subcomponent types bsc991616 - CVE-2016-3615: Unspecified vulnerability in subcomponent dml bsc991616 - CVE-2016-5440:...

Fedora 23 : libgcrypt (2016-2b4ecfa79f)

Important update from upstream which fixes predictability problem in the RNG CVE-2016-6313. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possib...