4308 matches found
MGASA-2016-0095 Updated squid packages fix security vulnerabilities
Updated squid packages fix security vulnerability: Due to incorrect bounds checking Squid is vulnerable to a denial of service attack when processing HTTP responses CVE-2016-2569, CVE-2016-2570, CVE-2016-2571...
MGASA-2016-0097 Updated graphite2 package fixes security vulnerabilities
Updated graphite2 packages fix security vulnerabilities: Multiple security flaws were found in the graphite2 font library. A web page or document containing malicious content could cause an application using graphite2 to crash or, potentially, execute arbitrary code with the privileges of the use...
MGASA-2016-0098 Updated xen packages fix security vulnerabilities
This xen update is based on upstream 4.5.2 maintenance release, and fixes the following security issues: The vgicv2tosgi function in arch/arm/vgic-v2.c in Xen 4.5.x, when running on ARM hardware with general interrupt controller GIC version 2, allows local guest users to cause a denial of service...
MGASA-2016-0094 Updated samba packages fix security vulnerabilities
Updated ldb and samba packages fix security vulnerabilities: A malicious client can send packets that cause the LDAP server in the samba daemon process to become unresponsive, preventing the server from servicing any other requests CVE-2015-3223. Versions of Samba from 3.0.0 to 4.3.2 inclusive ar...
MGASA-2016-0090 Updated tomcat packages fix security vulnerabilities
Updated tomcat packages fix security vulnerabilities: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 7.x before 7.0.65 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used b...
MGASA-2016-0089 Updated perl-FCGI packages fix CVE-2012-6687
Updated fcgi packages fix security vulnerability: FCGI does not perform range checks for file descriptors before use of the FDSET macro. This FDSET macro could allow for more than 1024 total file descriptors to be monitored in the closing state. This may allow remote attackers to cause a denial o...
MGASA-2016-0092 Updated phpmyadmin packages fix security vulnerabilities
Updated phpmyadmin package fixes security vulnerabilities: Multiple cross-site scripting XSS issues in phpMyAdmin before 4.4.15.5 CVE-2016-2560, CVE-2016-2561...
MGASA-2016-0091 Updated wireshark packages fix security vulnerabilities
Updated wireshark packages fix security vulnerabilities: ASN.1 BER dissector crash CVE-2016-2522. DNP dissector infinite loop CVE-2016-2523. X.509AF dissector crash CVE-2016-2524. HTTP/2 dissector crash CVE-2016-2525. HiQnet dissector crash CVE-2016-2526. 3GPP TS 32.423 Trace file parser crash...
MGASA-2016-0086 Updated asterisk packages fix CVE-2016-2316
Updated asterisk packages fix security vulnerability: chansip in Asterisk Open Source 11.x before 11.21.1, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service file descriptor consumption via vectors related to large...
MGASA-2016-0083 Updated vlc packages fix security vulnerabilities
Updated vlc packages fix security vulnerabilities: The vlc package has been updated to version 2.2.2, which fixes several bugs and possible security issues. See the NEWS file for details...
MGASA-2016-0080 Updated nodejs packages fix security vulnerability
A request smuggling vulnerability was found in Node.js that can be exploited under certain unspecified circumstances CVE-2016-2086. It was reported that HTTP header parsing in Node.js is vulnerable to response splitting attacks. While Node.js has been protecting against response splitting attacks...
MGASA-2016-0079 Updated glibc packages fix security vulnerabilities
Updated glibc fixes the following security issues: A stack overflow unbounded alloca could have caused applications which process long strings with the nan function to crash or, potentially, execute arbitrary code CVE-2014-9761. A stack-based buffer overflow in getaddrinfo allowed remote attacker...
MGASA-2016-0072 Updated libgcrypt packages fix security vulnerabilities
Updated libgcrypt packages fix security vulnerability: Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that the ECDH secret decryption keys in applications using the libgcrypt20 library could be leaked via a side-channel attack CVE-2015-7511. The libgcrypt package was also...
