SUSE SLED15 / SLES15 Security Update : mercurial (SUSE-SU-2018:1998-1)

This update for mercurial fixes the following issues: Security issues fixed : - CVE-2018-13346: Fix mpatchapply function in mpatch.c that incorrectly proceeds in cases where the fragment start is past the end of the original data bsc1100354. - CVE-2018-13347: Fix mpatch.c that mishandles integer...

SUSE SLED15 / SLES15 Security Update : libcdio (SUSE-SU-2018:2236-1)

This update for libcdio fixes the following issues: The following security vulnerabilities were addressed : - CVE-2017-18199: Fixed a NULL pointer dereference in reallocsymlink in rock.c bsc1082821 - CVE-2017-18201: Fixed a double free vulnerability in getcdtextgeneric in cdiogeneric.c bsc1082877...

SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2018:3753-1)

This update for ImageMagick fixes the following issues : Security issues fixed : CVE-2018-18024: Fixed an infinite loop in the ReadBMPImage function. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. bsc1111069 CVE-2018-18016: Fixed a memory...

SUSE SLED15 / SLES15 Security Update : Initial update for kernel-azure (SUSE-SU-2018:1952-1)

This update is the initial delivery of the Azure flavor of the Linux Kernel, which contains enhancements and optimizations for running the SUSE Linux Enterprise kernel in the Azure cloud. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

SUSE SLES12 Security Update : php5 (SUSE-SU-2016:1277-1)

This update for php5 fixes the following security issues : - CVE-2016-4073: A remote attacker could have caused denial of service, or possibly execute arbitrary code, due to incorrect handling of string length calculations in mbstrcut bsc977003 - CVE-2015-8867: The PHP function...

SUSE SLED15 / SLES15 Security Update : openssh (SUSE-SU-2018:3686-1)

This update for openssh fixes the following issues : CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration o...

SUSE SLED15 / SLES15 Security Update : mutt (SUSE-SU-2018:2085-1)

This update for mutt fixes the following issues: Security issues fixed : - bsc1101428: Mutt 1.10.1 security release update. - CVE-2018-14351: Fix imap/command.c that mishandles long IMAP status mailbox literal count size bsc1101583. - CVE-2018-14353: Fix imapquotestring in imap/util.c that has an...

SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2018:2539-1)

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-15572: The spectrev2selectmitigation function in arch/x86/kernel/cpu/bugs.c did not always fill RSB upon a context switch, which made it easier for attacke...

SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2018:3927-1)

This update for qemu fixes the following issues : Security issues fixed : CVE-2018-10839: Fixed NE2000 NIC emulation support that is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use...

SUSE SLED15 / SLES15 Security Update : accountsservice (SUSE-SU-2018:3625-1)

This update for accountsservice fixes the following issues : This security issue was fixed : CVE-2018-14036: Prevent directory traversal caused by an insufficient path check in userchangeiconfileauthorizedcb bsc1099699 Thsese non-security issues were fixed: Don't abort loading users when an...

SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2018:2298-1)

This update for MozillaFirefox to the 52.9 ESR release fixes the following issues: These security issues were fixed : - Firefox ESR 52.9 : - CVE-2018-5188 Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 bsc1098998. - CVE-2018-12368 No warning when opening executable...

SUSE SLED15 / SLES15 Security Update : pam (SUSE-SU-2018:3965-1)

This update for pam fixes the following issue : Security issue fixed : CVE-2018-17953: Fixed IP address and subnet handling of pamaccess.so that was not honoured correctly when a single host was specified bsc1115640. Note that Tenable Network Security has extracted the preceding description block...

SUSE SLED15 / SLES15 Security Update : systemd (SUSE-SU-2018:3644-1)

This update for systemd fixes the following issues : Security issues fixed : CVE-2018-15688: A buffer overflow vulnerability in the dhcp6 client of systemd allowed a malicious dhcp6 server to overwrite heap memory in systemd-networkd. bsc1113632 CVE-2018-15686: A vulnerability in unitdeserialize ...

Tenable Nessus < 8.1.1 Multiple Vulnerabilities (TNS-2018-16)

According to its self-reported version, the Tenable Nessus application running on the remote host is 8.x prior to 8.1.1. It is, therefore, affected by multiple vulnerabilities: - Tenable Nessus contains a flaw in the bundled third-party component OpenSSL library's DSA signature algorithm that...

SUSE SLES12 Security Update : Recommended update for php5 (SUSE-SU-2018:3995-1)

This update for php5 fixes the following issues : Security issue fixed : CVE-2018-19518: Fixed imapopen script injection flaw bsc1117107. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatical...

SUSE SLED15 / SLES15 Security Update : postgresql10 (SUSE-SU-2018:3942-1)

This update for postgresql10 fixes the following issues : Security issue fixed : CVE-2018-16850: Fixed improper quoting of transition table names when pgdump emits CREATE TRIGGER could have caused privilege escalation bsc1114837. Non-security issues fixed: Update to release 10.6 : -...

SUSE SLES12 Security Update : php5 (SUSE-SU-2017:0038-1)

This update for php5 fixes the following issues : - CVE-2016-9933 Possible stack overflow on truecolor images handling bsc1015187 - CVE-2016-9934 Dereference from NULL pointer could lead to crash bsc1015188 - CVE-2016-9935 Invalid read could lead to crash bsc1015189 Note that Tenable Network...

SUSE SLED15 / SLES15 Security Update : ucode-intel (SUSE-SU-2018:1926-1) (Spectre)

This update for ucode-intel fixes the following issues: The microcode bundles was updated to the 20180703 release For the listed CPU chipsets this fixes CVE-2018-3640 Spectre v3a and helps mitigating CVE-2018-3639 Spectre v4 bsc1100147 bsc1087082 bsc1087083. More information on:...

EulerOS 2.0 SP3 : openssl110f (EulerOS-SA-2018-1434)

According to the version of the openssl110f packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A microprocessor side-channel vulnerability was found on SMT e.g, Hyper-Threading architectures. An attacker running a malicious process on th...

Debian DLA-1617-1 : libvncserver security update

Kaspersky Lab discovered several vulnerabilities in libvncserver, a C library to implement VNC server/client functionalities. CVE-2018-6307 a heap use-after-free vulnerability in the server code of the file transfer extension, which can result in remote code execution. This attack appears to be...