Red Hat Security Advisory 2016-1086-01 - Libndp is a library that provides a wrapper for the IPv6 Neighbor Discovery Protocol. It also provides a tool named ndptool for sending and receiving NDP messages. Security Fix: It was found that libndp did not properly validate and check the origin of Neighbor Discovery Protocol messages. An attacker on a non-local network could use this flaw to advertise a node as a router, allowing them to perform man-in-the-middle attacks on a connecting client, or disrupt the network connectivity of that client.
8355924f316a3a290f7093136170ead8bd279f1e0739e79b02189dd1b7f3e2bd
Apple Security Advisory 2016-05-16-6 - iTunes 12.4 is now available and addresses a code execution vulnerability.
0bb484fb892661c9d0d136b77554d8e0cf261760a62acc90c71612cdb5f12636
Apple Security Advisory 2016-05-16-5 - Safari 9.1.1 is now available and addresses history deletion, data disclosure, code execution, and various other vulnerabilities.
a9e53dda0873ad8a4ed17e1822b21b16c940203d4a931b8a0a7f88912870545b
Gentoo Linux Security Advisory 201605-2 - Multiple vulnerabilities have been found in the Chromium web browser, the worst of which allows remote attackers to execute arbitrary code. Versions less than 50.0.2661.102 are affected.
3d35e4f94f3e0d5fc1ec1b66fbcd0077314511b7d86948997867d9fcca1414b0
Ubuntu Security Notice 2981-1 - It was discovered that libarchive incorrectly handled certain entry-size values in ZIP archives. A remote attacker could use this issue to cause libarchive to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. It was discovered that libarchive incorrectly handled memory when processing certain tar files. A remote attacker could use this issue to cause libarchive to crash, resulting in a denial of service. Various other issues were also addressed.
cd28623f8a397ad606f6739d1d53e4c06507e985acd72d2147bc28e72c960e56
Apple Security Advisory 2016-05-16-4 - OS X El Capitan 10.11.5 and Security Update 2016-003 is now available and addresses code execution, PHP flaws, information leakage, and various other vulnerabilities.
033664aa28ec2879dd3701fb337746a01283cd594653ca2f21434886e857c2b1
Ubuntu Security Notice 2980-1 - Julien Bernard discovered that libndp incorrectly performed origin checks when receiving Neighbor Discovery Protocol (NDP) messages. A remote attacker outside of the local network could use this issue to advertise a node as a router, causing a denial of service, or possibly to act as a man in the middle.
fd80dfb5e75a446fbe7f7256ff55473acd17f98dda4e3e20e1cfdab2bede7e5d
Red Hat Security Advisory 2016-1083-01 - Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments. Security Fix: An input sanitization flaw was found in the scoped search parameters sort_by and sort_order in the REST API. An authenticated user could use this flaw to perform an SQL injection attack on the Katello back end database.
16c634ffd6be21f4086f926a66feee82da9905f491a151635564f12cd7807517
Apple Security Advisory 2016-05-16-3 - watchOS 2.2.1 is now available and addresses information leakage, code execution, and various other vulnerabilities.
33b024e7cf4ccb3341bea4ad4c523f2b5f77ad44af02d7c3a4e377bffabb8637
Bugzilla versions 2.16rc1 to 4.4.11 and 4.5.1 to 5.0.2 suffer from a cross site scripting vulnerability.
b5b557c9a96230c03f35334bcabd0cbadd09684f233600dafc8de9a79dd18b6b
Apple Security Advisory 2016-05-16-2 - iOS 9.3.2 is now available and addresses buffer overflow, information leakage, and various other vulnerabilities.
fa5fb69a96d1763e7f9b8f05cfb08dc7841350132fdbde952f885dfdea6fc729
Apple Security Advisory 2016-05-16-1 - tvOS 9.2.1 is now available and addresses information disclosure, code execution issues, and more.
a7046a4cb19a989986f26465b54fe410792551ee40fb5815e022d3ff6cd5e750
7-Zip versions prior to 16.00 suffer from code execution and various other vulnerabilities.
