SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2015:2182-1) (FREAK)

The java-171-ibm package was updated to version 7.1-3.20 to fix several security and non security issues : - bnc955131: Version update to 7.1-3.20: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844...

Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2826-1)

It was discovered that the SCTP protocol implementation in the Linux kernel performed an incorrect sequence of protocol-initialization steps. A local attacker could use this to cause a denial of service system crash. CVE-2015-5283 Dmitry Vyukov discovered that the Linux kernel's keyring handler...

SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2015:2168-1) (FREAK)

The java-171-ibm package was updated to versioin 7.1-3.20 to fix several security and non security issues : - bnc955131: Version update to 7.1-3.20: CVE-2015-4734 CVE-2015-4803 CVE-2015-4805 CVE-2015-4806 CVE-2015-4810 CVE-2015-4835 CVE-2015-4840 CVE-2015-4842 CVE-2015-4843 CVE-2015-4844...

Debian DLA-357-1 : libphp-snoopy security update

It was discovered that missing input sanitizing in Snoopy, a PHP class that simulates a web browser may result in the execution of arbitrary commands. For the oldoldstable distribution squeeze-lts, this problem has been fixed in version 2.0.0-1deb6u1. We recommend that you upgrade your...

Debian DLA-352-1 : libcommons-collections3-java security update

The Apache commons collection suffered from security issues, making applications to accept serialized objects from untrusted sources. Remote attackers might take advantage of these issues to execute arbitrary Java functions and even inject manipulated bytecode. This release of...

SUSE SLED11 / SLES11 Security Update : kernel (SUSE-SU-2015:2108-1)

The SUSE Linux Enterprise 11 Service Pack 3 kernel was updated to receive various security and bugfixes. Following security bugs were fixed : - CVE-2015-8104: Prevent guest to host DoS caused by infinite loop in microcode via DB exception bsc954404. - CVE-2015-5307: Prevent guest to host DoS caus...

Debian DLA-350-1 : eglibc security update

The strxfrm function is vulnerable to integer overflows when computing memory allocation sizes similar to CVE-2012-4412. Furthermore since it fallbacks to use alloca when malloc fails, it is vulnerable to stack-based buffer overflows similar to CVE-2012-4424. Those issues have been fixed in Debia...

Debian DLA-346-1 : openjdk-6 security update

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform. These vulnerabilities relate to execution of arbitrary code, breakouts of the Java sandbox, information disclosure and denial of service. For Debian 6 'Squeeze', these problems have been fixed ...

SUSE SLED12 / SLES12 Security Update : dracut (SUSE-SU-2015:2065-1)

The dracut package was updated to fix the following security and non-security issues : - CVE-2015-0794: Use mktemp instead of hard-coded filenames, possible vulnerability bsc935338. - Always install mdraid modules bsc935993. - Add notice when dracut failed to install modules bsc952491. - Always...

SUSE SLED11 / SLES11 Security Update : ntp (SUSE-SU-2015:2058-1)

This ntp update provides the following security and non security fixes : - Update to 4.2.8p4 to fix several security issues bsc951608 : - CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK - CVE-2015-7855: decodenetnum will ASSERT botch instead of returni...

SUSE SLED11 / SLES11 Security Update : xscreensaver (SUSE-SU-2015:2054-1)

The xscreensaver package was updated to fix the following security and non security issues : - CVE-2015-8025: Fixed a crash when hot-swapping monitors while locked bsc952062. - Added xscreensaver-insignalhandlerp.patch needed for fix of signal handling. - Refresh xscreensaver-stars.patch. Note th...

Debian DLA-344-1 : nspr security update

Google security engineer Ryan Sleevi found a vulnerability in the NetScape Portable Runtime Library NSPR. NSPR allocated memory without specific checks, making it possible for remote attackers to cause a Denial of Service or execute arbitrary code. For Debian 6 'Squeeze', this issue have been fix...

Ubuntu 15.04 / 15.10 : lxcfs vulnerabilities (USN-2813-1)

It was discovered that LXCFS incorrectly enforced directory escapes. A local attacker could use this issue to possibly escalate privileges. CVE-2015-1342 It was discovered that LXCFS incorrectly checked certain permissions. A local attacker could use this issue t possibly escalate privileges...

SUSE SLED12 / SLES12 Security Update : libsndfile (SUSE-SU-2015:2000-1)

The libsndfile package was updated to fix the following security issue : - CVE-2014-9756: Fixed a divide by zero problem that can lead to a Denial of Service DoS bsc953521. - CVE-2015-7805: Fixed heap overflow issue bsc953516. - CVE-2015-8075: Fixed heap overflow issue bsc953519. Note that Tenabl...

SUSE SLES11 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2015:1978-1)

This Mozilla Firefox, NSS and NSPR update fixes the following security and non security issues. - mozilla-nspr was updated to version 4.10.10 bsc952810 - MFSA 2015-133/CVE-2015-7183 bmo1205157 NSPR memory corruption issues - mozilla-nss was updated to 3.19.2.1 bsc952810 - MFSA...

Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2795-1)

It was discovered that in certain situations, a directory could be renamed outside of a bind mounted location. An attacker could use this to escape bind mount containment and gain access to sensitive information. CVE-2015-2925 Moein Ghasemzadeh discovered that the USB WhiteHEAT serial driver...

SUSE SLED12 / SLES12 Security Update : krb5 (SUSE-SU-2015:1897-1)

krb5 was updated to fix three security issues. These security issues were fixed : - CVE-2015-2695: Applications which call gssinquirecontext on a partially-established SPNEGO context could have caused the GSS-API library to read from a pointer using the wrong type, generally causing a process...

SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2015:1908-1)

xen was updated to version 4.4.3 to fix nine security issues. These security issues were fixed : - CVE-2015-4037: The slirpsmb function in net/slirp.c created temporary files with predictable names, which allowed local users to cause a denial of service instantiation failure by creating...

SUSE SLED12 / SLES12 Security Update : libvdpau (SUSE-SU-2015:1892-1)

libvdpau was updated to use securegetenv instead of getenv for several variables so it can be more safely used in setuid applications. - CVE-2015-5198: libvdpau: incorrect check for security transition bnc943967 - CVE-2015-5199: libvdpau: directory traversal in dlopen bnc943968 - CVE-2015-5200:...

SUSE SLED12 / SLES12 Security Update : Recommended update for LibreOffice (SUSE-SU-2015:1915-1)

This update brings LibreOffice to version 5.0.2, a major version update. It brings lots of new features, bugfixes and also security fixes. Features as seen on http://www.libreoffice.org/discover/new-features/ - LibreOffice 5.0 ships an impressive number of new features for its spreadsheet module,...