SUSE SLED12 Security Update : puppet (SUSE-SU-2018:0571-1)

This update for puppet fixes the following issues : - CVE-2017-10689: Reset permissions when unpacking tar in PMT. When using minitar, files were unpacked with whatever permissions are in the tarball. This is potentially unsafe, as tarballs can be easily created with weird permissions bsc1080288...

Debian DLA-1297-1 : freexl security update

Leon reported five heap-based buffer-overflow vulnerabilities in FreeXL. CVE-2018-7435 There is a heap-based buffer over-read in the freexl::destroycell function. CVE-2018-7436 There is a heap-based buffer over-read in a pointer dereference of the parseSST function. CVE-2018-7437 There is a...

Oracle Linux 7 : ruby (ELSA-2018-0378)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-0378 advisory. - Add Psych.safeload ruby-2.1.0-there-should-be-only-one-exception.patch ruby-2.1.0-Adding-Psych.safeload.patch Related: CVE-2017-0903 - Disable Tokyo ...

Ubuntu 14.04 LTS / 16.04 LTS : sensible-utils vulnerability (USN-3584-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3584-1 advisory. Gabriel Corona discovered that sensible-utils incorrectly validated strings when launcher a browser with the sensible-browser tool. A remote attacker...

Oracle Linux 6 / 7 : java-1.7.0-openjdk (ELSA-2018-0349)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-0349 advisory. 1:1.7.0.171-2.6.13.0.0.1 - Update DISTRONAME in specfile 1:1.7.0.171-2.6.13.0 - Bump to 2.6.13 and u171b01. - Update...

Fedora 27 : suricata (2018-ee417c4b28)

fixes bz1543250 and bz1543251 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 ...

Fedora 27 : kernel (2018-7a62047e30)

The 4.15.4 update contains a number of important fixes across the tree Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducin...

Fedora 27 : qt5-qtwebengine (2018-e08d828ed9)

This update updates QtWebEngine to the 5.10.1 bugfix and security release. QtWebEngine 5.10.1 is part of the Qt 5.10.1 release, but only the QtWebEngine component is included in this update. This update includes : - Security fixes from Chromium up to version 64.0.3282.140. Including:...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0525-1) (Spectre)

The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information...

Ubuntu 17.10 : wavpack vulnerabilities (USN-3578-1)

It was discovered that WavPack incorrectly handled certain DSDIFF files. An attacker could possibly use this to execute arbitrary code or cause a denial of service. CVE-2018-7253 It was discovered that WavPack incorrectly handled certain CAF files. An attacker could possibly use this to cause a...

SUSE SLED12 / SLES12 Security Update : postgresql96 (SUSE-SU-2018:0507-1)

This update for postgresql96 to version 9.6.7 fixes the following issues : - CVE-2018-1053: Ensure that all temporary files made by pgupgrade are non-world-readable. bsc1077983 A full changelog is available here: https://www.postgresql.org/docs/9.6/static/release-9 -6-7.html Note that Tenable...

SUSE SLED12 Security Update : drm (SUSE-SU-2018:0509-1)

This update for drm provides the following fixes: This security issue was fixed : - CVE-2017-10810: Memory leak in the virtiogpuobjectcreate function in drivers/gpu/drm/virtio/virtgpuobject.c allowed attackers to cause a denial of service memory consumption by triggering object-initialization...

Tenable University: Nessus Certificate of Proficiency

Yesterday I finished "Nessus Certificate of Proficiency" learning plan at Tenable University and passed the final test. Here I would like to share my impressions. First of all, few words about my motivation. I use Nessus literally every day at work. So, it was fun to check my knowledge. I already...

SUSE SLES11 Security Update : quagga (SUSE-SU-2018:0457-1)

This update for quagga fixes the following issues : - The Quagga BGP daemon contained a bug in the ASPATH size calculation that could have been exploited to facilitate a remote denial-of-service attack via specially crafted BGP UPDATE messages. CVE-2017-16227, bsc1065641 - The Quagga BGP daemon d...

Dell EMC Patches Critical Flaws in VMAX Enterprise Storage Systems

Dell EMC fixed two critical flaws in its management interfaces for its VMAX enterprise storage systems. One of the vulnerabilities could allow a remote attacker to use a hard-coded password to a default account to gain unauthorized access to systems. The company issued updates that address the tw...

Debian DLA-1281-1 : advancecomp security update

Joonun Jang discovered that the advzip tool in advancecomp, a collection of recompression utilities, was prone to a heap-based buffer overflow. This might allow an attacker to cause a denial of service application crash or other unspecified impact via a crafted file. For Debian 7 'Wheezy', these...

Ubuntu 14.04 LTS / 16.04 LTS : Exim vulnerability (USN-3565-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3565-1 advisory. Meh Chang discovered that Exim incorrectly handled memory in certain decoding operations. A remote attacker could use this issue to cause Exim to cras...

Fedora 26 : kernel (2018-57e732b89f)

The 4.14.18 stable update contains a number of important fixes across the tree, including some additional spectre mitigation. ---- The 4.14.17 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description bloc...

Ubuntu 14.04 LTS / 16.04 LTS : PostgreSQL vulnerability (USN-3564-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3564-1 advisory. It was discovered that PostgreSQL incorrectly handled certain temp files. An attacker could possibly use this to access sensitive information. Tenable...

SUSE SLED12 / SLES12 Security Update : ghostscript (SUSE-SU-2018:0407-1)

This update for ghostscript fixes several issues. These security issues were fixed : - CVE-2017-9835: The gsallocrefarray function allowed remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact via a crafted...