9f796f1af89d7aa0d638e43def7b8d0e70a285275a25793a5d06f71c464ca9c1
Ubuntu Security Notice 2979-4 - Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did not properly process certificate files with tags of indefinite length. A local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges.
f8e3be2b927e976c9209bd751acdb51d9b30164629cb20cc001b615de8729e1d
Ubuntu Security Notice 2979-1 - David Matlack discovered that the Kernel-based Virtual Machine (KVM) implementation in the Linux kernel did not properly restrict variable Memory Type Range Registers (MTRR) in KVM guests. A privileged user in a guest VM could use this to cause a denial of service (system crash) in the host, expose sensitive information from the host, or possibly gain administrative privileges in the host. Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did not properly process certificate files with tags of indefinite length. A local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges. Various other issues were also addressed.
f54efabc7a7953e27810fe6ce72422448a5483cf73e0c1c26490ee17ddb6515d
Ubuntu Security Notice 2979-2 - USN-2979-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. David Matlack discovered that the Kernel-based Virtual Machine (KVM) implementation in the Linux kernel did not properly restrict variable Memory Type Range Registers (MTRR) in KVM guests. A privileged user in a guest VM could use this to cause a denial of service (system crash) in the host, expose sensitive information from the host, or possibly gain administrative privileges in the host. Various other issues were also addressed.
cdb2c86cd663d5c26cde9b3c2a5708b24e10070bf88b9fc77d97870354cfaeb1
Ubuntu Security Notice 2977-1 - Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did not properly process certificate files with tags of indefinite length. A local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges.
d6b3be39ac7937bb9c063bc7588dc509dfded0b1d2782055a62769be30157ce9
Ubuntu Security Notice 2976-1 - Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did not properly process certificate files with tags of indefinite length. A local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges.
a7e8c5cbdc10dd613588bad7d3979dece9409d0fcc442c155c1452784fcf6482
Ubuntu Security Notice 2978-3 - Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did not properly process certificate files with tags of indefinite length. A local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges.
380a8900f2b41cbbcdc679855c577286d9e8ac890b72e924185614245a2678d8
Ubuntu Security Notice 2975-1 - Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did not properly process certificate files with tags of indefinite length. A local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges.
ce4aa24f49da8508bdc20d9f6ec8279498501fffb6953834550e0930d92b30a2
Ubuntu Security Notice 2975-2 - USN-2975-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu 12.04 LTS. Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did not properly process certificate files with tags of indefinite length. A local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges. Various other issues were also addressed.
feac0eb25f9c1cd3fa095cee054213a408415e169c7b4778f95545c5dacb38c1
Ubuntu Security Notice 2978-2 - USN-2978-1 fixed vulnerabilities in the Linux kernel for Ubuntu 15.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 15.10 for Ubuntu 14.04 LTS. David Matlack discovered that the Kernel-based Virtual Machine (KVM) implementation in the Linux kernel did not properly restrict variable Memory Type Range Registers (MTRR) in KVM guests. A privileged user in a guest VM could use this to cause a denial of service (system crash) in the host, expose sensitive information from the host, or possibly gain administrative privileges in the host. Various other issues were also addressed.
64141def5026b2fd37a8d73d52076845eb142cd7b02d5e2f75a7ec27d647aa30
Ubuntu Security Notice 2979-3 - Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did not properly process certificate files with tags of indefinite length. A local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges.
ebdfe841208c413cc4a3580e230a63f56eb848beb54d4fc7056c707f90f943df
Ubuntu Security Notice 2978-1 - David Matlack discovered that the Kernel-based Virtual Machine (KVM) implementation in the Linux kernel did not properly restrict variable Memory Type Range Registers (MTRR) in KVM guests. A privileged user in a guest VM could use this to cause a denial of service (system crash) in the host, expose sensitive information from the host, or possibly gain administrative privileges in the host. Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did not properly process certificate files with tags of indefinite length. A local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges. Various other issues were also addressed.
c7ba527bc03f4e3f11f857d8f2bda733be9c17654f1a0e13e3c436345ac34da5
Debian Linux Security Advisory 3580-1 - Nikolay Ermishkin from the Mail.Ru Security Team and Stewie discovered several vulnerabilities in ImageMagick, a program suite for image manipulation. These vulnerabilities, collectively known as ImageTragick, are the consequence of lack of sanitization of untrusted input. An attacker with control on the image input could, with the privileges of the user running the application, execute code (CVE-2016-3714), make HTTP GET or FTP requests (CVE-2016-3718), or delete (CVE-2016-3715), move (CVE-2016-3716), or read (CVE-2016-3717) local files.
747cf13d24c6beb4d0ce9afc86b233876539d3430e7ac143db6dd5daba44316e