Fedora 25 : ghostscript (2017-15f85f1cf1)

This is a security update for these CVEs : - CVE-2016-9601 - Heap-buffer overflow in jbig2imagenew function This update also solves possible licensing issues with ghostscritpt's source code. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

Tenable Nessus 6.x < 6.9.3 Multiple Stored XSS

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 6.9.3. It is, therefore, affected by multiple stored cross-site scripting XSS vulnerabilities due to improper validation of user-supplied input. An authenticated, remote attacker can...

Debian DLA-800-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code or information leaks or privilege escalation. For Debian 7 'Wheezy', these problems have been fix...

Tenable SecurityCenter < 5.4.1 Multiple Vulnerabilities (TNS-2016-19)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is prior to 5.4.1. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists in x509vfy.c due to improper handling of certificate revocation lists...

Oracle Linux 5 / 6 / 7 : firefox (ELSA-2017-0190)

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2017-0190 advisory. 45.7.0-1.0.1 - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat files 45.7.0-...

Fedora 25 : ansible (2017-cb88734094)

Update to ansible 2.2.1. Fixes several CVEs as well as a number of other bugfixes. See: https://github.com/ansible/ansible/blob/stable-2.2/CHANGELOG.md for full changes. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

Ubuntu 16.04 LTS : OpenJDK 8 vulnerabilities (USN-3179-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3179-1 advisory. Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly...

Fedora 24 : ansible (2017-418398ce60)

Update to ansible 2.2.1. Fixes several CVEs as well as a number of other bugfixes. See: https://github.com/ansible/ansible/blob/stable-2.2/CHANGELOG.md for full changes. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

SUSE SLED12 / SLES12 Security Update : systemd (SUSE-SU-2017:0279-1)

This update for systemd fixes the following issues: This security issue was fixed : - CVE-2016-10156: Fix permissions set on permanent timer timestamp files, preventing local unprivileged users from escalating privileges bsc1020601. The update package also includes non-security fixes. See advisor...

Oracle Weblogic Server Deserialization RCE - RMI UnicastRef

An unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a serialized object sun.rmi.server.UnicastRef to the interface to execute code on vulnerable hosts. Module Options msf use exploit/multi/misc/weblogic/deserializeunicastref msf...

Fedora 25 : fedmsg (2017-fff6e1af37)

Fix validation logic in the base consumer The base consumer is intended to only derive its validation switch from the on-disk configuration if the child class doesn't override the validatesignatures switch. There was a bug here where the default value provided in the base class made it appear as ...

Ubuntu 12.04 LTS : icoutils vulnerabilities (USN-3178-1)

It was discovered that icoutils incorrectly handled memory when processing certain files. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause icoutils to crash, resulting in a denial of service, or possibly execute arbitrary code. Note that...

Fedora 24 : gd (2017-2717b02630)

Version 2.2.4 - 2017-01-18 Security - gdImageCreate doesn't check for oversized images and as such is prone to DoS vulnerabilities. CVE-2016-9317 - double-free in gdImageWebPtr CVE-2016-6912 - potential unsigned underflow in gdinterpolation.c - DOS vulnerability in gdImageCreateFromGd2Ctx Fixed -...

SUSE SLES11 Security Update : ntp (SUSE-SU-2017:0255-1)

This update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed : - CVE-2016-9311, CVE-2016-9310, bsc1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. - CVE-2016-7427, bsc1011390: Broadcast Mode Replay Prevention DoS. - CVE-2016-7428,...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:0248-1)

This update for the Linux Kernel 3.12.60-5249 fixes several issues. The following security bugs were fixed : - CVE-2016-9806: Race condition in the netlinkdump function in net/netlink/afnetlink.c in the Linux kernel allowed local users to cause a denial of service double free or possibly have...

SUSE SLES11 Security Update : gstreamer-0_10-plugins-good (SUSE-SU-2017:0225-1)

gstreamer-010-plugins-good was updated to fix six security issues. These security issues were fixed : - CVE-2016-9634: Invalid FLIC files could have caused and an out-of-bounds write bsc1012102 - CVE-2016-9635: Invalid FLIC files could have caused and an out-of-bounds write bsc1012103 -...

Ubuntu 14.04 LTS / 16.04 LTS : MySQL vulnerabilities (USN-3174-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3174-1 advisory. Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been...

Debian DLA-790-1 : mapserver security update

It was discovered that mapserver, a CGI-based framework for Internet map services, was vulnerable to a stack-based overflow. This issue allowed a remote user to crash the service, or potentially execute arbitrary code. For Debian 7 'Wheezy', these problems have been fixed in version...

SUSE SLED12 Security Update : gstreamer-0_10-plugins-good (SUSE-SU-2017:0210-1)

This update for gstreamer-010-plugins-good fixes the following issues : - CVE-2016-9634: Invalid FLIC files could have caused and an out-of-bounds write bsc1012102 - CVE-2016-9635: Invalid FLIC files could have caused and an out-of-bounds write bsc1012103 - CVE-2016-9636: Prevent maliciously...

Ubuntu 14.04 LTS / 16.04 LTS : NVIDIA graphics drivers vulnerability (USN-3173-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3173-1 advisory. It was discovered that the NVIDIA graphics drivers contained a flaw in the kernel mode layer. A local attacker could use this issue to cause a denial ...