MGASA-2016-0063 Updated cpio packages fix CVE-2016-2037
Updated cpio package fixes security vulnerability: An out-of-bounds write in cpio was found in the parsing of cpio files, in the processcopyin function in src/copyin.c CVE-2016-2037...
MGASA-2016-0066 Updated python-pillow packages fix security vulnerability
A buffer overflow in TiffDecode.c causing an arbitrary amount of memory to be overwritten when opening a specially crafted invalid TIFF file CVE-2016-0740. A buffer overflow in FliDecode.c causing a segfault when opening FLI files CVE-2016-0775. A buffer overflow in PcdDecode.c causing a segfault...
MGASA-2016-0071 Updated thunar packages fix CVE-2013-7447
Updated thunar packages fix security vulnerability: Due to a logic error, an attempt to allocate a large block of memory fails in thunargdkcairosetsurface, leading to a crash of thunar CVE-2013-7447...
MGASA-2016-0067 Updated claws-mail packages fix CVE-2015-8708
Updated claws-mail fix security vulnerabilities A stack-based buffer overflow has been found in conveuctojis after applying incomplete patch for CVE-2015-8614. In conveuctojis the comparison is with outlen - 3, but each pass through the loop uses up to 5 bytes and the rest of the function may add...
MGASA-2016-0070 Updated eom packages fix CVE-2013-7447
Updated eom packages fix security vulnerability: Due to a logic error, an attempt to allocate a large block of memory fails in gdkcairosetsourcepixbuf, leading to a crash of eom CVE-2013-7447...
MGASA-2016-0076 Updated gnome-photos packages fix CVE-2013-7447
Updated gnome-photos package fixes security vulnerabilities: Due to a logic error, an attempt to allocate a large block of memory fails in createsurfacefrompixbuf, leading to a crash of gnome-photos CVE-2013-7447. A similar potential issue in viewhelperdraw in src/gegl-gtk-view-helper.c has also...
MGASA-2016-0078 Updated thunderbird packages fix security vulnerability
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird CVE-2016-1930, CVE-2016-1935. Multiple security flaws were foun...
MGASA-2016-0075 Updated gambas3 packages fix CVE-2013-7447
Updated gambas3 packages fix security vulnerability: Due to a logic error, an attempt to allocate a large block of memory fails in gtcairocreatesurface, leading to a crash of gambas3 CVE-2013-7447...
MGASA-2016-0074 Updated eog packages fix security vulnerability
Due to a logic error, an attempt to allocate a large block of memory fails in createsurfacefrompixbuf, leading to a crash of eog CVE-2013-7447...
MGASA-2016-0073 Updated pinpoint packages fix CVE-2013-7447
Updated pinpoint packages fix security vulnerability: Due to a logic error, an attempt to allocate a large block of memory fails in caironewsurfacefrompixbuf, leading to a crash of pinpoint CVE-2013-7447...
MGASA-2016-0059 Updated jasper packages fix CVE-2016-1867
Updated jasper packages fix security vulnerabilities: The jpcpinextcprl function in JasPer 1.900.1 allows remote attackers to cause a denial of service out-of-bounds read and application crash via a crafted JPEG 2000 image CVE-2016-1867...
MGASA-2016-0061 Updated nettle packages fix security vulnerabilities
Updated nettle2.7 and nettle packages fix security vulnerabilities: Two carry propagation bugs in elliptic curve scalar multiplications that affect the NIST P-256 curve. The bugs are in the C code and affect multiple architectures CVE-2015-8803, CVE-2015-8805. A carry propagation bug in elliptic...
