SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2017:2202-1)

This update for freeradius-server fixes the following issues : - update to 3.0.15 bsc1049086 - Bind the lifetime of program name and python path to the module - CVE-2017-10978: FR-GV-201: Check input / output length in makesecret bsc1049086 - CVE-2017-10983: FR-GV-206: Fix read overflow when...

SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:2175-1)

This java-180-openjdk update to version jdk8u141 icedtea 3.5.0 fixes the following issues: Security issues fixed : - CVE-2017-10053: Improved image post-processing steps bsc1049305 - CVE-2017-10067: Additional jar validation steps bsc1049306 - CVE-2017-10074: Image conversion improvements...

Oracle Linux 6 : httpd (ELSA-2017-2478)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2478 advisory. - Resolves: 1463194 - CVE-2017-3167 httpd: apgetbasicauthpw authentication bypass - Resolves: 1463197 - CVE-2017-3169 httpd: modssl NULL pointer...

Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) regression (USN-3392-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3392-2 advisory. USN-3392-1 fixed a regression in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kerne...

Ubuntu 16.04 LTS : Linux kernel regression (USN-3392-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3392-1 advisory. USN-3378-1 fixed vulnerabilities in the Linux kernel. Unfortunately, a regression was introduced that prevented conntrack from working correctly in some situation...

Debian DLA-1058-1 : krb5 security update

In MIT Kerberos 5 aka krb5 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests. For Debian 7 'Wheezy', these problems have been fixed in version 1.10.1+dfsg-5+deb7u8. We recommend that you upgrade your krb5 packages. NOTE:...

Ubuntu 14.04 LTS / 16.04 LTS : GD vulnerability (USN-3389-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3389-1 advisory. A vulnerability was discovered in GD Graphics Library aka libgd, as used in PHP that does not zero colorMap arrays before use. A specially crafted GIF...

Fedora 26 : kernel (2017-adc7d95627)

The 4.12.5 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Fedora 26 : git (2017-b1b3ae6666)

Resolve an arbitrary code execution vulnerability via crafted 'ssh://' URL CVE-2017-1000117. From the release announcement : A malicious third-party can give a crafted 'ssh://...' URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's...

Fedora 25 : git (2017-8ba7572cfd)

Resolve an arbitrary code execution vulnerability via crafted 'ssh://' URL CVE-2017-1000117. From the release announcement : A malicious third-party can give a crafted 'ssh://...' URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's...

Debian DLA-1056-1 : cvs security update

It was discovered that there was a command injection vulnerability in the CVS revision control system. For Debian 7 'Wheezy', this issue has been fixed in cvs version 2:1.12.13+real-9+deb7u1. We recommend that you upgrade your cvs packages. Thanks to Thorsten Glaser for preparing and testing this...

Ubuntu 14.04 LTS / 16.04 LTS : Subversion vulnerabilities (USN-3388-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3388-1 advisory. Joern Schneeweisz discovered that Subversion did not properly handle host names in 'svn+ssh://' URLs. A remote attacker could use this to...

Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3385-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3385-2 advisory. USN-3385-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enableme...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3386-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3386-1 advisory. Andrey Konovalov discovered a race condition in the UDP Fragmentation Offload UFO code in the Linux kernel. A local attacker could use this to cause a...

Ubuntu 17.04 : linux, linux-raspi2 vulnerabilities (USN-3384-1)

Andrey Konovalov discovered a race condition in the UDP Fragmentation Offload UFO code in the Linux kernel. A local attacker could use this to cause a denial of service or execute arbitrary code. CVE-2017-1000112 Andrey Konovalov discovered a race condition in AFPACKET socket option handling code...

Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3384-2)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3384-2 advisory. USN-3384-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04. This update provides the corresponding updates for the Linux Hardware Enablement H...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3385-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3385-1 advisory. Andrey Konovalov discovered a race condition in the UDP Fragmentation Offload UFO code in the Linux kernel. A local attacker could use this to cause a...

Oracle Linux 6 / 7 : java-1.7.0-openjdk (ELSA-2017-2424)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2424 advisory. 1:1.7.0.151-2.6.11.0.0.1 - Update DISTRONAME in specfile 1:1.7.0.151-2.6.11.0 - Bump to 2.6.11 and u151b00. - Update...

Oracle Linux 7 : freeradius (ELSA-2017-2389)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2389 advisory. - Related: Bug1469414 CVE-2017-10984 freeradius: Out-of-bounds write in data2vpwimax - Resolves: Bug1469409 CVE-2017-10978 freeradius: Out-of-bounds...

Oracle Linux 7 : qemu-kvm (ELSA-2017-2445)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-2445 advisory. 1.5.3-141.el74.1 - kvm-qemu-nbd-Ignore-SIGPIPE.patch bz1468107 - Resolves: bz1468107 CVE-2017-10664 qemu-kvm: Qemu: qemu-nbd: server breaks with SIGPIPE upon...