Updated webmin packages fix security vulnerability

Updated webmin package fixes security vulnerability: Webmin before 1.930 allows remote exploits if the option to change expired passwords is enabled CVE-2019-15107. Note that it is only vulnerable if changing of expired passwords is enabled, which is not the case by default...

Updated cronie packages fix security vulnerabilities

Updated cronie packages fix security vulnerabilities: Cronie before 1.5.3 allows local users to cause a denial of service daemon crash via a large crontab file because the calloc return value is not checked CVE-2019-9704. Cronie before 1.5.3 allows local users to cause a denial of service memory...

Updated mumble packages fix security vulnerability

It was discovered that insufficient restrictions in the connection handling of Mumble, a low latency encrypted VoIP client, could result in denial of service CVE-2018-20743...

Updated ocaml packages fix security vulnerability

The camlbadeserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service memory corruption or possibly execute arbitrar...

Updated irssi packages fix security vulnerability

It was discovered that Irssi incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service or to execute arbitrary code CVE-2019-5882...

Updated mbedtls packages fix security vulnerabilities

Updated mbedtls package fixes security vulnerabilities: Fixed a vulnerability in the TLS ciphersuites based on use of CBC and SHA-384 in DTLS/TLS 1.0 to 1.2, that allowed an active network attacker to partially recover the plaintext of messages under certains conditions by exploiting timing...

Updated mediawiki packages fix security vulnerabilities

Updated mediawiki packages fix security vulnerabilities: '$wgRateLimits' entry for 'user' overrides 'newbie' CVE-2018-0503. When a log event is partially hidden Special:Redirect/logid can link to the incorrect log and reveal hidden information CVE-2018-0504. BotPasswords can bypass CentralAuth's...

Updated vlc packages fix security vulnerability

This update provides vlc 3.0.4 and fixes at least the following security issue: A use-after-free was discovered in the MP4 demuxer of the VLC media player, which could result in the execution of arbitrary code if a malformed media file is played CVE-2018-11529 For other fixes in this update, see...

Updated librsvg packages fix a security vulnerability

Updated librsvg package fixes security vulnerability: It was discovered that there was an input validation vulnerability in the librsvg renderer library that could result in data being leaked to remote attackers via a specially-crafted file CVE-2018-1000041...

Updated webkit2 packages fix security vulnerabilities

Updated webkit2 packages fix security vulnerabilities: The webkit2 package has been updated to version 2.20.2, fixing several security issues and other bugs...

Updated transmission packages fix a security vulnerability

Updated transmission packages fix security vulnerability: Tavis Ormandy discovered a vulnerability in the Transmission BitTorrent client; insecure RPC handling between the Transmission daemon and the client interfaces may result in the execution of arbitrary code if a user visits a malicious...

Updated ming packages fix security vulnerabilities

The readString function in util/read.c and util/old/read.c in libming 0.4.8 allows remote attackers to cause a denial of service via a large file that is mishandled by listswf, listaction, etc. This occurs because of an integer overflow that leads to a memory allocation error. CVE-2017-8782 The...

Updated redis packages fix security vulnerability

The following vulnerabilities were fixed: - Buffer overflows occurring reading redis.conf bsc1061967 The following bugs are fixed: - Several PSYNC2 bugs could cause data corruption...

Updated backintime packages fix security vulnerability

backintime aka Back in Time before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft...

Updated gnome-shell packages fix security vulnerability

gnome-shell through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications but not interact with them, see information from the extensions e.g., what applications you have open...

Updated libexif packages fix security vulnerability

A vulnerability was found in libexif. The vulnerability is caused by an integer overflow. In some cases, the integer overflow can cause Heap Out-of-Bounds Read, i.e. Heap Buffer Overflow vulnerability. In some other cases, the integer overflow can cause use of uninitialized pointer variable, i.e...

Updated varnish packages fix security vulnerability

vbfstperror in bin/varnishd/cache/cachefetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote attackers to obtain sensitive information from process memory because a VFPGetStorage buffer is larger than intended in certain circumstances involving -sfile Stevedore...

