Ubuntu Security Notice 3084-1 - Pengfei Wang discovered a race condition in the audit subsystem in the Linux kernel. A local attacker could use this to corrupt audit logs or disrupt system-call auditing. It was discovered that the powerpc and powerpc64 hypervisor-mode KVM implementation in the Linux kernel for did not properly maintain state about transactional memory. An unprivileged attacker in a guest could cause a denial of service in the host OS. Various other issues were also addressed.
041db440f69287cf86d0d560304f9cc2ad2db1bde818b1fd1fe14913043891c1Ubuntu Security Notice 3083-1 - Dmitry Vyukov discovered that the IPv6 implementation in the Linux kernel did not properly handle options data, including a use-after-free. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. It was discovered that a race condition existed when handling heartbeat- timeout events in the SCTP implementation of the Linux kernel. A remote attacker could use this to cause a denial of service. Various other issues were also addressed.
52eab0418053602603e73f209e3485a85f8d0aa24f7c884e3f1b8270ed05f0b4Ubuntu Security Notice 3082-1 - Chiachih Wu, Yuan-Tsung Lo, and Xuxian Jiang discovered that the legacy ABI for ARM had incomplete access checks for epoll_wait and semtimedop. A local attacker could use this to possibly execute arbitrary code.
78480af0d32b0fa86f7245b2313c33bd6ea5a6d3271d63257a89bde3551eeab7Ubuntu Security Notice 3083-2 - USN-3083-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement kernel from Ubuntu 14.04 LTS for Ubuntu 12.04 LTS. Dmitry Vyukov discovered that the IPv6 implementation in the Linux kernel did not properly handle options data, including a use-after-free. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.
652cd80153f903b94a35a79406720a21993e90e76a9a9d24eecb192b752aa471Ubuntu Security Notice 3082-2 - Chiachih Wu, Yuan-Tsung Lo, and Xuxian Jiang discovered that the legacy ABI for ARM had incomplete access checks for epoll_wait and semtimedop. A local attacker could use this to possibly execute arbitrary code.
f1feea8469491b747927e478e26065a5bed1b7be3659ba44a7b964e4ea9682daUbuntu Security Notice 3081-1 - Dawid Golunski discovered that the Tomcat init script incorrectly handled creating log files. A remote attacker could possibly use this issue to obtain root privileges. This update also reverts a change in behavior introduced in USN-3024-1 by setting mapperContextRootRedirectEnabled to True by default.
675f6057a1c1f0a39c448e746d1b909c252d28c8cb0a684b52fd7a96408910f7WordPress Neosense theme version 1.7 suffers from a remote shell upload vulnerability.
483336d59b67f8d8d195f34a5ff3040d94a360e52713228620ce4ef924c1d190EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 7.3 contain fixes for multiple vulnerabilities. These vulnerabilities may expose the Avamar clients and servers to potentially be compromised by malicious users. They include improper authentication, improper encryption, privilege escalation, and command injection vulnerabilities.
5a4bc9d5cbfb3e7fe1be98e04086dfe29c1b721203749f2c75bd95a4099bc49eVMWare Workstation vprintproxy.exe suffers from a double-free in the handling of EMF (EMR_SMALLTEXTOUT record).
e6eac7c024a8a3b3788360713d4b8f38aa43580e461b5cbd18a110c2d2f297c5ZooKeeper versions 3.4.0 through 3.4.8 and 3.5.0 through 3.5.2 suffer from a buffer overflow vulnerability. This affects the ZooKeeper C client shells cli_st and cli_mt.
dac1578f028d29ce343ed0fd6cce66eb90707710c6358e7134caa196a1cc54b6Slackware Security Advisory - New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue.
17ab5bcec57a40add161eafd30fb8c99ec9160c22309af0adc7b46c7723807d7Red Hat Security Advisory 2016-1905-01 - Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 53.0.2785.113. Security Fix: Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim.
0de4dbd636bf8199b04092466d1f4e3c34d8b6f6cd8688d066ccb681573ded47Debian Linux Security Advisory 3669-1 - Dawid Golunski of LegalHackers discovered that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation.
206d6b75119861b8a83da66629ef1f00284e5a30f11fb052bc9a1f4f46863523RSA announces security fixes to RSA BSAFE Micro Edition Suite designed to address Security Losses from Obsolete and Truncated Transcript Hashes (SLOTH) attack on TLS 1.2. RSA BSAFE Micro Edition Suite (MES) all 4.1.x versions prior to 4.1.5 and all 4.0.x versions prior to 4.0.9 are affected.