MGASA-2016-0054 Updated mbedtls/hiawatha/belle-sip/linphone/pdns packages fix security vulnerability
Note: this package was called polarssl, but is now called mbed tls. The PolarSSL software is now called mbed TLS. Heap-based buffer overflow in mbed TLS formerly PolarSSL 1.3.x before 1.3.14 allows remote SSL servers to cause a denial of service client crash and possibly execute arbitrary code vi...
MGASA-2016-0055 Updated privoxy packages fix security vulnerabilities
This update fixes two denial-of-service vulnerabilities that have been discovered in privoxy 3.0.23: The removechunkedtransfercoding function in filters.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service invalid read and crash via crafted chunk-encoded content...
MGASA-2016-0056 Updated openssl packages fix security vulnerabilities
Updated openssl packages fix security vulnerability: OpenSSL before 1.0.2f would allow for a process to re-use the same private Diffie-Hellman exponent repeatedly during its entire lifetime, which, given that it also allows to use custom DH parameters which may be based on unsafe primes, could...
MGASA-2016-0049 Updated imlib2 packages fix security vulnerability
Various issues in imlib before 1.4.7 in the GIF loader CVE-2014-9762, CVE-2014-9764 and PNM loader CVE-2014-9763 could cause crashes. The imlib2 package has been updated to version 1.4.7, fixing these issues and several other bugs...
MGASA-2016-0044 Updated cakephp package fixes security vulnerability
CakePHP, an open-source web application framework for PHP, was vulnerable to SSRF Server Side Request Forgery attacks. Remote attacker can utilize it for at least DoS Denial of Service attacks, if the target application accepts XML as an input. It is caused by insecure design of Cake's Xml class...
MGASA-2016-0043 Updated docker/golang packages fix security vulnerability
Manipulated layer IDs could have lead to local graph poisoning CVE-2014-8178. Manifest validation and parsing logic errors allowed pull-by-digest validation bypass CVE-2014-8179. To fix these issues, the golang package has been updated to version 1.4.3 and the docker package has been updated to...
MGASA-2016-0051 Updated phpmyadmin/phpseclib packages fix security vulnerability
Password suggestion functionality uses Math.random which does not provide cryptographically secure random numbers CVE-2016-1927. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full pa...
MGASA-2016-0053 Updated socat packages fix security vulnerability
In socat before 2.0.0-b9, in the OpenSSL address implementation, the hard coded 1024 bit DH p parameter was not prime. It may be possible for an eavesdropper to recover the shared secret from a key exchange CVE-2016-2217. In socat before 2.0.0-b9, a stack overflow vulnerability was found that can...
MGASA-2016-0052 Updated krb5 packages fix security vulnerability
In all versions of MIT krb5, an authenticated attacker can cause kadmind to read beyond the end of allocated memory by sending a string without a terminating zero byte. Information leakage may be possible for an attacker with permission to modify the database CVE-2015-8629. In MIT krb5 1.12 and...
MGASA-2016-0048 Updated java-1.8.0-openjdk/copy-jdk-configs/lua-lunit/lua-posix packages fix security vulnerability
An out-of-bounds write flaw was found in the JPEG image format decoder in the AWT component in OpenJDK. A specially crafted JPEG image could cause a Java application to crash or, possibly execute arbitrary code. An untrusted Java application or applet could use this flaw to bypass Java sandbox...
MGASA-2016-0046 Updated gajim packages fix security vulnerability
Gajim before 0.16.5 doesn't verify the origin of roster pushes thus allowing third parties to modify the roster via a man-in-the-middle attack CVE-2015-8688...
MGASA-2016-0040 Updated owncloud packages fix security vulnerability
A Cross-site scripting XSS vulnerability in the OCS discovery provider in ownCloud Server before 8.0.10 allows remote attackers to inject arbitrary web script or HTML via the URL resulting in a reflected Cross-Site-Scripting CVE-2016-1498. ownCloud Server before 8.0.10 allows remote authenticated...
