Debian DLA-699-1 : xen security update

Xen does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it. For Debian 7 'Wheezy', thes...

SUSE SLES11 Security Update : curl (SUSE-SU-2016:2714-1)

This update for curl fixes the following security issues : - CVE-2016-8624: invalid URL parsing with '' bsc1005646 - CVE-2016-8623: Use-after-free via shared cookies bsc1005645 - CVE-2016-8621: curlgetdate read out of bounds bsc1005642 - CVE-2016-8619: double-free in krb5 code bsc1005638 -...

Ubuntu 16.04 LTS : OpenJDK 8 vulnerabilities (USN-3121-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3121-1 advisory. It was discovered that the Hotspot component of OpenJDK did not properly check arguments of the System.arraycopy function in certain cases. An attacker...

Debian DLA-689-1 : qemu-kvm security update

Multiple vulnerabilities have been discovered in qemu-kvm, a full virtualization solution on x86 hardware based on Quick EmulatorQemu. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2016-7909 Quick EmulatorQemu built with the AMD PC-Net II emulator suppor...

Default Password 'tech' for 'tech' Account

The account 'tech' on the remote host has the default password 'tech'. A remote attacker can exploit this issue to gain administrative access to the affected system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. account = "tech"; password = "tech"; include'deprecatednasllevel.inc';...

SUSE SLED12 / SLES12 Security Update : python3 (SUSE-SU-2016:2653-1) (httpoxy)

This update provides Python 3.4.5, which brings many fixes and enhancements. The following security issues have been fixed : - CVE-2016-1000110: CGIHandler could have allowed setting of HTTPPROXY environment variable based on user-supplied Proxy request header. bsc989523 - CVE-2016-0772: A...

SUSE SLES11 Security Update : gtk2 (SUSE-SU-2016:2532-1)

This update for gtk2 fixes the following security issues : - CVE-2016-6352: Some crashes were fixed, including a out of bounds write in the OneLine32 function that could be used by attackers to crash GTK/GDK programs. - CVE-2013-7447: Avoid overflow when allocating a cairo pixbuf bsc966682. Note...

SUSE SLES11 Security Update : kernel (SUSE-SU-2016:2614-1) (Dirty COW)

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to fix one security issue. This security bug was fixed : - CVE-2016-5195: Local privilege escalation using MAPPRIVATE. It is reportedly exploited in the wild bsc1004418. Note that Tenable Network Security has extracted the preceding...

SUSE SLES12 Security Update : kernel (SUSE-SU-2016:2636-1) (Dirty COW)

This update for the Linux Kernel 3.12.51-5231 fixes several issues. The following security bugs were fixed : - CVE-2016-5195: A local privilege escalation using MAPPRIVATE was fixed, which is reportedly exploited in the wild bsc1004419. - CVE-2016-4997: The compat IPTSOSETREPLACE and...

SUSE SLED12 / SLES12 Security Update : kdump (SUSE-SU-2016:2553-1)

This update for kdump provides several fixes and enhancements : - Refresh kdumprd if /etc/hosts or /etc/nsswitch.conf is changed. bsc943214 - Add a separate systemd service to rebuild kdumprd at boot. bsc943214 - Improve network setup in the kdump environment by reading configuration from wicked ...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:2592-1) (Dirty COW)

The SUSE Linux Enterprise 12 SP1 kernel was updated to fix two issues. This security bug was fixed : - CVE-2016-5195: Local privilege escalation using MAPPRIVATE. It is reportedly exploited in the wild bsc1004418. The update package also includes non-security fixes. See advisory for details. Note...

Oracle Linux 7 : kernel (ELSA-2016-2098)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2098 advisory. - 3.10.0-327.36.3.OL7 - Oracle Linux certificates Alexey Petrenko 3.10.0-327.36.3 - mm remove gupflags FOLLWRITE games from getuserpages Alexander Gordeev 13851...

Oracle Linux 5 : bind97 (ELSA-2016-2094)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2094 advisory. - Fix CVE-2016-2848 - Fix CVE-2016-2776 - Fix CVE-2016-1285 and CVE-2016-1286 - Fix CVE-2015-8704 - Fix CVE-2015-8000 - Fix CVE-2015-5722 - Fix CVE-2015-5477...

Oracle Linux 5 / 6 : bind (ELSA-2016-2093)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-2093 advisory. - Fix CVE-2016-2848 - Fix CVE-2016-2776 - Fix issue with patch for CVE-2016-1285 and CVE-2016-1286 found by test suite - Fix CVE-2016-1285 and CVE-2016-1286...

Fedora 24 : php-pecl-zip (2016-b9cb75981a)

Version 1.13.5 - Fixed bug php72660 NULL pointer dereference in zendvirtualcwd. Laruence - Fixed bug php68302 impossible to compile php with zip support. cmb - Fixed bug php70752 Depacking with wrong password leaves 0 length files. cmb Note that Tenable Network Security has extracted the precedin...

Ubuntu 16.04 LTS : Linux kernel vulnerability (USN-3106-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3106-1 advisory. It was discovered that a race condition existed in the memory manager of the Linux kernel when handling copy-on-write breakage of private read-only memory mapping...

Debian DLA-668-1 : libass security update

Several vulnerabilities were discovered in libass, a library for manipulating the SubStation Alpha SSA subtitle file format. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2016-7969 Mode 0/3 line wrapping equalization in specific cases which could result in...

Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerability (USN-3106-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3106-2 advisory. USN-3106-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE...

Debian DLA-669-1 : dwarfutils security update

Several vulnerabilities were discovered in dwarfutils, a tool and library for reading/consuming and writing/producing DWARF debugging information. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2015-8538 A specially crafted ELF file can cause a segmentation...

Debian DLA-666-1 : guile-2.0 security update

Several vulnerabilities were discovered in GNU Guile, an implementation of the Scheme programming language. The Common Vulnerabilities and Exposures project identifies the following issues. CVE-2016-8605: The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that...