Red Hat Security Advisory 2017-0564-01 - The libguestfs packages contain a library, which is used for accessing and modifying virtual machine disk images. Security Fix: An integer conversion flaw was found in the way OCaml's String handled its length. Certain operations on an excessively long String could trigger a buffer overflow or result in an information leak. Note: The libguestfs packages in this advisory were rebuilt with a fixed version of OCaml to address this issue.
13e2ecc8a13af222de17972b009f4a313cce49b6e9f9523c18baa3b620443535Ubuntu Security Notice 3239-1 - It was discovered that the GNU C Library incorrectly handled the strxfrm function. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. It was discovered that an integer overflow existed in the _IO_wstr_overflow function of the GNU C Library. An attacker could use this to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Various other issues were also addressed.
a086af7e2dbc01251777d0699eb6cb41c5a2b8b291a0d8d90e74157971b520c5Red Hat Security Advisory 2017-0817-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: It was discovered that a remote attacker could leverage the generation of IPv6 atomic fragments to trigger the use of fragmentation in an arbitrary IPv6 flow and could subsequently perform any type of a fragmentation-based attack against legacy IPv6 nodes that do not implement RFC6946.
597c633d164dd5b659055724a7f94dfa6104bd1ddf58babc8fd4e61d37290908Ubuntu Security Notice 3240-1 - It was discovered that the NVIDIA graphics drivers contained a flaw in the kernel mode layer. A local attacker could use this issue to cause a denial of service.
2699f0a251a71c47e3720ed4b11d0f247f4f7b4f326059f83a39fbbafbfab3a5Red Hat Security Advisory 2017-0794-01 - The quagga packages contain Quagga, the free network-routing software suite that manages TCP/IP based protocols. Quagga supports the BGP4, BGP4+, OSPFv2, OSPFv3, RIPv1, RIPv2, and RIPng protocols, and is intended to be used as a Route Server and Route Reflector. Security Fix: A stack-based buffer overflow flaw was found in the way Quagga handled IPv6 router advertisement messages. A remote attacker could use this flaw to crash the zebra daemon resulting in denial of service.
382a7eb4860c0cafcd06124913757757571d5dd5111b8d10cb82337462076114Red Hat Security Advisory 2017-0744-01 - Samba is an open-source implementation of the Server Message Block or Common Internet File System protocol, which allows PC-compatible machines to share files, printers, and other information. Security Fix: It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.
1ce8166802d57628cd0aacc6d9c34081469c6920c71ff18af394355450dc4b92Red Hat Security Advisory 2017-0725-01 - The bash packages provide Bash, which is the default shell for Red Hat Enterprise Linux. Security Fix: An arbitrary command injection flaw was found in the way bash processed the hostname value. A malicious DHCP server could use this flaw to execute arbitrary commands on the DHCP client machines running bash under specific circumstances. An arbitrary command injection flaw was found in the way bash processed the SHELLOPTS and PS4 environment variables. A local, authenticated attacker could use this flaw to exploit poorly written setuid programs to elevate their privileges under certain circumstances.
ec88f4635773f8c357e90336dc5b241990df59544ff8b895b01996472d9147fbRed Hat Security Advisory 2017-0698-01 - The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Red Hat entitlement platform. The subscription-manager-migration-data package provides certificates for migrating a system from the legacy Red Hat Network Classic to Red Hat Subscription Management. The python-rhsm packages provide a library for communicating with the representational state transfer interface of a Red Hat Unified Entitlement Platform. The Subscription Management tools use this interface to manage system entitlements, certificates, and access to content.
7ed7a3cd5cca5a76507d1f1a74e96ab9486e5b99469084c67b9095081b236c8fRed Hat Security Advisory 2017-0680-01 - The glibc packages provide the standard C libraries, POSIX thread libraries, standard math libraries, and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix: A stack overflow vulnerability was found in nan* functions that could cause applications, which process long strings with the nan function, to crash or, potentially, execute arbitrary code.
324d43db935a7ec05e599e403198eb2ed3ce4e5f8890b00bc2368b2c12b3560dRed Hat Security Advisory 2017-0654-01 - The coreutils packages contain the GNU Core Utilities and represent a combination of the previously used GNU fileutils, sh-utils, and textutils packages. Security Fix: A race condition was found in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
0a6e6561b675d0cda0718db60cdc2b972bac9e81b2d5915d4e6a951edb1a4a6eRed Hat Security Advisory 2017-0662-01 - Samba is an open-source implementation of the Server Message Block protocol and the related Common Internet File System protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix: It was found that Samba always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.
442935e6a374fb7bc908d12b18c53e8f934e99f5d371e37ea8509b0e862caf86Red Hat Security Advisory 2017-0641-01 - OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix: It was discovered that the OpenSSH sshd daemon fetched PAM environment settings before running the login program. In configurations with UseLogin=yes and the pam_env PAM module configured to read user environment settings, a local user could use this flaw to execute arbitrary code as root.
