qemu security update

CentOS Errata and Security Advisory CESA-2015:0867 An updated qemu-kvm package that fixes one security issue and one bug is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS...

Ubuntu 14.04 LTS : MySQL vulnerabilities (USN-2575-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2575-1 advisory. Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues. MySQL has been updated to...

Fedora 21 : ceph-deploy-1.5.23-1.fc21 (2015-5981)

Update to ceph-deploy 1.5.23. This fixes CVE-2015-3010 keyring permissions are world readable in ceph. See upstream changelog for detailed changes. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Debian DSA-3229-1 : mysql-5.5 - security update

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.43. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details : -...

Debian DLA-201-1 : tzdata new upstream version

Upstream published version 2015c, fixing the DST rule for Egypt. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Moderate: Red Hat Security Advisory: python-django-horizon and python-django-openstack-auth update

Updated python-django-horizon and python-django-openstack-auth packages that fix one security issue and multiple bugs are now available for Red Hat Enterprise Linux OpenStack Platform 5.0 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security...

Fedora 21 : tor-0.2.5.11-1.fc21 (2015-4725)

Update to upstream release 0.2.5.11. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 703...

openssl-fips security update

1.0.1m-2.0.1 - update to upstream 1.0.1m - update to fips canister 2.0.9 - regenerated below patches openssl-1.0.1-beta2-rpmbuild.patch openssl-1.0.1m-rhcompat.patch openssl-1.0.1m-ecc-suiteb.patch openssl-1.0.1m-fips-mode.patch openssl-1.0.1m-version.patch openssl-1.0.1m-evp-devel.patch...

Fedora 20 : libssh2-1.5.0-1.fc20 (2015-3791)

This update, to the current upstream release version, contains numerous bug fixes and enhancements as described in the RELEASE-NOTES file. These include a security fix for CVE-2015-1782 : A malicious attacker could man in the middle a real server and cause libssh2-using clients to crash denial of...

Mandriva Linux Security Advisory : readline (MDVSA-2015:132)

Updated readline packages fix security vulnerability : Steve Kemp discovered the rltropen function in readline insecurely handled a temporary file. This could allow a local attacker to perform symbolic link attacks CVE-2014-2524. Also, upstream patches have been added to fix an infinite loop in v...

CVE-2013-7437

Multiple integer overflows in potrace 1.11 allow remote attackers to cause a denial of service crash via large dimensions in a BMP image, which triggers a buffer overflow...

Debian DLA-40-1 : cacti security update

Multiple security issues cross-site scripting, missing input sanitizing and SQL injection have been discovered in Cacti, a web interface for graphing of monitoring systems. Furthermore, the fix for CVE-2014-4002 in the previous security update has been brought in-line with the upstream fix as it...

Debian DLA-126-1 : ettercap security update

Patches a bunch of security vulnerabilities : - CVE-2014-9380 Buffer over-read - CVE-2014-9381 Signedness error See: https://www.obrela.com/home/security-labs/advisories/osi -advisory-osi-1402/ Patches taken from upstream - 6b196e011fa456499ed4650a360961a2f1323818 pull/608 -...

Debian DLA-179-1 : tzdata new upstream version

Upstream published version 2015b. Changes since 2014h-0squeeze1 currently in squeeze-lts are the following : - New leap second 2015-06-30 23:59:60 UTC. - New DST for Mongolia. - New DST for Palestine. - New DST for Cancun Mexico. - New DST for Chile. - New DST for Fiji. - Time zone change for Tur...

Debian DLA-111-1 : cpio security update

Multiple issues have been identified in cpio, including a buffer overflow and multiple NULL pointer dereference, resulting at least in a denial of service and possibly also in an unwanted code execution. This has been fixed in Debian 6 Squeeze with version 2.11-4+deb6u1 by applying the upstream...

Debian DLA-74-1 : ppp security update

This updates fixes a potential integer overflow in option parsing. A user in the group 'dip' could provide a specially crafted configuration file of more than 2G and generate an integer overflow. This may enable an attacker to overwrite the heap and thereby corrupt security-relevant variables. Se...

Debian DLA-137-1 : libevent security update

The libevent library was vulnerable to a potential heap overflow in the buffer/bufferevent APIs. This update was prepared by Nguyen Cong who used the upstream-provided patch. Thanks to them! NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA securit...

Debian DLA-133-1 : unrtf security update

CVE-2014-9274 : check that accesses to color table stay within bounds Patches taken from upstream commits : - CVE-2014-9274: b0cef89a170a66bc48f8dd288ce562ea8ca91f7a CVE-2014-9275 : various crashes . - CVE-2014-9275: 1df886f2e65f7c512a6217588ae8d94d4bcbc63d 3c7ff3f888de0f0d957fe67b6bd4bec9c0d475f...

Debian DLA-118-1 : linux-2.6 security update

Non-maintainer upload by the Squeeze LTS and Kernel Teams. New upstream stable release 2.6.32.65, see http://lkml.org/lkml/2014/12/13/81 for more information. The stable release 2.6.32.65 includes the following new commits compared to the previous 2.6.32-48squeeze9 package : - USB: whiteheat: Add...

Fedora 22 : gnupg-1.4.19-1.fc22 (2015-2872)

New upstream v1.4.19 - Use ciphertext blinding for Elgamal decryption CVE-2014-3591 - Fixed data-dependent timing variations in modular exponentiation related to CVE-2015-0837 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security...