Updated git packages fix security vulnerability

The git subcommand cvsserver is a Perl script which makes excessive use of the backtick operator to invoke git. Unfortunately user input is used within some of those invocations, which can be a OS Command Injection vulnerability CVE-2017-14867...

Updated potrace packages fix security vulnerability

Potrace 1.14 has a heap-based buffer over-read in the interpolatecubic function in mkbitmap.c CVE-2017-12067...

Updated kauth and kdelibs4 packages fix security vulnerability

Sebastian Krahmer from SUSE discovered that the KAuth framework contains a logic flaw in which the service invoking dbus is not properly checked. This flaw allows spoofing the identity of the caller and gaining root privileges from an unprivileged account CVE-2017-8422...

Updated swftools package fixes security vulnerability

In SWFTools 0.9.2, an out-of-bounds write of heap data can occur in the function pngload in lib/png.c. This issue can be triggered by a malformed PNG file that is mishandled by png2swf. Attackers could exploit this issue for DoS; it might cause arbitrary code execution CVE-2017-8400...

Updated sane packages fix security vulnerability

saned could have leaked uninitialized memory back to its requesters for some opcodes, allowing for information disclosure of saned memory CVE-2017-6318...

Updated git packages fix security vulnerability

Timo Schmid of ERNW GmbH discovered that the Git git-shell, a restricted login shell for Git-only SSH access, allows a user to run an interactive pager by causing it to spawn "git upload-pack --help" CVE-2017-8386...

Updated flash-player-plugin packages fix security vulnerability

flash-player-plugin update fixes the following issues: A type confusion vulnerability that could lead to code execution CVE-2017-2995. An integer overflow vulnerability that could lead to code execution CVE-2017-2987. Use-after-free vulnerabilities that could lead to code execution CVE-2017-2982,...

Updated wireshark packages fix security vulnerability

The wireshark package has been updated to version 2.0.11, which fixes two security issues where a malformed packet trace could cause it to crash or go into an infinite loop, and fixes several other bugs as well. See the release notes for details...

Updated gstreamer packages fix security vulnerability

Out of bounds heap read in windowsicontypefind in gst/typefind/gsttypefindfunctions.c CVE-2016-9811...

Updated tar packages fix security vulnerability

Harry Sintonen discovered that GNU tar does not properly handle member names containing '..', thus allowing an attacker to bypass the path names specified on the command line and replace files and directories in the target directory CVE-2016-6321...

Updated flash-player-plugin package fixes security vulnerabilities

Adobe Flash Player 11.2.202.637 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system. This update resolves a type confusion vulnerability that could lead to code execution CVE-2016-6992. This...

Updated ruby packages fix a security vulnerability

A bug in openssl module caused using an all 0 IV for AES-GCM ciphers in some cases when setting a key, an iv, and then setting a key a again CVE-2016-779...

Applications using libtorrent-rasterbar are vulnerable to denial of service

Applications using libtorrent-rasterbar are vulnerable to denial of service. An attacker-controlled torrent tracker can crash victim torrent clients by sending malformed GZIP responses CVE-2016-7164...

Updated flash-player-plugin packages fix security vulnerability

Adobe Flash Player 11.2.202.635 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system. This update resolves an integer overflow vulnerability that could lead to code execution CVE-2016-4287. Th...

Updated perl-DBD-mysql packages fix security vulnerability

Two use-after-free vulnerabilities were discovered in DBD::mysql. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using DBD::mysql application crash, or potentially to execute arbitrary code with the privileges of the user running the...

Updated krb5 packages fix security vulnerability

The validateasrequest function in kdcutil.c in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 before 1.14.3, when restrictanonymoustotgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service NULL pointer dereference a...

Updated libupnp packages fix security vulnerability

libupnp's default behavior allows an unauthenticated user access to a server's filesystem through POST and GET requests CVE-2016-6255...

Updated gimp packages fix security vulnerability

It was discovered that there was a use-after-free vulnerability in the channel and layer properties parsing process in GIMP CVE-2016-4994...

