Fedora 20 : ReviewBoard-1.7.16-2.fc20 / python-djblets-0.7.21-1.fc20 (2013-18840)

Review Board 1.6.19 and 1.7.15 fix a few issues in the API where users could access certain data they should not have been able to access, if using the Local Sites feature, invite-only groups, or private repositories. It also fixes cases with invite-only groups where the group name and list of...

Fedora 20 : roundcubemail-0.9.5-1.fc20 (2013-19699)

Roundcubemail just released new 0.9.5 version with fixes for VCE2013-6172will be available soon. Hotfix: https://github.com/roundcube/roundcubemail/commit/4109bb26ce.diff Full announcement : Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

Ubuntu 12.04 LTS : linux vulnerabilities (USN-2017-1)

A denial of service flaw was discovered in the Btrfs file system in the Linux kernel. A local user could cause a denial of service by creating a large number of files with names that have the same CRC32 hash value. CVE-2012-5374 A denial of service flaw was discovered in the Btrfs file system in...

Fedora 19 : wireshark-1.10.3-2.fc19 (2013-20829)

Harden dumpcap capabilities - Ver. 1.10.3 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVE...

Fedora 19 : bugzilla-4.2.7-1.fc19 (2013-19480)

The following security issues have been discovered in Bugzilla 4.2.6 : - A CSRF vulnerability in attachment.cgi can lead to an attachment being edited without the user consent. - Several unfiltered parameters when editing flagtypes can lead to XSS. - Due to an incomplete fix for CVE-2012-4189, so...

Fedora 19 : libuv-0.10.18-1.fc19 / nodejs-0.10.21-1.fc19 (2013-19497)

This release contains a security fix for the http server implementation, please upgrade as soon as possible. For more information, see . 2013.10.18, node.js Version 0.10.21 Stable - crypto: clear errors from verify failure Timothy J Fontaine - dtrace: interpret two byte strings Dave Pacheco - fs:...

Fedora 18 : xen-4.2.3-4.fc18 (2013-19053)

Five security fixes CVE-2013-4368 CVE-2013-4369 CVE-2013-4370 CVE-2013-4371 CVE-2013-4375 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...

Ubuntu 12.04 LTS / 12.10 / 13.04 : icu vulnerabilities (USN-1989-1)

It was discovered that ICU contained a race condition affecting multi- threaded applications. If an application using ICU processed crafted data, an attacker could cause it to crash or potentially execute arbitrary code with the privileges of the user invoking the program. This issue only affecte...

Fedora 20 : elinks-0.12-0.36.pre6.fc20 (2013-18323)

verify server certificate hostname with nsscompatossl 881411 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Fedora 18 : zabbix-2.0.8-3.fc18 (2013-18348)

New upstream version 2.0.8 - Patch for CVE-2013-5743 SQL injection vulnerability, ZBX-7091 - Patch for ZBX-6922 Failing host XML import - SQL speed-up patch for graphs ZBX-6804 - Require php-ldap and ZBX-6992 Service SQL - Create and configure a spooling directory for fping files outside of /tmp...

Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : gnupg, gnupg2 vulnerabilities (USN-1987-1)

Daniel Kahn Gillmor discovered that GnuPG treated keys with empty usage flags as being valid for all usages. CVE-2013-4351 Taylor R Campbell discovered that GnuPG incorrectly handled certain OpenPGP messages. If a user or automated system were tricked into processing a specially crafted message,...

Fedora 18 : kernel-3.10.14-100.fc18 (2013-18364)

The 3.10.14 stable update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

MS13-087: Vulnerability in Silverlight Could Allow Information Disclosure (2890788) (Mac OS X)

The version of Microsoft Silverlight installed on the remote host is reportedly affected by an information disclosure vulnerability due to its failure to properly handle certain objects in memory. If an attacker could trick a user on the affected system into visiting a website hosting a malicious...

Fedora 20 : wireshark-1.10.2-7.fc20 (2013-17627)

dumpcap now stores temporary capture files in /var/tmp - Convert automake/pkgconfig files into patches better upstream integration - Restored category in the .desktop file - Install another one necessary header file - framedatasequence.h - Add basic OpenFlow dissector - Ver. 1.10.2 - Ver. 1.10.1...

Ubuntu 12.04 LTS / 12.10 : python3.2 vulnerabilities (USN-1984-1)

Florian Weimer discovered that Python incorrectly handled matching multiple wildcards in ssl certificate hostnames. An attacker could exploit this to cause Python to consume resources, resulting in a denial of service. CVE-2013-2099 Ryan Sleevi discovered that Python did not properly handle...

Ubuntu 12.04 LTS : libkdcraw vulnerabilities (USN-1978-1)

It was discovered that libKDcraw incorrectly handled photo files. If a user or automated system were tricked into processing a specially crafted photo file, applications linked against libKDcraw could be made to crash, resulting in a denial of service. CVE-2013-1438, CVE-2013-1439. Note that...

Ubuntu 12.04 LTS / 12.10 / 13.04 : txt2man vulnerability (USN-1979-1)

Patrick J Cherry discovered that txt2man contained leftover debugging code that incorrectly created a temporary file. A local attacker could possibly use this issue to overwrite arbitrary files. In the default Ubuntu installation, this should be prevented by the Yama link restrictions. Note that...

SecurityCenter devform.php message Parameter XSS

The version of Tenable Network Security SecurityCenter installed on the remote host contains the 'devform.php' script. This PHP script is affected by a cross-site scripting vulnerability because the application does not properly validate user-supplied input to the 'message' parameter. An attacker...

Fedora 18 : filezilla-3.7.3-1.fc18 (2013-14794)

Merge further fixes from PuTTY to address CVE-2013-4206, CVE-2013-4207, CVE-2013-4208 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora 19 : zabbix-2.0.6-3.fc19 (2013-14029)

This update solves a security issue involving the use of libcurl in the code used to access the eztexting service. It potentially allows for man-in-the-middle attacks. The issue was described as CVE-2012-6086. Please refer to https://support.zabbix.com/browse/ZBX-5924 for details! Note that Tenab...