Ubuntu 14.04 LTS : libwmf vulnerabilities (USN-2670-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2670-1 advisory. Fernando Muoz and Stefan Cornelius discovered that libwmf incorrectly handled certain malformed images. If a user or automated system were tricked into...

Debian DLA-269-1 : linux-ftpd-ssl security update

The issue is due to a case of missing brackets in the patch '500-ssl.diff', which causes the execution of 'fcloseNULL' and thus displays as a segmentation fault. The error appears while transmogrifying 'linux-ftpd' into 'linux-ftpd-ssl'. There is no CVE assigned to this issue. The patch was creat...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2663-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2663-1 advisory. Alexandre Oliva reported a race condition flaw in the btrfs file system's handling of extended attributes xattrs. A local attacker could exploit this fla...

Oracle Linux 6 : abrt (ELSA-2015-1210)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1210 advisory. abrt 2.0.8-26.0.1.el66.1 - Add abrt-oracle-enterprise.patch to be product neutral - Remove abrt-plugin-rhtsupport dependency for cli and desktop - Make...

Ubuntu 14.04 LTS : Bind vulnerability (USN-2669-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2669-1 advisory. Breno Silveira Soares discovered that Bind incorrectly handled certain zone data when configured to perform DNSSEC validation. A remote attacker could use this...

SUSE SLED11 / SLES10 Security Update : OpenSSL (SUSE-SU-2015:1183-2) (Logjam)

OpenSSL was updated to fix several security issues. CVE-2015-4000: The Logjam Attack weakdh.org has been addressed by rejecting connections with DH parameters shorter than 1024 bits. We now also generate 2048-bit DH parameters by default. CVE-2015-1789: An out-of-bounds read in X509cmptime was...

SUSE SLED12 / SLES12 Security Update : strongswan (SUSE-SU-2015:1196-1)

Strongswan was updated to fix one security issue. The following vulnerability was fixed : - CVE-2015-4171: Rogue servers were able to authenticate themselves with certificate issued by any CA the client trusts, to gain user credentials from a client in certain IKEv2 setups bsc933591 Note that...

Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2658-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2658-1 advisory. Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL bytes in file paths. A remote attacker could possibly use this issue to bypass...

Fedora 21 : drupal7-7.38-1.fc21 (2015-10189)

Release 7.38 is a security fix release - Upstream release notes: https://www.drupal.org/drupal-7.38-release-notes Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it...

SUSE SLED11 / SLES11 Security Update : MySQL (SUSE-SU-2015:1177-1) (Logjam)

This update fixes the following security issue : Logjam Attack: MySQL uses 512 bit dh groups in SSL bnc934789 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as mu...

Debian DLA-260-1 : hostapd security update

A vulnerability was found in WMM Action frame processing in a case where hostapd is used to implement AP mode MLME/SME functionality i.e., Host AP driver of a mac80211-based driver on Linux. This vulnerability can be used to perform denial of service attacks by an attacker that is within radio...

Fedora 21 : abrt-2.3.0-7.fc21 / gnome-abrt-1.0.0-3.fc21 / libreport-2.3.0-8.fc21 (2015-10193)

Security fixes for : - CVE-2015-3315 - CVE-2015-3142 - CVE-2015-1869 - CVE-2015-1870 - CVE-2015-3151 - CVE-2015-3150 - CVE-2015-3159 abrt: ===== - Move the default dump location from /var/tmp/abrt to /var/spool/abrt - Use root for owner of all dump directories - Stop reading hserror.log from /tmp...

Ubuntu 14.04 LTS : Oxide vulnerabilities (USN-2652-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2652-1 advisory. It was discovered that Chromium did not properly consider the scheme when determining whether a URL is associated with a WebUI SiteInstance. If a user we...

Fedora 21 : python-jwt-1.3.0-1.fc21 (2015-10249)

Latest upstream with security fix for http://seclists.org/oss-sec/2015/q2/3 https://github.com/jpadilla/pyjwt/commit/88a9fc56bdc6c870aa6af93bda401 414a217db2a Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...

Fedora 22 : python-jwt-1.3.0-1.fc22 (2015-10350)

Latest upstream with security fix for http://seclists.org/oss-sec/2015/q2/3 https://github.com/jpadilla/pyjwt/commit/88a9fc56bdc6c870aa6af93bda401 414a217db2a Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...

Oracle Linux 6 / 7 : postgresql (ELSA-2015-1194)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1194 advisory. 9.2.13-1 - update to 9.2.13 per release notes http://www.postgresql.org/docs/9.2/static/release-9-2-13.html 9.2.12-1 - update to 9.2.12 per release...

SUSE SLED12 / SLES12 Security Update : compat-openssl098 (SUSE-SU-2015:1150-1) (Logjam)

This update fixes the following security issues : - CVE-2015-4000 boo931698 - The Logjam Attack / weakdh.org - reject connections with DH parameters shorter than 1024 bits - generates 2048-bit DH parameters by default - CVE-2015-1788 boo934487 - Malformed ECParameters causes infinite loop -...

SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2015:1086-4) (Bar Mitzvah) (FREAK)

IBM Java 1.7.0 was updated to SR9 fixing security issues and bugs. Tabulated information can be found on: http://www.ibm.com/developerworks/java/jdk/alerts/IB MSecurityUpdateMay2015. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...

Debian DLA-257-1 : libwmf security update

libwmf is vulnerable to two denial of service due to invalid read operations when processing specially crafted WMF files. CVE-2015-4695 Heap buffer overread in libwmf CVE-2015-4696 Read after free in wmf2gd/wmf2eps For the squeeze distribution, those issues have been fixed in libwmf...

Debian DLA-256-1 : t1utils security update

Jakub Wilk found a vulnerability in the Type 1 font manipulation programs, t1utils : CVE-2015-3905 Buffer overflow in the setcsstart function in t1disasm.c in t1utils before 1.39 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a crafted font file...