Ubuntu 14.04 LTS / 16.04 LTS : ImageMagick regression (USN-3363-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3363-2 advisory. USN-3363-1 fixed vulnerabilities in ImageMagick. The update caused a regression for certain users when processing images. The problematic patch has be...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2017-3597)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3597 advisory. - HID: hid-cypress: validate length of report Greg Kroah-Hartman Orabug: 25891914 CVE-2017-7273 - udf: Remove repeated loads blocksize Jan Kara...

Debian DLA-1046-1 : lucene-solr security update

lucene-solr handler supports an HTTP API /replication?command=filecontent&file= which is vulnerable to path traversal attack. Specifically, this API does not perform any validation of the user specified filename parameter. This can allow an attacker to download any file readable to Solr server...

SUSE SLED12 / SLES12 Security Update : poppler (SUSE-SU-2017:1998-1)

This update for poppler fixes the following issues: Security issues fixed : - CVE-2017-9775: Fix a stack overflow bug in pdftocairo that could have been exploited in a denial of service attack through a specially crafted PDF document. bsc1045719 - CVE-2017-9776: Fix an integer overflow bug that...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3596)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3596 advisory. kernel-uek 3.8.13-118.19.3 - posixacl: Clear SGID bit when setting file permissions Jan Kara Orabug: 25507344 CVE-2016-7097 CVE-2016-7097 Tenable has...

Juniper Junos CLI Local Privilege Escalation (JSA10803)

According to its self-reported version number, the remote Juniper Junos device is affected by an unspecified buffer overflow condition in the CLI component that allows a local attacker who has read-only privileges to execute arbitrary code with root privileges. C Tenable Network Security, Inc...

Oracle Linux 7 : tomcat (ELSA-2017-1809)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-1809 advisory. - Resolves: rhbz1441487 CVE-2017-5648 tomcat: Calls to application listeners did not use the appropriate facade object - Resolves: rhbz1441480...

Qualys new look and new products

As you all know, it's Black Hat 2017 time. This year Qualys seems to be the main newsmaker among Vulnerability Management vendors. Qualys Team renewed logo and website, updated marketing strategy, presented two new products: CloudView and CertView. I decided to take a look. Talking about design, ...

Fedora 24 : 1:nodejs (2017-aa44293a53)

Security update Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Ubuntu 14.04 LTS / 16.04 LTS : libiberty vulnerabilities (USN-3368-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3368-1 advisory. It was discovered that libiberty incorrectly handled certain string operations. If a user or automated system were tricked into processing a...

Fedora 24 : webkitgtk4 (2017-37f68e3534)

This update addresses the following vulnerabilities : - CVE-2017-2538 Additional fixes : - Fix web process deadlock when seeking youtube videos. - Fix blob downloads. - Improve theme rendering performance when using GTK+ = 3.20. - Fix positioning of popup menus in Wayland. - Fix JavaScriptCore...

Ubuntu 14.04 LTS / 16.04 LTS : gdb vulnerabilities (USN-3367-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3367-1 advisory. Hanno Bck discovered that gdb incorrectly handled certain malformed AOUT headers in PE executables. If a user or automated system were tricke...

SUSE SLES12 Security Update : apache2 (SUSE-SU-2017:1961-1)

This update for apache2 fixes the following issues: Security issue fixed : - CVE-2017-9788: Uninitialized memory reflection in modauthdigest. bsc1048576 Bug fixes : - Include individual sysconfig.d files instead of the whole sysconfig.d directory. - Include sysconfig.d/include.conf after httpd.co...

Debian DLA-1039-1 : rkhunter security update

CVE-2017-7480 The original patch introduces new regex to better check for allowed download URLs. Other versions of the package in Jessie, Stretch and Sid don't apply that patch but just disable the download of everything by default via rkhunter.conf. In order to make this version consistent with...

Ubuntu 14.04 LTS / 16.04 LTS : X.Org X server vulnerabilities (USN-3362-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3362-1 advisory. It was discovered that the X.Org X server incorrectly handled endianness conversion of certain X events. An attacker able to connect to an X...

Debian DLA-1037-1 : catdoc security update

A heap-based buffer underflow flaw was discovered in catdoc, a text extractor for MS-Office files, which may lead to denial of service application crash or have unspecified other impact, if a specially crafted file is processed. For Debian 7 'Wheezy', these problems have been fixed in version...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1946-1) (Stack Clash)

This update for the Linux Kernel 3.12.67-606421 fixes several issues. The following security bugs were fixed : - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be 'jumped' over the stack...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1945-1) (Stack Clash)

This update for the Linux Kernel 3.12.61-5269 fixes several issues. The following security bugs were fixed : - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be 'jumped' over the stack...

Ubuntu 14.04 LTS / 16.04 LTS : ImageMagick vulnerabilities (USN-3363-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3363-1 advisory. It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1937-1) (Stack Clash)

This update for the Linux Kernel 3.12.69-606429 fixes several issues. The following security bugs were fixed : - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be 'jumped' over the stack...