SUSE SLES12 Security Update : samba (SUSE-SU-2016:3299-1)

This update for samba fixes the following issues: Security issues fixed : - CVE-2016-2125: Don't send delegated credentials to all servers. bsc1014441. - CVE-2016-2126: Denial of service due to a client triggered crash in the winbindd parent process. bsc1014442. - CVE-2016-2123: Heap-based Buffer...

SUSE SLED12 / SLES12 Security Update : gstreamer-plugins-good (SUSE-SU-2016:3303-1)

This update for gstreamer-plugins-good fixes the following security issues : - CVE-2016-9807: Flic decoder invalid read could lead to crash. bsc1013655 - CVE-2016-9634: Flic out-of-bounds write could lead to code execution. bsc1012102 - CVE-2016-9635: Flic out-of-bounds write could lead to code...

SUSE SLES11 Security Update : samba (SUSE-SU-2016:3298-1)

This update for samba provides the following fixes: Security issues fixed : - CVE-2016-2125: Don't send delegated credentials to all servers. bsc1014441 - CVE-2016-2126: Prevent denial of service due to a client triggered crash in the winbindd parent process. bsc1014442 Non security issues fixed ...

Fedora 24 : xen (2016-bc02bff7f5)

two security flaws 1406840 x86 PV guests may be able to mask interrupts XSA-202, CVE-2016-10024 x86: missing NULL pointer check in VMFUNC emulation XSA-203, CVE-2016-10025 x86: Mishandling of SYSCALL singlestep during emulation XSA-204, CVE-2016-10013 1406260 Note that Tenable Network Security ha...

SUSE SLED12 / SLES12 Security Update : gstreamer-plugins-bad (SUSE-SU-2016:3296-1)

This update for gstreamer-plugins-bad fixes the following security issues, which would allow attackers able to submit media files for indexing to cause code execution or crashes : - Check an integer overflow CVE-2016-9445 and initialize a buffer CVE-2016-9446 in vmncdec. bsc1010829 - CVE-2016-980...

Debian DLA-776-1 : samba security update

Simo Sorce of Red Hat discovered that the Samba client code always requests a forwardable ticket when using Kerberos authentication. A target server, which must be in the current or trusted domain/realm, is given a valid general purpose Kerberos 'Ticket Granting Ticket' TGT, which can be used to...

Debian DLA-764-1 : qemu security update

Multiple vulnerabilities have been found in QEMU : CVE-2016-9911 Quick Emulator Qemu built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehciinittransfer'. A guest user/ process could use this issue to leak host memory...

Debian DLA-765-1 : qemu-kvm security update

Multiple vulnerabilities have been found in qemu-kvm : CVE-2016-9911 qemu-kvm built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehciinittransfer'. A guest user/process could use this issue to leak host memory,...

SUSE SLED12 / SLES12 Security Update : wget (SUSE-SU-2016:3268-1)

This update for wget fixes the following issues: Security issues fixed : - CVE-2016-7098: Fixed a potential race condition by creating files with .tmp ext and making them accessible to the current user only. bsc995964 Non security issues fixed : - bsc1005091: Don't call xfree on string returned b...

Debian DLA-759-1 : nss security update

Franziskus Kiefer reported that the existing mitigations for some timing side-channel attacks were insufficient: https://www.mozilla.org/en-US/security/advisories/mfsa2016-90/CVE-201 6-9074 For Debian 7 'Wheezy', these problems have been fixed in version 2:3.26-1+debu7u2. We recommend that you...

SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2016:3271-1)

This update for samba fixes the following issues: Security issues fixed : - CVE-2016-2125: Don't send delegated credentials to all servers. bsc1014441. - CVE-2016-2126: Denial of service due to a client triggered crash in the winbindd parent process. bsc1014442. - CVE-2016-2123: Heap-based Buffer...

Fedora 25 : gdk-pixbuf2 (2016-a1e8589ef9)

gdk-pixbuf 2.36.2 release. - Remove the pixdata loader 776004 - Fix integer overflows in the jpeg loader 775218 - Add an external thumbnailer for images - Fix a NULL pointer dereference 776026 - Fix a memory leak 776020 - Support bmp headers with bitmask 766890 - Add tests for scaling 80925 -...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3655)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-3655 advisory. kernel-uek 4.1.12-61.1.23 - net: Fix use after free in the recvmmsg exit path Arnaldo Carvalho de Melo Orabug: 25298601 CVE-2016-7117 Tenable has extracted...

Oracle Linux 6 : gstreamer-plugins-bad-free (ELSA-2016-2974)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2974 advisory. 0.10.19-5 - vmncdec: Sanity-check width/height before using it Resolves: rhbz1400820 0.10.19-4 - Remove insecure NSF decoder Resolves: rhbz1400820...

Debian DLA-758-1 : libgd2 security update

It was discovered that invalid color causes stack exhaustion by recursive call to function gdImageFillToBorder when the image used is truecolor. The vulnerability can be exploited through php5 which uses system's libgd2 library through the imagefilltoborder PHP function to cause denial of service...

SUSE SLES11 Security Update : ntp (SUSE-SU-2016:3193-1)

This update for ntp fixes the following issues : - Simplify ntpd's search for its own executable to prevent AppArmor warnings bsc956365. Security issues fixed update to 4.2.8p9 : - CVE-2016-9311, CVE-2016-9310, bsc1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. -...

Oracle Linux 5 : xen (ELSA-2016-2963)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2963 advisory. 3.0.3-148.el511 - xen-qemu-ioport-array-overflow.patch bz1401521 - Resolves: bz1401521 CVE-2016-9637 xsa199 xen: qemu ioport array overflow XSA-199 rhel-5.11.z...

SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2016:3195-1)

This update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed : - CVE-2016-9311, CVE-2016-9310, bsc1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. - CVE-2016-7427, bsc1011390: Broadcast Mode Replay Prevention DoS. - CVE-2016-7428,...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3160-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3160-1 advisory. CAI Qian discovered that shared bind mounts in a mount namespace exponentially added entries without restriction to the Linux kernel's mount table. A loc...

Oracle Linux 5 : kernel (ELSA-2016-2962)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2962 advisory. kernel 2.6.18-417 - virt hv: do not lose pending heartbeat vmbus packets Vitaly Kuznetsov 1391167 - net Fix use after free in the recvmmsg exit path Davide...