6277 matches found
MGASA-2017-0130 Updated ettercap packages fix security vulnerability
Etterfilter utility of Ettercap have an out-of-bounds read denial-of-service vulnerability when parsing a crafted file. This occurs in the compiletree function of the efcompiler.c source file when processing corrupted filters CVE-2017-6430...
MGASA-2017-0129 Updated audiofile packages fix security vulnerabilities
Several vulnerabilities have been discovered in the audiofile library, which may result in denial of service or the execution of arbitrary code if a malformed audio file is processed CVE-2017-6827, CVE-2017-6828, CVE-2017-6829, CVE-2017-6830, CVE-2017-6831, CVE-2017-6832, CVE-2017-6833,...
MGASA-2017-0128 Updated minicom packages fix security vulnerability
In minicom before version 2.7.1, the escparms buffer in vt100.c is vulnerable to an overflow that may allow for remote code execution CVE-2017-7467...
MGASA-2017-0094 Updated mbedtls packages fix security vulnerability
In mbedTLS before 1.3.19, if a malicious peer supplies a certificate with a specially crafted secp224k1 public key, then an attacker can cause the server or client to attempt to free block of memory held on stack. Depending on the platform, this could result in a Denial of Service client crash or...
MGASA-2017-0083 Updated tnef packages fix security vulnerability
An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapiattr.c:mapiattrread. These might lead to invalid read and write operations, controlled by an attacker. CVE-2017-6307 An issue was discovered in tnef before 1.4.13. Several Integer Overflows, which can le...
MGASA-2017-0082 Updated thunderbird packages fix security vulnerability
JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. CVE-2017-5400 A crash triggerable by web content in which an ErrorResult references unassigned memory due to a logic error. The resulting crash may...
MGASA-2017-0077 Updated wavpack packages fix security vulnerability
Hanno Böck discovered a global buffer overread vulnerability in WavPack's word parsing logic CVE-2016-10169, this update fixes it...
MGASA-2017-0071 Updated quagga packages fix security vulnerability
All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host CVE-2017-5495...
MGASA-2017-0050 Updated tomcat packages fix security vulnerability
It was discovered that incorrect error handling in the NIO HTTP connector of the Tomcat servlet and JSP engine could result in information disclosure CVE-2016-8745...
MGASA-2017-0044 Updated icoutils packages fix security vulnerability
Multiple programming errors in the wrestool tool of the icoutils suite allows denial of service or the execution of arbitrary code if a malformed binary is parsed CVE-2017-5208, CVE-2017-5331, CVE-2017-5332, CVE-2017-5333...
MGASA-2017-0029 Updated opus packages fix security vulnerability
A remote code execution vulnerability in silk/NLSFstabilize.c in libopus could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing CVE-2017-0381...
MGASA-2017-0028 Updated 389-ds-base packages fix security vulnerability
The "attribute uniqueness" plugin did not properly NULL-terminate an array when building up its configuration if a so called 'old-style' configuration was being used. An attacker, authenticated, but possibly also unauthenticated, could possibly force the plugin to read beyond allocated memory and...
MGASA-2017-0005 Updated bash packages fix security vulnerability
In Bash, the popd command can be tricked to free a user supplied address, which could be used to bypass restricted shells rsh on some environments to cause use-after-free CVE-2016-9401...
MGASA-2016-0432 Updated tracker packages fix security vulnerability
It was discovered that Tracker incorrectly handled certain malformed GIF images. If a user or automated system were tricked into downloading a specially-crafted GIF image, Tracker could crash, resulting in a denial of service...
MGASA-2016-0410 Updated firefox packages fix security vulnerability
A flaw was found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox CVE-2016-9079...
MGASA-2016-0390 Updated gnuchess packages fix security vulnerability
gnuchess before 6.2.4 is vulnerable to a stack buffer overflow related to user move input, where 160 characters of input can crash gnuchess CVE-2015-8972...
MGASA-2016-0377 Updated python-cryptography package fixes security vulnerability
Fixed a bug where HKDF would return an empty byte-string if used with a length less than algorithm.digestsize. CVE-2016-9243...
MGASA-2016-0373 Updated freeimage packages fix security vulnerability
Multiple vulnerabilities were discovered in the FreeImage multimedia library, which might result in denial of service or the execution of arbitrary code if a malformed XMP or RAW image is processed. CVE-2015-3885, CVE-2016-5684...
MGASA-2016-0369 Updated libtomcrypt packages fix security vulnerability
It was discovered that the implementation of RSA signature verification in libtomcrypt is vulnerable to the Bleichenbacher signature attack. If an RSA key with exponent 3 is used it may be possible to forge a PKCS1 v1.5 signature signed by that key CVE-2016-6129...
MGASA-2016-0363 Updated php-adodb packages fix security vulnerabilities
The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting. CVE-2016-7405 Cross Site Scripting vulnerability in test script CVE-2016-4855...
MGASA-2016-0343 Updated mailman package fixes security vulnerability
Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account...
MGASA-2016-0334 Updated python-django packages fix security vulnerability
CVE-2016-7401: CSRF protection bypass on a site with Google Analytics An interaction between Google Analytics and Django's cookie parsing could allow an attacker to set arbitrary cookies leading to a bypass of CSRF protection...
MGASA-2016-0321 Updated wireshark packages fix security vulnerabilities
The wireshark package has been updated to version 2.0.6, which fixes several security issues where a malformed packet trace could cause it to crash, and fixes several other bugs as well. See the release notes for details...
MGASA-2016-0306 Updated krb5 packages fix security vulnerability
The validateasrequest function in kdcutil.c in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 before 1.14.3, when restrictanonymoustotgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service NULL pointer dereference a...
MGASA-2016-0254 Updated thunderbird packages fix security vulnerability
Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird CVE-2016-2805, CVE-2016-2807, CVE-2016-2818. This update...
MGASA-2016-0253 Updated pdfbox packages fix security vulnerability
Apache PDFBox before 1.8.12 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted PDF CVE-2016-2175...
MGASA-2016-0249 Updated mbedtls packages fix security vulnerabilities
Updated mbedtls packages fix security vulnerabilities: The mbedtls package has been updated to version 1.3.17, which fixes a few minor security issues in mbedtlsrsarsaespkcs1v15encrypt and mbedtlsrsarsaesoaepencrypt and fixes a handful of other bugs as well. See the upstream release announcement...
MGASA-2016-0236 Updated pidgin packages fix security vulnerability
A buffer overflows vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in arbitrary code execution. A malicious server or an attacker who intercepts the network traffic can send an invalid size for a packet...
MGASA-2016-0211 Updated phpmyadmin package fixes CVE-2016-5099
In phpMyAdmin before 4.4.15.6, a specially crafted attack could allow for special HTML characters to be passed as URL encoded values and displayed back as special characters in the page CVE-2016-5099...
MGASA-2016-0195 Updated networkmanager packages fix CVE-2016-0764
Updated networkmanager package fixes security vulnerability: NetworkManager before 1.0.12 is vulnerable to a race condition that could lead to a local information leak CVE-2016-0764. The networkmanager package has been updated to version 1.0.12, which fixes this issue and several other bugs. See...
MGASA-2016-0172 Updated mercurial packages fix security vulnerability
This update fixes possible arbitrary code execution when converting Git repos. Mercurial prior to 3.8 allowed arbitrary code execution when using the convert extension on Git repos with hostile names. This could affect automated code conversion services that allow arbitrary repository names. This...
MGASA-2016-0173 Updated flash-player-plugin packages fix security vulnerability
Adobe Flash Player 11.2.202.621 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system. This update resolves type confusion vulnerabilities that could lead to code execution CVE-2016-1105,...
MGASA-2016-0168 Updated vlc packages fix security vulnerability
Updated vlc packages fix security vulnerabilities: The vlc package has been updated to version 2.2.3, which fixes several bugs and possible security issues. See the NEWS file for details...
MGASA-2016-0154 Updated w3m packages fix security vulnerabilities
Updated w3m package fixes security vulnerability: A vulnerability was found in w3m package. A maliciously crafted html file opened with specific command could cause the application to crash rhbz1324348...
MGASA-2016-0143 Updated chromium-browser-stable packages fix security vulnerabilities
Chromium-browser-stable 50.0.2661.75 fixes security issues: Cross-site scripting XSS vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/modulesystem.cc in the Extensions subsystem in Google Chrome before 50.0.2661.75 allows remote attackers to inject arbitrary we...
MGASA-2016-0141 Updated python-pillow packages fix CVE-2016-3076
This update fixes an integer overflow in Jpeg2KEncode.c causing a buffer overflow CVE-2016-3076...
MGASA-2016-0138 Updated mercurial packages fix security vulnerabilities
Updated mercurial packages fix security vulnerabilities: Blake Burkhart discovered that Mercurial allows URLs for Git subrepositories that could result in arbitrary code execution on clone CVE-2016-3068. Blake Burkhart discovered that Mercurial allows arbitrary code execution when converting Git...
MGASA-2016-0119 Updated git packages fix security vulnerability
There is a buffer overflow vulnerability possibly leading to remote code execution in git. It can happen while pushing or cloning a repository with a large filename or a large number of nested trees CVE-2016-2315, CVE-2016-2324. The git package has been updated to version 2.7.4, which fixes this...
MGASA-2016-0108 Updated openssh packages fix security vulnerability
Missing sanitisation of untrusted input allows an authenticated user who is able to request X11 forwarding to inject commands to xauth1 CVE-2016-3115...
MGASA-2016-0087 Updated drupal packages fix security vulnerabilities
Updated drupal packages fix security vulnerabilities: The drupal package has been update to version 7.43, which fixes several security issues and other bugs. See the upstream advisory and release notes for details...
MGASA-2016-0088 Updated xerces-c packages fix CVE-2016-0729
Updated xerces-c packages fix security vulnerability: The Xerces-C XML parser mishandles certain kinds of malformed input documents, resulting in buffer overlows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse...
MGASA-2016-0079 Updated glibc packages fix security vulnerabilities
Updated glibc fixes the following security issues: A stack overflow unbounded alloca could have caused applications which process long strings with the nan function to crash or, potentially, execute arbitrary code CVE-2014-9761. A stack-based buffer overflow in getaddrinfo allowed remote attacker...
MGASA-2016-0073 Updated pinpoint packages fix CVE-2013-7447
Updated pinpoint packages fix security vulnerability: Due to a logic error, an attempt to allocate a large block of memory fails in caironewsurfacefrompixbuf, leading to a crash of pinpoint CVE-2013-7447...
MGASA-2016-0070 Updated eom packages fix CVE-2013-7447
Updated eom packages fix security vulnerability: Due to a logic error, an attempt to allocate a large block of memory fails in gdkcairosetsourcepixbuf, leading to a crash of eom CVE-2013-7447...
MGASA-2016-0078 Updated thunderbird packages fix security vulnerability
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird CVE-2016-1930, CVE-2016-1935. Multiple security flaws were foun...
MGASA-2016-0062 Updated flash-player-plugin packages fix security vulnerabilities
Adobe Flash Player 11.2.202.569 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system. This update resolves a type confusion vulnerability that could lead to code execution CVE-2016-0985. This...
MGASA-2016-0042 Updated chromium-browser-stable packages fix security vulnerability
The LoadIC::UpdateCaches function in ic/ic.cc in Google V8, as used in Google Chrome before 48.0.2564.82, does not ensure receiver compatibility before performing a cast of an unspecified variable, which allows remote attackers to cause a denial of service or possibly have unknown other impact vi...
MGASA-2016-0036 Updated lxc packages fix security vulnerability
A directory traversal flaw while lxc-start in lxc before 1.0.8 in initially setting up the mounts for a container CVE-2015-1335...
MGASA-2015-0479 Updated chromium-browser-stable packages fix CVE-2015-6792
Updated chromium-browser-stable packages fix security vulnerabilities: Fixes from internal audits and fuzzing CVE-2015-6792...
MGASA-2015-0466 Updated openssl packages fix security vulnerability
If a client receives a ServerKeyExchange for an anonymous DH ciphersuite with the value of p set to 0 then a seg fault can occur leading to a possible denial of service attack CVE-2015-1794. Loic Jonas Etienne of Qnective AG discovered that the signature verification routines will crash with a NU...