6321 matches found
Updated libnl3 packages fix security vulnerability
An elevation of privilege vulnerability in the libnl library could enable a local malicious application to execute arbitrary code within the context of a privileged process CVE-2017-0386. An integer overflow vulnerability was found in nlmsgreserve triggered by crafted @len argument resulting into...
Updated nss packages fix security vulnerability
A null pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library CVE-2017-7502...
Updated menu-cache packages fix security vulnerability
Libmenu-cache 1.0.2 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service menu unavailability. CVE-2017-8933...
Updated git packages fix security vulnerability
Timo Schmid of ERNW GmbH discovered that the Git git-shell, a restricted login shell for Git-only SSH access, allows a user to run an interactive pager by causing it to spawn "git upload-pack --help" CVE-2017-8386...
Updated pcmanfm packages fix security vulnerability
PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service application unavailability. CVE-2017-8934...
Updated openvpn packages fix security vulnerability
It was discovered that OpenVPN improperly triggered an assert when receiving an oversized control packet in some situations. A remote attacker could use this to cause a denial of service server or client crash CVE-2017-7478. It was discovered that OpenVPN improperly triggered an assert when packe...
Updated perl-Image-Info packages fix security vulnerability
A crafted SVG file could have caused information disclosure or denial of service by using external entitity expansion XXE. This is a potentially incompatible change; however usually SVG files do not rely on XXE CVE-2016-9181...
Updated vlc packages fix security vulnerability
The VLC packages have been updated to version 2.2.6, which includes various security improvements in demuxers, as well as other bug fixes...
Updated perl-CGI-Emulate-PSGI packages fix security vulnerability
This update removes the setting of the HTTPPROXY environment value. This works around the httproxy vulnerability aka CVE-2016-5387...
Updated kernel packages fixes security vulnerabilities
This kernel update is based on upstream 4.4.68 and fixes at least the following security issues: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers to cause a denial of service system crash via a long RPC reply, related to net/sunrpc/svc.c,...
Updated kernel-tmb packages fixes security vulnerabilities
This kernel-tmb update is based on upstream 4.4.68 and fixes at least the following security issues: fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service memory consumption and deadloc...
Updated kernel-linus packages fixes security vulnerabilities
This kernel-linus update is based on upstream 4.4.68 and fixes at least the following security issues: fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service memory consumption and...
Updated samba packages fix security vulnerability
A flaw was found in the way Samba handled PAC Privilege Attribute Certificate checksums. A remote, authenticated attacker could use this flaw to crash the winbindd process CVE-2016-2126. Jann Horn discovered that Samba incorrectly handled symlinks. An authenticated remote attacker could use this...
Updated webmin packages fix security vulnerability
The webmin package has been updated to version 1.840, which fixes cross-site scripting XSS issues, and has other bug fixes and enhancements. See the upstream release announcements and change log for details...
Updated vlc packages fix security vulnerability
The VLC packages have been updated to version 2.2.5.1, which includes various security improvements in demuxers and decoders, as well as other bug fixes...
Updated flash-player-plugin packages fix security vulnerability
Adobe Flash Player 25.0.0.171 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system. This updates resolves a use-after-free vulnerability that could lead to code execution CVE-2017-3071. This...
Updated mhonarc packages fix security vulnerability
MHonArc before 2.6.19 is vulnerable to PHP code injection via commentized subjects. This update fixes it...
Updated radicale package fixes security vulnerability
Radicale before 1.1.2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method CVE-2017-8342...
Updated lxterminal package fixes security vulnerability
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service preventing terminal launch, or possibly have other impact bypassing terminal access control. CVE-2016-10369...
Updated kernel packages fixes security vulnerabilities
This kernel update is based on upstream 4.4.65 and fixes at least the following security issues: fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service memory consumption and deadlock vi...
Updated thunderbird packages fix security vulnerability
Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird CVE-2017-5429, CVE-2017-5432, CVE-2017-5433, CVE-2017-5434,...
Updated feh package fixes security vulnerability
Updated feh package to fix a double-free/OOB-write in E17 IPC. This was a potential security issue as a malicious X11 app running alongside feh and pretending to be an E17 window manager could have had access to out-of-bound memory. Security vulnerability: CVE-2017-7875...
Updated ntp packages fix security vulnerability
A vulnerability was found in NTP, in the legacy MX4200 refclock implementation. If this refclock was compiled in and used, an attacker may be able to induce stack overflow, leading to a crash or potential code execution CVE-2017-6451. A vulnerability was found in NTP, in the building of response...
Updated virtualbox packages fixes security vulnerabilities
This update provides virtualbox 5.1.22 maintenance release and resolves at least the following security issues: A vulnerability in the core subcomponent of virtualbox allows high privilegied attacker unauthorized read access to a subset of VirtualBox accessible data CVE-2017-3513. A vulnerability...
Updated ghostscript packages fix security vulnerability
Various userparams in Ghostscript allow %pipe% in paths, allowing remote shell command execution CVE-2016-7976. The .libfile function in Ghostscript doesn't check PermitFileReading array, allowing remote file disclosure CVE-2016-7977. Reference leak in the .setdevice function in Ghostscript allow...
