SUSE SLED12 / SLES12 Security Update : libsndfile (SUSE-SU-2015:2000-1)

The libsndfile package was updated to fix the following security issue : - CVE-2014-9756: Fixed a divide by zero problem that can lead to a Denial of Service DoS bsc953521. - CVE-2015-7805: Fixed heap overflow issue bsc953516. - CVE-2015-8075: Fixed heap overflow issue bsc953519. Note that Tenabl...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2015-3098)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-3098 advisory. - virtio-net: drop NETIFFFRAGLIST Jason Wang Orabug: 22145600 CVE-2015-5156 - RDS: fix race condition when sending a message on unbound socket...

SUSE SLES11 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2015:1978-1)

This Mozilla Firefox, NSS and NSPR update fixes the following security and non security issues. - mozilla-nspr was updated to version 4.10.10 bsc952810 - MFSA 2015-133/CVE-2015-7183 bmo1205157 NSPR memory corruption issues - mozilla-nss was updated to 3.19.2.1 bsc952810 - MFSA...

Ubuntu 14.04 LTS : wpa_supplicant and hostapd vulnerabilities (USN-2808-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2808-1 advisory. It was discovered that wpasupplicant incorrectly handled WMM Sleep Mode Response frame processing. A remote attacker could use this issue to perform...

Ubuntu 14.04 LTS : Linux kernel (Wily HWE) vulnerability (USN-2807-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2807-1 advisory. Ben Serebrin discovered that the KVM hypervisor implementation in the Linux kernel did not properly catch Alignment Check exceptions. An attacker in a guest virtu...

Ubuntu 14.04 LTS : Linux kernel vulnerability (USN-2801-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2801-1 advisory. Ben Serebrin discovered that the KVM hypervisor implementation in the Linux kernel did not properly catch Alignment Check exceptions. An attacker in a guest virtu...

Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2795-1)

It was discovered that in certain situations, a directory could be renamed outside of a bind mounted location. An attacker could use this to escape bind mount containment and gain access to sensitive information. CVE-2015-2925 Moein Ghasemzadeh discovered that the USB WhiteHEAT serial driver...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3094)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-3094 advisory. kernel-uek 2.6.32-400.37.12uek - virtio-net: drop NETIFFFRAGLIST Jason Wang Orabug: 22145596 CVE-2015-5156 Tenable has extracted the preceding description...

IBM WebSphere RCE Java Deserialization Vulnerability

This module exploits a vulnerability in IBM's WebSphere Application Server. An unsafe deserialization call of unauthenticated Java objects exists to the Apache Commons Collections ACC library, which allows remote arbitrary code execution. Authentication is not required in order to exploit this...

Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2798-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2798-1 advisory. It was discovered that in certain situations, a directory could be renamed outside of a bind mounted location. An attacker could use this to escape bind...

Ubuntu 14.04 LTS : NSS vulnerabilities (USN-2791-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2791-1 advisory. Tyson Smith and David Keeler discovered that NSS incorrectly handled decoding certain ASN.1 data. An remote attacker could use this issue to cause NSS to...

SUSE SLED12 / SLES12 Security Update : libvdpau (SUSE-SU-2015:1892-1)

libvdpau was updated to use securegetenv instead of getenv for several variables so it can be more safely used in setuid applications. - CVE-2015-5198: libvdpau: incorrect check for security transition bnc943967 - CVE-2015-5199: libvdpau: directory traversal in dlopen bnc943968 - CVE-2015-5200:...

SUSE SLED12 / SLES12 Security Update : krb5 (SUSE-SU-2015:1897-1)

krb5 was updated to fix three security issues. These security issues were fixed : - CVE-2015-2695: Applications which call gssinquirecontext on a partially-established SPNEGO context could have caused the GSS-API library to read from a pointer using the wrong type, generally causing a process...

SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2015:1908-1)

xen was updated to version 4.4.3 to fix nine security issues. These security issues were fixed : - CVE-2015-4037: The slirpsmb function in net/slirp.c created temporary files with predictable names, which allowed local users to cause a denial of service instantiation failure by creating...

SUSE SLED12 / SLES12 Security Update : Recommended update for LibreOffice (SUSE-SU-2015:1915-1)

This update brings LibreOffice to version 5.0.2, a major version update. It brings lots of new features, bugfixes and also security fixes. Features as seen on http://www.libreoffice.org/discover/new-features/ - LibreOffice 5.0 ships an impressive number of new features for its spreadsheet module,...

Ubuntu 14.04 LTS : NSPR vulnerability (USN-2790-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2790-1 advisory. Ryan Sleevi discovered that NSPR incorrectly handled memory allocation. A remote attacker could use this issue to cause NSPR to crash, resulting in a denial of...

SUSE SLED11 / SLES11 Security Update : xen (SUSE-SU-2015:1894-1)

xen was updated to version 4.4.3 to fix nine security issues. These security issues were fixed : - CVE-2015-4037: The slirpsmb function in net/slirp.c created temporary files with predictable names, which allowed local users to cause a denial of service instantiation failure by creating...

Oracle Linux 7 : kernel (ELSA-2015-1978)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1978 advisory. - netdrv virtio-net: drop NETIFFFRAGLIST Jason Wang 1247839 1247840 CVE-2015-5156 - fs dcache: dwalk might skip too much Denys Vlasenko 1173812 1173813...

SUSE SLES11 Security Update : openssh (SUSE-SU-2015:1840-1) (Logjam)

openssh was updated to fix four security issues. These security issues were fixed : - CVE-2015-5352: The x11openhelper function in channels.c in ssh in OpenSSH when ForwardX11Trusted mode is not used, lacked a check of the refusal deadline for X connections, which made it easier for remote...

Ubuntu 14.04 LTS : audiofile vulnerability (USN-2787-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2787-1 advisory. Fabrizio Gennari discovered that audiofile incorrectly handled changing both the sample format and the number of channels. If a user or automated system were...