5d6e2f099f8ccb45904c59f7fb1b77ce959845f9396dc506196e49e869659a8aUbuntu Security Notice 3080-1 - Eric Soroos discovered that the Python Imaging Library incorrectly handled certain malformed FLI or PhotoCD files. A remote attacker could use this issue to cause Python Imaging Library to crash, resulting in a denial of service. Andrew Drake discovered that the Python Imaging Library incorrectly validated input. A remote attacker could use this to cause Python Imaging Library to crash, resulting in a denial of service. Various other issues were also addressed.
d1ec6ef38949653dea8c3e73dc30bf74f615becbac00bfbf51a96b5385184e0aAndroid applications developed with Adobe AIR send data back to Adobe servers without HTTPS while running. This can allow an attacker to compromise the privacy of the applications' users. This has been fixed in Adobe AIR SDK release version 23.0.0.257. This affects applications compiled with the Adobe AIR SDK versions 22.0.0.153 and earlier.
7116841c325788e68cfc1fa448456174602554df31525c572ce4f81042034b28Red Hat Security Advisory 2016-1847-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: A security flaw was found in the Linux kernel in the mark_source_chains() function in "net/ipv4/netfilter/ip_tables.c". It is possible for a user-supplied "ipt_entry" structure to have a large "next_offset" field. This field is not bounds checked prior to writing to a counter value at the supplied offset.
97c4833d6ef062497ce53d7bc4c425df6db32d45c28eb4202a714264ea140c56Ubuntu Security Notice 3058-1 - An issue was discovered in Blink involving the provisional URL for an initially empty document. An attacker could potentially exploit this to spoof the currently displayed URL. A use-after-free was discovered in the WebCrypto implementation in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. Various other issues were also addressed.
1a6d9dccdc1ad228648a7fe517941aaa2262f710c49018ca68a1528a45e0054eRed Hat Security Advisory 2016-1875-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. The kernel-rt packages have been upgraded to the kernel-3.10.0-327.36.1 source tree, which provides a number of bug fixes over the previous version. Security Fix: A security flaw was found in the Linux kernel in the mark_source_chains() function in "net/ipv4/netfilter/ip_tables.c". It is possible for a user-supplied "ipt_entry" structure to have a large "next_offset" field. This field is not bounds checked prior to writing to a counter value at the supplied offset.
0fa57f8af62588a757e2e80f9e728575d38e5444f6abbf06db0b8907755051dfRed Hat Security Advisory 2016-1883-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. The kernel-rt packages have been upgraded to version 3.10.0-327.rt56.197, which provides a number of bug fixes over the previous version. Security Fix: A security flaw was found in the Linux kernel in the mark_source_chains() function in "net/ipv4/netfilter/ip_tables.c". It is possible for a user-supplied "ipt_entry" structure to have a large "next_offset" field. This field is not bounds checked prior to writing to a counter value at the supplied offset.
560ae7b8c932b8db101f981656564278badc38c9fb1687c8d0d32cffb6951d8eApple Security Advisory 2016-09-13-3 - watchOS 3 is now available and addresses an information disclosure vulnerability.
c981b8363aded70bd2b1dfdd0413a2da414b99462f30f938a6388424cbb26dfcApple Security Advisory 2016-09-13-1 - iOS 10 is now available and addresses network blocking, information disclosure, and various other vulnerabilities.
c79356a790c950b1fe726043da3eaab71921362c32728020bbea0f35cbb5484cApple Security Advisory 2016-09-14-1 - iOS 10.0.1 is now available and addresses a kernel memory disclosure vulnerability.
a3be6f2c1041762b0caa078958b3b1744e01bc127d2dd2f6afb20429b10acfb5Debian Linux Security Advisory 3666-1 - Dawid Golunski discovered that the mysqld_safe wrapper provided by the MySQL database server insufficiently restricted the load path for custom malloc implementations, which could result in privilege escalation.
d28b96249e7fc2df03afa448cba9de612a55ed8cfcda4eca4c0fd98e74a1d2bcApple Security Advisory 2016-09-13-2 - Xcode 8 is now available and addresses code execution vulnerabilities.
b2b40b5c7c66d9710535d8e2fcaf210b0893d1aabc69b23e45fe5836f19e4256
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed