The vulnerability of the Ubuntu operating system, which allows a hacker to load and execute arbitrary installation packages

The vulnerability of the Ubuntu operating system’s unattended upgrades is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to download and execute arbitrary installation packages when the force-control and force-confnew options are...

Debian Security Advisory DSA 3308-1 (mysql-5.5 - security update)

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.44. Please see the MySQL 5.5 Release Notes and Oracle OpenVAS Vulnerability Test $Id: deb3308.nasl 6609 2017-07-07 12:05:59Z cfischer $...

[slackware-security] httpd

New httpd packages are available for Slackware 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/httpd-2.4.16-i486-1slack14.1.txz: Upgraded. This update fixes the following security issues: CVE-2015-0253: Fix a crash with...

java-1.7.0-openjdk security update

1:1.7.0.85-2.6.1.2.0.1.el71 - Update DISTRONAME in specfile 1:1.7.0.85-2.6.1.2 - Bump upstream tarball to u25b01 to fix issue with 8075374 backport. - Resolves: rhbz1235158 1:1.7.0.85-2.6.1.1 - Update OpenJDK tarball so correct version is used. - Resolves: rhbz1235158 1:1.7.0.85-2.6.1.0 - Add...

CVE-2015-1330 Unattended-Upgrades Vulnerability | Cloud Foundry

CVE-2015-1330 Unattended-Upgrades Vulnerability Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description It was found that for some configurations, unattended-upgrades would not properly perform authentication checks on packages prior to installation. An attacker...

[SECURITY] [DSA 3297-1] unattended-upgrades security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3297-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini June 29, 2015 https://www.debian.org/security/faq -...

unattended-upgrades man-in-the-middle

Under some conditions package spoofing is possible...

DLA-267-1 unattended-upgrades - security update

Bulletin has no description...

[SECURITY] [DLA 265-1] unattended-upgrades security update

Package : unattended-upgrades Version : 0.62.2+squeeze1 CVE ID : CVE-2015-1330 Bug : LP: 1466380 It was discovered that unattended-upgrades, a script for automatic installation of security upgrades, did not properly authenticate downloaded packages when the force-confold or force-confnew dpkg...

Unattended-upgrades File Checksum Bypass Remote Arbitrary Code Execution Vulnerability

unattended-upgrades is an automatic update program. The unattended-upgrades system fails to properly verify downloaded files if the 'force-confold' or 'force-confnew' dpkg option is enabled via the DPkg::Options:: apt configuration, allowing an attacker to modify the package file and execute...

CVE-2015-1330

unattended-upgrades before 0.86.1 does not properly authenticate packages when the 1 force-confold or 2 force-confnew dpkg options are enabled in the DPkg::Options:: apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors...

CVE-2015-1330

unattended-upgrades before 0.86.1 does not properly authenticate packages when the 1 force-confold or 2 force-confnew dpkg options are enabled in the DPkg::Options:: apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors...

DEBIAN-CVE-2015-1330

unattended-upgrades before 0.86.1 does not properly authenticate packages when the 1 force-confold or 2 force-confnew dpkg options are enabled in the DPkg::Options:: apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors...

CVE-2015-1330

unattended-upgrades before 0.86.1 does not properly authenticate packages when the 1 force-confold or 2 force-confnew dpkg options are enabled in the DPkg::Options:: apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors...

CVE-2015-1330

CVE-2015-1330 affects unattended-upgrades prior to 0.86.1, where authentication of downloaded packages can be bypassed when DPkg::Options contains force-confold or force-confnew. This enables a remote MITM attacker to upload and install altered packages via unspecified vectors. Root cause: inadeq...

CVE-2015-1330

unattended-upgrades before 0.86.1 does not properly authenticate packages when the 1 force-confold or 2 force-confnew dpkg options are enabled in the DPkg::Options:: apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors...

Ubuntu: Security Advisory (USN-2657-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-3297-1 : unattended-upgrades - security update

It was discovered that unattended-upgrades, a script for automatic installation of security upgrades, did not properly authenticate downloaded packages when the force-confold or force-confnew dpkg options were enabled via the DPkg::Options:: apt configuration. %NASLMINLEVEL 70300 C Tenable Networ...

[SECURITY] [DSA 3297-1] unattended-upgrades security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3297-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini June 29, 2015 https://www.debian.org/security/faq -...

USN-2657-1 unattended-upgrades vulnerability

It was discovered that unattended-upgrades incorrectly performed authentication checks in certain configurations. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered packages...