Debian DLA-415-1 : cpio security update

An out-of-bounds write was discovered in the parsing of cpio files. For Debian 6 'Squeeze', this issue has been fixed in cpio version 2.11-4+deb6u2. We recommend you to upgrade your cpio package. Learn more about the Debian Long Term Support LTS Project and how to apply these updates at:...

Ubuntu 14.04 LTS : GTK+ vulnerability (USN-2898-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2898-1 advisory. It was discovered that GTK+ incorrectly handled certain large images. A remote attacker could use this issue to cause GTK+ applications to crash, resulting in a...

SUSE SLED11 / SLES11 Security Update : krb5 (SUSE-SU-2016:0430-1)

This update for krb5 fixes the following issues : - CVE-2015-8629: Information leak authenticated attackers with permissions to modify the database bsc963968 - CVE-2015-8631: An authenticated attacker could have caused a memory leak in auditd by supplying a null principal name in request bsc96397...

Ubuntu 14.04 LTS : PostgreSQL vulnerabilities (USN-2894-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2894-1 advisory. It was discovered that PostgreSQL incorrectly handled certain regular expressions. A remote attacker could possibly use this issue to cause PostgreSQL to...

Oracle Linux 6 : sos (ELSA-2016-0152)

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2016-0152 advisory. 3.2-28.0.1.2 - Add vendor, vendor URL info for Oracle Linux orabug 17656507 [email protected] - Direct traceroute to linux.oracle.com John Haxby orabug 1171327...

SUSE SLED11 / SLES11 Security Update : curl (SUSE-SU-2016:0347-1)

This update for curl fixes the following issues : - CVE-2016-0755: libcurl would reuse NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer bsc962983 The update package also includes non-security...

SUSE SLED12 / SLES12 Security Update : MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nss (SUSE-SU-2016:0338-1)

This update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nss fixes the following issues: bsc963520 Mozilla Firefox was updated to 38.6.0 ESR. Mozilla NSS was updated to 3.20.2. The following vulnerabilities were fixed : - CVE-2016-1930: Memory safety bugs fixed in Firefox ESR 38.6...

SUSE SLED11 / SLES11 Security Update : kdebase4-workspace (SUSE-SU-2016:0303-1)

This update for kdebase4-workspace fixes the following issues : - CVE-2014-8651: Privilege escalation via KDE Clock KCM helper when non-default polkit settings are used bsc904625 The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has...

Ubuntu 14.04 LTS : Linux kernel (Wily HWE) vulnerabilities (USN-2890-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2890-2 advisory. It was discovered that a use-after-free vulnerability existed in the AFUNIX implementation in the Linux kernel. A local attacker could use crafted epollc...

Ubuntu 14.04 LTS : OpenJDK 7 vulnerabilities (USN-2884-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2884-1 advisory. Multiple vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity, and availability. An attacker could exploi...

Debian DLA-406-1 : phpmyadmin security update

Several flaws were discovered in the CSRF authentication code of phpMyAdmin. CVE-2016-2039 The XSRF/CSRF token is generated with a weak algorithm using functions that do not return cryptographically secure values. CVE-2016-2041 The comparison of the XSRF/CSRF token parameter with the value saved ...

SUSE SLED11 / SLES11 Security Update : ecryptfs-utils (SUSE-SU-2016:0290-1)

This update for ecryptfs-utils fixes the following issues : - CVE-2016-1572: A local user could have escalated privileges by mounting over special filesystems bsc962052 - CVE-2014-9687: A default salt value reduced complexity of offline precomputation attacks bsc920160 Note that Tenable Network...

Tenable Nessus Watermark Detection

Binary data 9067.prm...

Debian DLA-405-1 : tiff security update

Several security flaws have been found and solved in libtiff, a library that provides support for handling Tag Image File Format TIFF. These flaws concern out of bounds reads and writes in the LogL16Decode, LogLuvDecode24, LogLuvDecode32, LogLuvDecodeTile, LogL16Encode, LogLuvEncode24,...

Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2877-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2877-1 advisory. A bad cast was discovered in V8. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a...

Oracle Linux 5 / 6 / 7 : firefox (ELSA-2016-0071)

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2016-0071 advisory. 38.6.0-1.0.1 - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat files 38.6.0-...

Oracle Linux 5 / 6 / 7 : java-1.6.0-openjdk (ELSA-2016-0067)

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0067 advisory. 1.6.0.38-1.13.10.0.0.1 - Add oracle-enterprise.patch 1:1.6.0.38-1.13.10.0 - Add patch to replace -fno-strict-overflow with -fwrapv on older RHE...

Ubuntu 14.04 LTS : MySQL vulnerabilities (USN-2881-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2881-1 advisory. Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to...

Debian DLA-402-1 : tiff security update

Two security flaws have been found and solved in libtiff, library that provides support for handling Tag Image File Format TIFF. These flaws concern out of bounds reads in the TIFFRGBAImage interface, when parsing unsupported values related to LogLUV and CIELab. CVE-2015-8665 was reported by...

SUSE SLED12 / SLES12 Security Update : gdk-pixbuf (SUSE-SU-2016:0225-1)

This update for gdk-pixbuf fixes the following security issues : - CVE-2015-7552: various overflows, including heap overflow in flipping bmp files bsc958963 The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the precedin...