1e04f6c86073b42f0d6aac48811b28484c12a88852f4aa3a8049cc76fe1f3f41Red Hat Security Advisory 2017-0631-01 - The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix: Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file.
a857a0533e9d54b99d71f61dabbae572e2cb165bdc70df97f720572b2a66cc2bRed Hat Security Advisory 2017-0630-01 - Virtual Network Computing is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. The tigervnc packages contain a client which allows users to connect to other desktops running a VNC server. Security Fix: A denial of service flaw was found in the TigerVNC's Xvnc server. A remote unauthenticated attacker could use this flaw to make Xvnc crash by terminating the TLS handshake process early.
07f7f8ba8a8df7e79f920eae4fc677b6d156caef1b63841bdec008081b481281Ubuntu Security Notice 3173-2 - USN-3173-1 fixed a vulnerability in nvidia-graphics-drivers-304 and nvidia-graphics-drivers-340. This update provides the corresponding update for nvidia-graphics-drivers-375. It was discovered that the NVIDIA graphics drivers contained a flaw in the kernel mode layer. A local attacker could use this issue to cause a denial of service. Various other issues were also addressed.
7c048d77dfb2bf8dbf684be157012eb2dd7edbede534637fe240c791a22cb615Adium version 1.5.10.2 includes a vulnerable version of libpurple that permits for arbitrary code execution on the client.
ecda5b423632c41687024c6a3f6d0c1f5e08a999e78e7e3f2993c4210cff312bMozilla Firefox suffers from a table use-after-free vulnerability.
467f7a92740d3d939226cb316dd4c5564e04846cf418f83875fb7b601f8b7208EMC RecoverPoint update contains a fix for an SSL stripping vulnerability that may potentially be exploited by malicious users to compromise the affected system. Versions prior to 5.0 are affected.
8279c37d5fc37aaeb794e695f885941bc5413f2602ef275e025af37d36f98b7eUbuntu Security Notice 3238-1 - An integer overflow was discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could exploit this to cause a denial of service via application crash or execute arbitrary code.
b6b00bdea5a46267871ff5572e784dc568cabd5a7a8f0ea1e960b32c132c6319Debian Linux Security Advisory 3796-2 - CVE-2016-8743 meant being more stringent when dealing with whitespace patterns in HTTP requests, and that change broke the upload tool of sitesummary-client.
9f454c966cfbe982bd6953ab0bde1b10a4a667a1dd3b4d83f34331327a46db91HP Security Bulletin HPSBUX03596 2 - A security vulnerability in Samba was addressed by HPE HP-UX running CIFS Server (Samba). The vulnerability could be exploited resulting in remote access restriction bypass and unauthorized access. Revision 2 of this advisory.
d841f519b91c644cd53e085dff736d033e160d2adae9e3588ae69a1f6ed05cb1Ubuntu Security Notice 3237-1 - It was discovered that FreeType did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash, resulting in a denial of service, or possibly execute arbitrary code.
043ff2b27d9d296fe83b51e3661fdcb9e5855895d2618bc4c4729e92302fa76cUbuntu Security Notice 3183-2 - USN-3183-1 fixedCVE-2016-8610 in GnuTLS in Ubuntu 16.04 LTS and Ubuntu 16.10. This update provides the corresponding update for Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Stefan Buehler discovered that GnuTLS incorrectly verified the serial length of OCSP responses. A remote attacker could possibly use this issue to bypass certain certificate validation measures. This issue only applied to Ubuntu 16.04 LTS. Shi Lei discovered that GnuTLS incorrectly handled certain warning alerts. A remote attacker could possibly use this issue to cause GnuTLS to hang, resulting in a denial of service. This issue has only been addressed in Ubuntu 16.04 LTS and Ubuntu 16.10. It was discovered that GnuTLS incorrectly decoded X.509 certificates with a Proxy Certificate Information extension. A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. It was discovered that GnuTLS incorrectly handled certain OpenPGP certificates. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. Various other issues were also addressed.
c20be476843f82dbeef2f80230bbcaa5a17fdb8eea114d74c07fde2da3274f09Red Hat Security Advisory 2017-0559-01 - OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. Security Fix: Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in OpenJPEG. A specially crafted JPEG2000 image could cause an application using OpenJPEG to crash or, potentially, execute arbitrary code. A vulnerability was found in the patch for CVE-2013-6045 for OpenJPEG. A specially crafted JPEG2000 image, when read by an application using OpenJPEG, could cause heap-based buffer overflows leading to a crash or, potentially, arbitrary code execution.
cf1a2baceb0a6cb4020ae9a518c4553bc770b2638def72f156336ff01db72e25Gentoo Linux Security Advisory 201703-3 - A buffer overflow in PuTTY might allow remote attackers to execute arbitrary code or cause a denial of service. Versions less than 0.68 are affected.
bf2e380ea3c1c66d7992ffd39196ce810ddc34c559ff53caf3d2462d9b6e0e3f
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed