MGASA-2017-0064 Updated kernel-tmb packages fixes security vulnerabilities

This kernel-tmb update is based on upstream 4.4.50 and fixes at least the following security issues: The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service system hang by leveraging access to ...

MGASA-2017-0061 Updated libpcap/tcpdump packages fix security vulnerability

The AH parser in tcpdump before 4.9.0 has a buffer overflow in print-ah.c:ahprint. CVE-2016-7922 The ARP parser in tcpdump before 4.9.0 has a buffer overflow in print-arp.c:arpprint. CVE-2016-7923 The ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-atm.c:oamprint. CVE-2016-7924...

MGASA-2017-0062 Updated spice packages fix security vulnerability

An authenticated attacker could send crafted messages to the spice server causing a heap overflow leading to a crash or possible code execution. CVE-2016-9577 An attacker able to connect to the spice server could send crafted messages which would cause the process to crash. CVE-2016-9578...

MGASA-2017-0060 Updated ruby-archive-tar-minitar packages fix security vulnerability

Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. dot dot in a TAR archive entry. CVE-2016-10173 Moreover the updated packages replace deprecated requiregem by gem to make minitar wo...

MGASA-2017-0059 Updated iceape packages fix security vulnerability

Updated Iceape packages derived from Seamonkey include security fixes from Mozilla Firefox: Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Seamonkey before 2.46 allows remote attackers to cause a denial of service boolean out-of-bounds write or possib...

MGASA-2017-0057 Updated gtk-vnc packages fix security vulnerability

It was found that gtk-vnc code does not properly check boundaries of subrectangle-containing tiles. A malicious server can use this to overwrite parts of the client memory CVE-2017-5884. In addition, the vncconnectionservermessage and vnccolormapset functions do not check for integer overflow...

MGASA-2017-0053 Updated gnutls packages fix security vulnerability

Remote denial of service in SSL alert handling. CVE-2016-8610 In gnutlsx509extimportproxy: if the language was set but the policy wasn't, that could lead to a double free. CVE-2017-5334 Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows. CVE-2017-5335,...

MGASA-2017-0058 Updated netpbm packages fix security vulnerability

Version 10.73.07 fixes security vulnerabilities: Out-of-bounds write in writeRasterPbm CVE-2017-2581 Out-of-bounds read in expandCodeOntoStack CVE-2017-2579 Out-of-bounds write of heap data in addPixelToRaster CVE-2017-2580 Null pointer dereference in stringToUint CVE-2017-2586 Insufficient size...

MGASA-2017-0056 Updated libarchive packages fix security vulnerability

An error in the lhareadfileheader1 function archivereadsupportformatlha.c in libarchive 3.2.2 allows remote attackers to trigger an out-of-bounds read memory access and subsequently cause a crash via a specially crafted archive. CVE-2017-5601...

MGASA-2017-0055 Updated libgd packages fix security vulnerability

OOB reads of the TGA decompression buffer CVE-2016-6906. Double-free in gdImageWebPtr CVE-2016-6912. gdImageCreate doesn't check for oversized images and as such is prone to DoS vulnerabilities CVE-2016-9317. Potential unsigned underflow in gdinterpolation.c CVE-2016-10166. DOS vulnerability in...

MGASA-2017-0052 Updated lynx packages fix security vulnerability

Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host. CVE-2016-9179...

MGASA-2017-0054 Updated mariadb packages fix security vulnerability

Root Privilege Escalation CVE-2016-6664. Unspecified vulnerability affecting the Optimizer component CVE-2017-3238. Unspecified vulnerability affecting the Charsets component CVE-2017-3243. Unspecified vulnerability affecing the DML component CVE-2017-3244. Unspecified vulnerability affecting...

MGASA-2017-0051 Updated openjpeg2 packages fix security vulnerabilities

Floating Point Exception aka FPE or divide by zero in opjpinextcprl function in openjp2/pi.c:523 in OpenJPEG 2.1.2. CVE-2016-9112 There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. image-comps0.data is not assigned a value after initializationNULL...

MGASA-2017-0050 Updated tomcat packages fix security vulnerability

It was discovered that incorrect error handling in the NIO HTTP connector of the Tomcat servlet and JSP engine could result in information disclosure CVE-2016-8745...

MGASA-2017-0048 Updated viewvc packages fix security vulnerability

Thomas Gerbet discovered that viewvc, a web interface for CVS and Subversion repositories, did not properly sanitize user input. This problem resulted in a potential Cross-Site Scripting vulnerability CVE-2017-5938. The viewvc package has been updated to version 1.1.26 which fixes this issue...

MGASA-2017-0049 Updated jitsi packages fix security vulnerability

An incorrect implementation of XEP-0280: Message Carbons in Jitsi and other XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks CVE-2017-5603...

MGASA-2017-0047 Updated calibre packages fix security vulnerability

Newer devices like Kobo Aura HD requires newer versions of calibre for their new firmwares. Current calibre package does not support them. Also, our current calibre packages in both core and backports repositories have a security issue CVE-2016-10187. Newer versions of calibre 2.75.0 + fixes this...

MGASA-2017-0046 Updated audacious-plugins packages fix security vulnerability

Chris Evans discovered that incorrect emulation of the SPC700 audio co-processor of the Super Nintendo Entertainment System allows the execution of arbitrary code if a malformed SPC music file is opened CVE-2016-9957, CVE-2016-9958, CVE-2016-9959, CVE-2016-9960, CVE-2016-9961. These issues were...

MGASA-2017-0045 Updated nagios packages fix security vulnerabilities

The nagios package has been patched to fix the following issues: Improper sanitization of RSS feed input enables unauthenticated remote read and write of arbitrary files CVE-2016-9565. Unsafe logfile handling allows unprivileged users to escalate their privileges to root CVE-2016-9566...

MGASA-2017-0043 Updated irssi-otr packages fix security vulnerability

It was discovered that irssi-otr had a flaw in handing data returned by libotr. After the initiation of the OTR session only the first line was sent as a PRIVMSG, while additional data would be sent as raw commands to the IRC server. The additional data would ordinarily be a human-readable...

MGASA-2017-0044 Updated icoutils packages fix security vulnerability

Multiple programming errors in the wrestool tool of the icoutils suite allows denial of service or the execution of arbitrary code if a malformed binary is parsed CVE-2017-5208, CVE-2017-5331, CVE-2017-5332, CVE-2017-5333...

MGASA-2017-0041 Updated java-1.8.0-openjdk packages fix security vulnerabilities

It was discovered that the RMI registry and DCG implementations in the RMI component of OpenJDK performed deserialization of untrusted inputs. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application CVE-2017-3241. This...

MGASA-2017-0042 Updated openssl packages fix security vulnerability

There is a carry propagation bug in the Broadwell-specific Montgomery multiplication procedure that handles input lengths divisible by, but longer than 256 bits. mong EC algorithms only Brainpool P-512 curves are affected and one presumably can attack ECDH key negotiation CVE-2016-7055. If an...

MGASA-2017-0040 Updated php packages fix security vulnerabilities

Floating-point exception in php-exif when parsing a tag format CVE-2016-10158. Crash in php-phar while loading hostile phar archive CVE-2016-10159. Memory corruption in php-phar when loading hostile phar CVE-2016-10160. Heap out of bounds read on unserialize in finishnesteddata CVE-2016-10161...

MGASA-2017-0039 Updated thunderbird packages fix security vulnerabilities

JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. CVE-2017-5375 Use-after-free while manipulating XSL in XSLT documents. CVE-2017-5376 Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks...

MGASA-2017-0038 Updated phpmyadmin packages fix security vulnerabilities

Multiple vulnerabilities in setup script CVE-2016-6621 / PMASA-2016-44. Open redirect PMASA-2017-1. php-gettext code execution CVE-2015-8980 / PMASA-2017-2. DOS vulnerability in table editing PMASA-2017-3. CSS injection in themes PMASA-2017-4. SSRF in replication PMASA-2017-6. DOS in replication...

MGASA-2017-0037 Updated openafs packages fix security vulnerability

Due to incomplete initialization or clearing of reused memory, OpenAFS directory objects are likely to contain "dead" directory entry information. This extraneous information is not active - that is, it is logically invisible to the fileserver and client. However, the leaked information is...

MGASA-2017-0036 Updated pdns-recursor packages fix security vulnerability

Florian Heinz and Martin Kluge reported that pdns-recursor parses all records present in a query regardless of whether they are needed or even legitimate, allowing a remote, unauthenticated attacker to cause an abnormal CPU usage load on the pdns server, resulting in a partial denial of service i...

MGASA-2017-0034 Updated wireshark packages fix security vulnerabilities

The wireshark package has been updated to version 2.0.10, which fixes two security issues where a malformed packet trace could cause it to go into an infinite loop, and fixes several other bugs as well. See the release notes for details...

MGASA-2017-0033 Updated pdns packages fix security vulnerabilities

Mathieu Lafon discovered that pdns does not properly validate records in zones. An authorized user can take advantage of this flaw to crash server by inserting a specially crafted record in a zone under their control and then sending a DNS query for that record CVE-2016-2120. Florian Heinz and...

MGASA-2017-0032 Updated python-pycrypto packages fix security vulnerabilities

This is a security fix for a possible Buffer overflow. AES.new with invalid parameter crashes python. The IV parameter is currently ignored when initializing a cipher in ECB or CTR mode. There was a bug in pycrypto which could be exploited to get a shell...

MGASA-2017-0035 Updated libxpm packages fix security vulnerability

An out of boundary write has been found in libXpm before 3.5.12 which can be exploited by an attacker through maliciously crafted XPM files. To trigger the vulnerability, a program must explicitly request to also parse XPM extensions while reading files. The motif toolkit and xdm are two among so...

MGASA-2017-0031 Updated python-bottle packages fix security vulnerability

redirect in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect"233\r\nSet-Cookie: name=salt" call. CVE-2016-9964...

MGASA-2017-0030 Updated mbedtls packages fix security vulnerability

The mbedtls package has been updated to version 1.3.18, which removes a non-default configuration option that could lead to session key recovery in very long TLS sessions and fixes a potential stack corruption that cannot be triggered remotely. It also fixes several bugs. See the upstream release...

MGASA-2017-0029 Updated opus packages fix security vulnerability

A remote code execution vulnerability in silk/NLSFstabilize.c in libopus could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing CVE-2017-0381...

MGASA-2017-0025 Updated nvidia-current & ldetect-lst packages fix security vulnerabilities

This proprietary nvidia-current driver update provides an upgrade to the new R375 long lived branch adding support for nVidia Geforce 10 GTX10xx, Pascal series hardware and fixes the following security issues: NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer nvidia.ko...

MGASA-2017-0028 Updated 389-ds-base packages fix security vulnerability

The "attribute uniqueness" plugin did not properly NULL-terminate an array when building up its configuration if a so called 'old-style' configuration was being used. An attacker, authenticated, but possibly also unauthenticated, could possibly force the plugin to read beyond allocated memory and...

MGASA-2017-0024 Updated shadow-utils packages fix security vulnerabilities

It was found that shadow-utils-4.2.1 had a potentially unsafe use of getlogin with the concern that the utmp entry might have a spoofed username associated with a correct uid CVE-2016-6251. It was found that shadow-utils-4.2.1 had an incorrect integer handling problem where it looks like the int...

MGASA-2017-0026 Updated pcsc-lite packages fix security vulnerability

Once MSGRemoveContext is invoked via SCARDRELEASECONTEXT, cardsList is freed. A repeated invocation of SCARDRELEASECONTEXT with an empty context handle results in a use-after-free followed by a double-free. After MSGRemoveContext, invocation of SCardEstablishContext enable further use-after-free ...

MGASA-2017-0027 Updated libvncserver packages fix security vulnerability

It was discovered that there were two vulnerabilities in libvncserver, a library to create/embed a VNC server: A heap-based buffer overflow that allows remote servers to cause a denial of service via a crafted FramebufferUpdate message containing a subrectangle outside of the drawing area...

MGASA-2017-0023 Updated firefox packages fix security vulnerability

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox CVE-2017-5373, CVE-2017-5375, CVE-2017-5376, CVE-2017-5378,...

MGASA-2017-0022 Updated php-phpmailer packages fix security vulnerabilities

It was discovered that PHPMailer, a popular library to send email from PHP applications, allowed a remote attacker to execute code if they were able to provide a crafted Sender address CVE-2016-10033. It was discovered that PHPMailer prior to 5.2.22 contained a local file disclosure vulnerability...

MGASA-2017-0021 Updated gstreamer packages fix security vulnerability

Out of bounds heap read in windowsicontypefind in gst/typefind/gsttypefindfunctions.c CVE-2016-9811...

MGASA-2017-0020 Updated libpng and libpng12 packages fix security vulnerability

This security update fixes a NULL pointer dereference bug in libpng and libpng12 CVE-2016-10087...

MGASA-2017-0018 Updated irssi packages fix security vulnerabilities

In irssi before 0.8.21, a NULL pointer dereference in the nickcmp function CVE-2017-5193. In irssi before 0.8.21, use after free when receiving invalid nick message CVE-2017-5194. In irssi before 0.8.21, out of bounds read in certain incomplete control codes CVE-2017-5195. In irssi before 0.8.21,...

MGASA-2017-0019 Updated golang package fixes security vulnerability

The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors...

MGASA-2017-0017 Updated webmin package fixes security vulnerability

The webmin package has been updated to version 1.831, fixing possible security issues in the Authentic theme fixed in 1.801 and/or 1.810, and containing several other bug fixes and enhancements. See the upstream release announcements and change log for details...

MGASA-2017-0014 Updated flash-player-plugin packages fix security vulnerabilities

Adobe Flash Player 24.0.0.194 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2016-7892 exists in the wild, and is being used in limite...

MGASA-2017-0016 Updated php-ZendFramework2 packages fix security vulnerability

When using the zend-mail component to send email via the Zend\Mail\Transport\Sendmail transport, a malicious user may be able to inject arbitrary parameters to the system sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they c...

MGASA-2017-0015 Updated unzip package fixes security vulnerabilities

It was discovered that "unzip -l" CVE-2014-9913 and "zipinfo" CVE-2016-9844 were vulnerable to buffer overflows when provided malformed or maliciously-crafted ZIP files...