Updated vlc/mad packages fix security vulnerability

A vulnerability was found in processing QuickTime IMA files. VLC does not check that the number of channels in the input stream is less than or equal to the size of the buffer, resulting in an out-of-bounds write potential for remote code execution via a malicious media file CVE-2016-5108. The vl...

Updated apache-mod_nss packages fix CVE-2016-3099

Updated apache-modnss package fixes security vulnerability: Attempting to exclude ciphers from the list of accepted ciphers to use may not work as expected CVE-2016-3099...

Updated python-pillow packages fix CVE-2016-3076

This update fixes an integer overflow in Jpeg2KEncode.c causing a buffer overflow CVE-2016-3076...

Updated quagga packages fix security vulnerability

A vulnerability was found in a way VPNv4 NLRI parser copied packet data to the stack. Memcpy to stack data structure based on length field from packet data whose length field upper-bound was not properly checked CVE-2016-2342...

Updated phpmyadmin packages fix security vulnerabilities

Updated phpmyadmin package fixes security vulnerabilities: Multiple cross-site scripting XSS issues in phpMyAdmin before 4.4.15.5 CVE-2016-2560, CVE-2016-2561...

Updated cyrus-imapd packages fix security vulnerability

Cyrus-imapd versions 2.4.18 and earlier are vulnerable to potential integer and buffer overflows CVE-2015-8077, CVE-2015-8078...

Updated perl and perl-PathTools packages fix security vulnerability

It was reported that File::Spec::canonpath routine returns untainted strings even if passed tainted input. This defect undermines the guarantee of taint propagation, which is sometimes used to ensure that unvalidated user input does not reach sensitive code CVE-2015-8607...

Updated audiofile packages fixes security vulnerability

When libaudiofile is used to change both the number of channels of an audio file e.g. from stereo to mono and the sample format e.g. from 16-bit samples to 8-bit samples, the output file will contain corrupted data. If the new sample format is smaller than the old one, there is a risk of buffer...

Updated gnupg packages fix security vulnerabilities

Updated gnupg and gnupg2 packages fix security vulnerabilities: Hanno Böck discovered that GnuPG incorrectly handled certain malformed keyrings. If a user or automated system were tricked into opening a malformed keyring, a remote attacker could use this issue to cause GnuPG to crash, resulting i...

Updated libuser package fixes security vulnerabilities

Two flaws were found in the way the libuser library handled the /etc/passwd file. A local attacker could use an application compiled against libuser for example, userhelper to manipulate the /etc/passwd file, which could result in a denial of service or possibly allow the attacker to escalate the...

Updated xbmc packages fix CVE-2015-3885

Updated xbmc package fixes security vulnerability: The dcraw tool suffers from an integer overflow condition which lead to a buffer overflow. The vulnerability concerns the 'len' variable, parsed without validation from opened images, used in the ljpegstart function. A maliciously crafted raw ima...

Updated darktable packages fix CVE-2015-3885

Updated darktable package fixes security vulnerability The dcraw tool bundled in darktable's libraw copy suffers from an integer overflow condition which leads to a buffer overflow. A maliciously crafted raw image file can be used to trigger the vulnerability, causing a Denial of Service conditio...

Updated mailman packages fix security vulnerabilities

Updated mailman packages fix security vulnerability: A path traversal vulnerability was discovered in Mailman. Installations using a transport script such as postfix-to-mailman.py to interface with their MTA instead of static aliases were vulnerable to a path traversal attack. To successfully...

Updated tor packages fix security vulnerabilities

"disgleirio" discovered that a malicious client could trigger an assertion failure in a Tor instance providing a hidden service, thus rendering the service inaccessible CVE-2015-2928. "DonnchaC" discovered that Tor clients would crash with an assertion failure upon parsing specially crafted hidde...

Updated less packages fix CVE-2014-9488

Updated less package fixes security vulnerability: Malformed UTF-8 data could have caused an out of bounds read in the UTF-8 decoding routines, causing an invalid read access CVE-2014-9488...