Updated libarchive packages fix security vulnerabilities
The archivewstringappendfrommbs function in archivestring.c in libarchive 3.2.2 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted archive file. CVE-2016-10209 The archivele32dec function in archiveendian.h in libarchive 3.2.2 allows...
Updated ettercap packages fix security vulnerability
Etterfilter utility of Ettercap have an out-of-bounds read denial-of-service vulnerability when parsing a crafted file. This occurs in the compiletree function of the efcompiler.c source file when processing corrupted filters CVE-2017-6430...
Updated libsamplerate packages fix security vulnerability
It was discovered that libsamplerate contained a global buffer overflow in calcoutputsingle CVE-2017-7697...
Updated audiofile packages fix security vulnerabilities
Several vulnerabilities have been discovered in the audiofile library, which may result in denial of service or the execution of arbitrary code if a malformed audio file is processed CVE-2017-6827, CVE-2017-6828, CVE-2017-6829, CVE-2017-6830, CVE-2017-6831, CVE-2017-6832, CVE-2017-6833,...
Updated minicom packages fix security vulnerability
In minicom before version 2.7.1, the escparms buffer in vt100.c is vulnerable to an overflow that may allow for remote code execution CVE-2017-7467...
Updated texlive packages fix security vulnerability
It was discovered that texlive whitelists mpost as an external program to be run from within the TeX source code called \write18. Since mpost allows to specify other programs to be run, an attacker can take advantage of this flaw for arbitrary code execution when compiling a TeX document...
Updated python-lshell package fixes security vulnerabilities
Shell outbreak due to bad syntax parse CVE-2016-6902. Shell outbreak with multiline commands CVE-2016-6903...
Updated freetype2 packages fix security vulnerability
It was discovered that a heap-based buffer overflow existed in the FreeType library. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash, resulting in a denial of service, or possibly execute arbitrary code CVE-2016-10328. FreeType 2...
Updated openjpeg packages fix security vulnerability
Multiple integer overflows in the opjtcdinittile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allow remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via crafted JPEG 2000 data. CVE-2016-51...
Updated 389-ds-base packages fix security vulnerability
An invalid pointer dereference flaw was found in the way 389-ds-base handled LDAP bind requests. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service. CVE-2017-2668...
Updated libxslt packages fix security vulnerability
Holger Fuhrmannek discovered an integer overflow in the xsltAddTextString function in Libxslt. An attacker could use this to craft a malicious document that, when opened, could cause a denial of service application crash or possible execute arbitrary code CVE-2017-5029...
Updated squirrelmail packages fix security vulnerability
Squirrelmail version 1.4.22 and probably prior is vulnerable to a remote code execution vulnerability because it fails to sanitize a string before passing it to a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server CVE-2017-7692...
Updated xstream packages fix security vulnerability
A vulnerability was found in XStream. Parsing a maliciously crafted file could cause the application to crash. The processed stream at unmarshalling type contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. Th...
Updated java-1.8.0-openjdk packages fix security vulnerability
An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges CVE-2017-3511. It was found that the JAXP component of...
Updated tomcat packages fix security vulnerability
A bug in the handling of the pipelined requests when send file was used resulted in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests...
Updated firefox packages fix security vulnerability
An out-of-bounds write flaw was found in the way NSS performed certain Base64-decoding operations. An attacker could use this flaw to create a specially crafted certificate which, when parsed by NSS, could cause it to crash or execute arbitrary code, using the permissions of the user running an...
Updated icu packages fix security vulnerability
It was discovered that icu did not correctly validate its input. An attacker could use this problem to trigger an out-of-bound write through a heap-based buffer overflow, thus causing a denial of service via application crash, or potential execution of arbitrary code CVE-2017-7867, CVE-2017-7868...
Updated proftpd packages fix security vulnerability
ProFTPD before 1.3.5e controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowChrootSymlinks. Attackers with local access could bypass the AllowChrootSymlinks...
Updated chromium-browser-stable packages fix security vulnerability
Chromium-browser 57.0.2987.133 fixes security issues: Multiple flaws were found in the way Chromium 55 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information...
Updated wireshark packages fix security vulnerability
The wireshark package has been updated to version 2.0.12, which fixes multiple security issues where a malformed packet trace could cause it to crash or go into an infinite loop, and fixes several other bugs as well. See the release notes for details...
Updated flash-player-plugin package fixes security vulnerability
This update fixes the following critical security issues: use-after-free vulnerabilities that could lead to code execution CVE-2017-3058, CVE-2017-3059, CVE-2017-3062, CVE-2017-3063. memory corruption vulnerabilities that could lead to code execution CVE-2017-3060, CVE-2017-3061, CVE-2017-3064...
Updated gimp packages fix security vulnerability
Context-dependent attackers were able to cause a denial of service via an ICO file with an InfoHeader containing a Height of zero CVE-2007-3126...
Updated mediawiki packages fix security vulnerability
API parameters may now be marked as "sensitive" to keep their values out of the logs CVE-2017-0361. "Mark all pages visited" on the watchlist now requires a CSRF token CVE-2017-0362. Special:UserLogin and Special:Search allow redirect to interwiki links CVE-2017-0363, CVE-2017-0364. XSS in...