OPENSUSE-SU-2018:0629-1 Security update for go1.8

This update for go1.8 fixes the following issues: Security issues fixed: - CVE-2018-6574: 'go get' allows for remote command execution during source code build bsc1080006. Bug fixes: - bsc1082409: Review dependencies requires, recommends and supports This update was imported from the...

PT-2018-1903

Name of the Vulnerable Software and Affected Versions Django versions 2.0 before 2.0.3 Django versions 1.11 before 1.11.11 Django versions 1.8 before 1.8.19 Description The issue is related to a catastrophic backtracking vulnerability in a regular expression used by the django.utils.text.Truncato...

SUSE SLED12 Security Update : zziplib (SUSE-SU-2018:0548-1)

This update for zziplib fixes the following issues: Version update to 0.13.67 contains lots of bug- and security fixes. - If an extension block is too small to hold an extension, do not use the information therein. - CVE-2018-6540: If the End of central directory record EOCD contains an Offset of...

SUSE-SU-2018:0373-1 Security update for libjpeg-turbo

This update for libjpeg-turbo fixes the following issues: Feature update: - Update from version 1.3.1 to version 1.5.2 fate324061. Security issue fixed: - CVE-2017-15232: Fix NULL pointer dereference in jdpostct.c and jquant1.c bsc1062937...

JVN#15643848: Spring Security and Spring Framework vulnerable to authentication bypass

Spring Framework and Spring Security provided by Pivotal Software, Inc. contain an authentication bypass vulnerability. Impact A remote attacker can bypass authentication. As a result, the attacker gains access to the server and information may be disclosed. Solution Update the Software Update to...

MGASA-2018-0082 Updated webkit2 packages fix security vulnerabilities

The webkit2 package has been updated to version 2.18.5, containing Spectre mitigations...

SUSE-SU-2018:0065-1 Fixing security issues on OBS toolchain

This OBS toolchain update fixes the following issues: Package 'build': - CVE-2017-14804: Improve file name check extractbuild bsc1069904 - Fixed Dockerfile repository parsing Package 'obs-service-sourcevalidator': - CVE-2017-9274: Don't use rpmbuild to extract sources, patches etc. from a spec...

MGASA-2018-0066 Updated python-mistune packages fix security vulnerabilities

mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline such as in java\nscript: or a crafted email address, related to the escape and autolink functions CVE-2017-15612. A cross-site-scripting vulnerability was found in python-mistune CVE-2017-16876...

MGASA-2018-0008 Updated ffmpeg packages fix security vulnerability

This update provides ffmpeg version 2.4.14, which fixes several security vulnerabilities and other bugs which were corrected upstream...

MGASA-2018-0005 Updated webkit2 packages fix security vulnerabilities

The webkit2 package has been updated to version 2.18.4, fixing several security issues and other bugs...

GHSA-H9MJ-FGHC-664W Denial of Service in mqtt

Affected versions of mqtt do not properly handle PUBLISH packets returning from the server, leading to a Denial of Service condition. The vulnerability is completely mitigated if the only connected servers are trusted, guaranteed not to be under the control of a malicious actor. Proof of Concept...

SUSE-SU-2017:3391-1 Security update for postgresql96

This update for postgresql96 fixes the following issues: Security issues fixed: - CVE-2017-15098: Fix crash due to rowtype mismatch in jsonbpopulaterecordset bsc1067844. - CVE-2017-15099: Ensure that INSERT ... ON CONFLICT DO UPDATE checks table permissions and RLS policies in all cases bsc106784...

Ability Mail Server 3.3.2 Cross Site Scripting

Exploit Title: Ability Mail Server 3.3.2 Persistent Cross Site Scripting XSS CVE: CVE-2017-17752 Date: 19-12-2017 Software Link: http://download.codecrafters.com/ams3.exe Exploit Author: Aloyce J. Makalanga Contact: https://twitter.com/aloycemjr Vendor Homepage: http://www.codecrafters.com...

PT-2017-11908 · Adobe +2 · Flash Player +2

Name of the Vulnerable Software and Affected Versions: Adobe Flash Player versions prior to 27.0.0.187 Description: A regression in Adobe Flash Player causes the unintended reset of the global settings preference file when a user clears browser data. This issue allows attackers to affect the...

MGASA-2017-0425 Updated webkit2 packages fix security vulnerabilities

The webkit2 package has been updated to version 2.18.3, fixing several security issues and other bugs...

Fedora 26 : apr (2017-8d2cfc3752)

Security fix + version update Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 ...

MGASA-2017-0376 Updated webmin packages fix security vulnerability

The webmin package has been updated to version 1.840, which fixes a cross-site scripting XSS issue, an issue due to improper escaping in the download module, and has other bug fixes and enhancements. See the upstream release announcements and change log for details...

CVE-2017-15568

CVE-2017-15568 affects Redmine prior to 3.2.8, 3.3.x prior to 3.3.5, and 3.4.x prior to 3.4.3. A cross-site scripting vulnerability exists in app/helpers/application_helper.rb triggered by a multi-value field during rendering of issue history. Connected sources confirm the issue and provide remed...

PowerDNS Products End of Life (EOL) Detection

The version of the PowerDNS product on the remote host has reached the End of Life EOL and should not be used anymore. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

OTRS End of Life (EOL) Detection - Linux

The OTRS version on the remote host has reached the end of life EOL and should not be used anymore. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...