SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2016:1563-1)

ntp was updated to version 4.2.8p8 to fix five security issues. These security issues were fixed : - CVE-2016-4953: Bad authentication demobilizes ephemeral associations bsc982065. - CVE-2016-4954: Processing spoofed server packets bsc982066. - CVE-2016-4955: Autokey association reset bsc982067. ...

SUSE SLES11 Security Update : ntp (SUSE-SU-2016:1584-1)

ntp was updated to version 4.2.8p8 to fix five security issues. These security issues were fixed : - CVE-2016-4953: Bad authentication demobilizes ephemeral associations bsc982065. - CVE-2016-4954: Processing spoofed server packets bsc982066. - CVE-2016-4955: Autokey association reset bsc982067. ...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:1596-1)

The SUSE Linux Enterprise 12 GA kernel was updated to fix one security issue. The following security bug was fixed : - CVE-2016-1583: Prevent the usage of mmap when the lower file system does not allow it. This could have lead to local privilege escalation when ecryptfs-utils was installed and...

FreeBSD : botan -- cryptographic vulnerability (f771880c-31cf-11e6-8e82-002590263bf5)

MITRE reports : The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x before 1.11.9 improperly uses a single random base, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a DH group. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Ubuntu 16.04 LTS : Linux kernel (Qualcomm Snapdragon) vulnerability (USN-3008-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3008-1 advisory. Jann Horn discovered that eCryptfs improperly attempted to use the mmap handler of a lower filesystem that did not implement one, causing a recursive page fault t...

Debian DLA-505-1 : libpdfbox-java security update

Apache PDFBox did not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted PDF. This may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspectiv...

Debian DLA-506-1 : dhcpcd5 security update

Two vulnerabilities were discovered in dhcpcd5 a DHCP client package. A remote on a local network attacker can possibly execute arbitrary code or cause a denial of service attack by crafted messages. CVE-2014-7912 The getoption function does not validate the relationship between length fields and...

Ubuntu 14.04 LTS / 16.04 LTS : nginx vulnerability (USN-2991-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2991-1 advisory. It was discovered that nginx incorrectly handled saving client request bodies to temporary files. A remote attacker could possibly use this issue to...

Ubuntu 14.04 LTS / 16.04 LTS : ImageMagick vulnerabilities (USN-2990-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2990-1 advisory. Nikolay Ermishkin and Stewie discovered that ImageMagick incorrectly sanitized untrusted input. A remote attacker could use these issues to...

Oracle Linux 7 : squid (ELSA-2016-1139)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1139 advisory. - Related: 1330576 - CVE-2016-4553 squid: Cache poisoning issue in HTTP Request handling - Related: 1334491 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556...

Oracle Linux 6 : squid (ELSA-2016-1138)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2016-1138 advisory. - Related: 1334489 - CVE-2016-4554 CVE-2016-4556 squid: various flaws - Resolved: 1334489 - CVE-2016-4554 CVE-2016-4556 squid: various flaws - Related:...

Oracle Linux 6 : squid34 (ELSA-2016-1140)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2016-1140 advisory. - Resolves: 1334499 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556 squid34: various flaws - Resolves: 1334506 - CVE-2016-4553 squid34: squid: Cache...

Oracle Linux 5 : openssl (ELSA-2016-1137)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-1137 advisory. - fix CVE-2014-3570 - Bignum squaring may produce incorrect results - fix CVE-2014-3571 - DTLS segmentation fault in dtls1getrecord - fix CVE-2014-3572 - ECDHE...

Ubuntu 16.04 LTS : LXD vulnerabilities (USN-2988-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2988-1 advisory. Robie Basak discovered that LXD incorrectly set permissions when setting up a loop based ZFS pool. A local attacker could use this issue to copy and read...

Debian DLA-498-1 : ruby-activemodel-3.2 security update

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters. For Debian 7 'Wheezy', these problems...

Ubuntu 14.04 LTS : GNU C Library vulnerabilities (USN-2985-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2985-1 advisory. Martin Carpenter discovered that ptchown in the GNU C Library did not properly check permissions for tty files. A local attacker could use this to gain...

Debian DLA-486-1 : imagemagick security update (ImageTragick)

Nikolay Ermishkin from the Mail.Ru Security Team and Stewie discovered several vulnerabilities in ImageMagick, a program suite for image manipulation. These vulnerabilities, collectively known as ImageTragick, are the consequence of lack of sanitization of untrusted input. An attacker with contro...

SUSE SLES10 Security Update : openssl (SUSE-SU-2016:1360-1)

This update for OpenSSL fixes the following security issues : CVE-2016-2105: EVPEncodeUpdate overflow bsc977614 CVE-2016-2106: EVPEncryptUpdate overflow bsc977615 CVE-2016-2108: Memory corruption in the ASN.1 encoder bsc977617 CVE-2016-2109: ASN.1 BIO excessive memory allocation bsc976942...

Ubuntu 16.04 LTS : libndp vulnerability (USN-2980-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2980-1 advisory. Julien Bernard discovered that libndp incorrectly performed origin checks when receiving Neighbor Discovery Protocol NDP messages. A remote attacker outside of th...

Oracle Linux 6 : kernel (ELSA-2016-0855)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0855 advisory. - x86 kernel: espfix not working for 32-bit KVM paravirt guests Jacob Tanenbaum 1172767 CVE-2014-8134 - x86 nmi/64: Fix a paravirt stack-clobbering bug...