SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:0186-1)

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive a security fix. Following security bug was fixed : - A reference leak in keyring handling with joinsessionkeyring could lead to local attackers gain root privileges. bsc962075, CVE-2016-0728. Note that Tenable Network Security has...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:0205-1)

The SUSE Linux Enterprise 12 kernel was updated to receive a security fix. Following security bug was fixed : - A reference leak in keyring handling with joinsessionkeyring could lead to local attackers gain root privileges. bsc962075, CVE-2016-0728. Note that Tenable Network Security has extract...

Ubuntu 14.04 LTS : rsync vulnerability (USN-2879-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2879-1 advisory. It was discovered that rsync incorrectly handled invalid filenames. A malicious server could use this issue to write files outside of the intended destination...

Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2016-0053)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0053 advisory. 1.7.0.95-2.6.4.0.0.1 - Update DISTRONAME in specfile 1:1.7.0.95-2.6.4.0 - Remove reference to jre/lib/audio. - Resolves: rhbz1295765 1:1.7.0.95-2.6.4.0...

Oracle Linux 6 : java-1.8.0-openjdk (ELSA-2016-0050)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0050 advisory. 1:1.8.0.71-1.b15 - Add patch to turn off strict overflow on IndicRearrangementProcessor,2.cpp - Resolves: rhbz1295751 1:1.8.0.71-0.b15 - January 2016...

Juniper Junos IGMPv3 Protocol Multicast DoS (JSA10714)

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability due to a flaw in the IGMPv3 implementation. An unauthenticated, remote attacker can exploit this, via a specially crafted IGMPv3 packet, to affect service availability o...

SUSE SLED12 / SLES12 Security Update : libxml2 (SUSE-SU-2016:0178-1)

This update for libxml2 fixes the following security issue : - CVE-2015-8710: Parsing short unclosed HTML comment could cause uninitialized memory access, which allowed remote attackers to read contents from previous HTTP requests depending on the application bsc960674 Note that Tenable Network...

Ubuntu 14.04 LTS : eCryptfs vulnerability (USN-2876-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2876-1 advisory. Jann Horn discovered that mount.ecryptfsprivate would mount over certain directories in the proc filesystem. A local attacker could use this to escalate their...

Ubuntu 14.04 LTS : Linux kernel vulnerability (USN-2870-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2870-1 advisory. Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A...

Ubuntu 12.04 LTS : linux-lts-trusty vulnerability (USN-2870-2)

Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code with administrative privilege...

Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerability (USN-2871-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2871-2 advisory. Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A...

Ubuntu 15.10 : linux vulnerability (USN-2872-1)

Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code with administrative privilege...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:0168-1)

The SUSE Linux Enterprise 12 kernel was updated to receive various security and bugfixes. Following security bugs were fixed : - CVE-2015-7550: A local user could have triggered a race between read and revoke in keyctl bnc958951. - CVE-2015-8539: A negatively instantiated user key could have been...

Ubuntu 15.10 : linux-raspi2 vulnerability (USN-2872-3)

Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code with administrative privilege...

Debian DLA-393-1 : srtp security update

Prevent potential DoS attack due to lack of bounds checking on RTP header CSRC count and extension header length. Credit goes to Randell Jesup and the Firefox team for reporting this issue. As there is no aead mode available in the Squeeze version, only srtpunprotect needed to be patched NOTE:...

Debian DLA-390-1 : dbconfig-common security update

It was discovered that dbconfig-common could, depending on the local umask, make PostgreSQL database backups that were readable by other users than the database owner. The issue is fixed in version 1.8.46+squeeze.1. Access rights to existing database backups not only for PostgreSQL will be limite...

SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2016:0118-1)

This update for openssh fixes the following issues : - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature bsc961642 - CVE-2016-0778: A malicious or compromised server could could trigger a...

SUSE SLED11 / SLES11 Security Update : openssh (SUSE-SU-2016:0120-1)

This update for openssh fixes the following issues : - CVE-2016-0777: A malicious or compromised server could cause the OpenSSH client to expose part or all of the client's private key through the roaming feature bsc961642 - CVE-2016-0778: A malicious or compromised server could could trigger a...

SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2016:0121-1)

MariaDB has been updated to version 10.0.22, which brings fixes for many security issues and other improvements. The following CVEs have been fixed : - 10.0.22: CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4826, CVE-2015-4830, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870,...

Ubuntu 14.04 LTS : OpenSSH vulnerabilities (USN-2869-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2869-1 advisory. It was discovered that the OpenSSH client experimental support for resuming connections contained multiple security issues. A malicious server could use...