MGASA-2016-0038 Updated chrony packages fix security vulnerability
In chrony before 1.31.2, when used with symmetric key encryption, the client would accept packets encrypted with keys for any configured server, allowing a server to impersonate other servers to clients, thus performing a man-in-the-middle attack CVE-2016-1567...
MGASA-2016-0037 Updated srtp packages fix security vulnerability
Srtp before 1.5.3 is vulnerable to a potential DoS attack due to lack of bounds checking on RTP header CSRC count and extension header length CVE-2015-6360...
MGASA-2016-0039 Updated ntp packages fix security vulnerability
In ntpd before 4.2.8p6, when used with symmetric key encryption, the client would accept packets encrypted with keys for any configured server, allowing a server to impersonate other servers to clients, thus performing a man-in-the-middle attack. A server can be attacked by a client in a similar...
MGASA-2016-0035 Updated virtualbox packages fix security vulnerabilities
This update provides the virtualbox 5.0.14 maintenance release. It also fixes the following security issues: Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.3.36 and 5.0.14 allows remote attackers to affect availability via unknown...
MGASA-2016-0034 Updated dhcpcd packages fix security vulnerability
Possible heap overflow in dhcpcd before 6.10.0 caused by malformed dhcp responses due to incorrect option length values CVE-2016-1503. Possible invalid read in dhcpcd before 6.10.0 caused by malformed dhcp responses can lead to a crash CVE-2016-1504. The dhcpcd package has been updated to version...
MGASA-2016-0032 Updated kernel-tmb packages fix security vulnerability
Perception Point Research Team found a reference leak in keyring in joinsessionkeyring that can be exploited to successfully escalate privileges from a local user to root CVE-2016-0728. Other fixes in this kernel update: - netfilter: nfnatredirect: add missing NULL pointer check...
MGASA-2016-0033 Updated kernel packages fix security vulnerability
Perception Point Research Team found a reference leak in keyring in joinsessionkeyring that can be exploited to successfully escalate privileges from a local user to root CVE-2016-0728. Other fixes in this kernel update: - netfilter: nfnatredirect: add missing NULL pointer check...
MGASA-2016-0031 Updated kernel-linus packages fix security vulnerability
Perception Point Research Team found a reference leak in keyring in joinsessionkeyring that can be exploited to successfully escalate privileges from a local user to root CVE-2016-0728...
MGASA-2016-0027 Updated perl and perl-PathTools packages fix security vulnerability
It was reported that File::Spec::canonpath routine returns untainted strings even if passed tainted input. This defect undermines the guarantee of taint propagation, which is sometimes used to ensure that unvalidated user input does not reach sensitive code CVE-2015-8607...
MGASA-2016-0026 Updated encfs packages fix security vulnerability
A local attacker can utilize a possible buffer overflow in the encodeName method of StreamNameIO and BlockNameIO to execute arbitrary code or cause a Denial of Service. Also multiple weak cryptographics practices have been found in encfs CVE-2014-3462...
MGASA-2016-0025 Updated cacti packages fix security vulnerability
Several SQL injection vulnerabilities have been discovered in Cacti. Specially crafted input can be used by an attacker in the rraid value of the graph.php script to execute arbitrary SQL commands on the database CVE-2015-8369...
MGASA-2016-0030 Updated bind packages fix security vulnerability
In ISC BIND before 9.10.3-P3, a buffer size check used to guard against overflow could cause named to exit with an INSIST failure In apl42.c CVE-2015-8704. In ISC BIND before 9.10.3-P3, errors can occur when OPT pseudo-RR data or ECS options are formatted to text. In 9.10.3 through 9.10.3-P2, the...
MGASA-2016-0028 Updated dhcp packages fix security vulnerability
A badly formed packet with an invalid IPv4 UDP length field can cause an ISC DHCP server, client, or relay program to terminate abnormally CVE-2015-8605. The dhcp package has been updated to version 4.3.3-P1, which fixes this issue and several other bugs. Also, the package has also been enhanced ...