Red Hat Security Advisory 2016-2972-01 - Vim is an updated and improved version of the vi editor. Security Fix: A vulnerability was found in vim in how certain modeline options were treated. An attacker could craft a file that, when opened in vim with modelines enabled, could execute arbitrary commands with privileges of the user running vim.
cc11a7a8f8ac4e1541226f52f5a0287c18a6d65d6c407fe60139bf255df0eea3Ubuntu Security Notice 3162-2 - CAI Qian discovered that shared bind mounts in a mount namespace exponentially added entries without restriction to the Linux kernel's mount table. A local attacker could use this to cause a denial of service. Andreas Gruenbacher and Jan Kara discovered that the filesystem implementation in the Linux kernel did not clear the setgid bit during a setxattr call. A local attacker could use this to possibly elevate group privileges. Various other issues were also addressed.
1a152ec0d19bda232ea06ae996e6b93187b6b85c72aaa3e85cc3d929ae530758Ubuntu Security Notice 3162-1 - CAI Qian discovered that shared bind mounts in a mount namespace exponentially added entries without restriction to the Linux kernel's mount table. A local attacker could use this to cause a denial of service. It was discovered that the KVM implementation for x86/x86_64 in the Linux kernel could dereference a null pointer. An attacker in a guest virtual machine could use this to cause a denial of service in the KVM host. Various other issues were also addressed.
4a32c8e86f3b8ceeef4be6f5af7b05191500a3c31de769c0f518689e552db28cUbuntu Security Notice 3160-2 - USN-3160-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement kernel from Ubuntu 14.04 LTS for Ubuntu 12.04 LTS. CAI Qian discovered that shared bind mounts in a mount namespace exponentially added entries without restriction to the Linux kernel's mount table. A local attacker could use this to cause a denial of service. Various other issues were also addressed.
b95631754810748c106c3ef00f5e3777bc622f25a08336ae92870a1f6c78bc74Debian Linux Security Advisory 3743-1 - It was discovered that bottle, a WSGI-framework for the Python programming language, did not properly filter "\r\n" sequences when handling redirections. This allowed an attacker to perform CRLF attacks such as HTTP header injection.
0946395bf15ee5c683437b5aedcdca12a278c64ac8576b1546dfb0f8f763cd23Ubuntu Security Notice 3160-1 - CAI Qian discovered that shared bind mounts in a mount namespace exponentially added entries without restriction to the Linux kernel's mount table. A local attacker could use this to cause a denial of service. It was discovered that a race condition existed in the procfs environ_read function in the Linux kernel, leading to an integer underflow. A local attacker could use this to expose sensitive information. Various other issues were also addressed.
afcba7dde2f290972a730c8d0f9a1db7b7964ff29acc7b708042bf6e77ebe13aUbuntu Security Notice 3159-2 - It was discovered that a race condition existed in the procfs environ_read function in the Linux kernel, leading to an integer underflow. A local attacker could use this to expose sensitive information.
5436508e406737fd9a6eaa4c58fbe93bc26c77df2d1489e182159789b77b6653Ubuntu Security Notice 3159-1 - It was discovered that a race condition existed in the procfs environ_read function in the Linux kernel, leading to an integer underflow. A local attacker could use this to expose sensitive information.
2ade25b40e4ec8d4ce4b7451d983b4c53f72b9fd08bfee5d0bc5e62d74c79d04VMware Security Advisory 2016-0023 - VMware ESXi updates address a cross-site scripting issue. 2. Relevant Releases VMware vSphere Hypervisor (ESXi) 3. Problem Description a. Host Client stored cross-site scripting issue The ESXi Host Client contains a vulnerability that may allow for stored cross-site scripting (XSS). The issue can be introduced by an attacker that has permission to manage virtual machines through ESXi Host Client or by tricking the vSphere administrator to import a specially crafted VM. The issue may be triggered on the system from where ESXi Host Client is used to manage the specially crafted VM.
4c819b33c2e8f92eb95137137e7547a0258f115eb484d7b9c5ca8497fbf5ff13Red Hat Security Advisory 2016-2963-01 - Xen is a virtual machine monitor Security Fix: An out of bounds array access issue was found in the Xen virtual machine monitor, built with the QEMU ioport support. It could occur while doing ioport read/write operations, if guest was to supply a 32bit address parameter. A privileged guest user/process could use this flaw to potentially escalate their privileges on a host.
7ac655efdee02ef89e17a23c7ecd9abe6845f56392eefc7adbc10532877a2365Red Hat Security Advisory 2016-2962-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: A use-after-free vulnerability was found in the kernels socket recvmmsg subsystem. This may allows remote attackers to corrupt memory and may allow execution of arbitrary code. This corruption takes place during the error handling routines within __sys_recvmmsg() function.
88ca76a55ea9f7cb3276bc89c0241b0d89b71386834dda46af34102ce58a9982Ubuntu Security Notice 3161-4 - Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the TTY implementation in the Linux kernel. A local attacker could use this to expose sensitive information. It was discovered that the Video For Linux Two implementation in the Linux kernel did not properly handle multiple planes when processing a VIDIOC_DQBUF ioctl. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.
09cffad9b41759532941fa035fb7aeb597e6fa782bb0de514b160c4fbc83e328Ubuntu Security Notice 3161-3 - Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the TTY implementation in the Linux kernel. A local attacker could use this to expose sensitive information. It was discovered that the Video For Linux Two implementation in the Linux kernel did not properly handle multiple planes when processing a VIDIOC_DQBUF ioctl. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.
3b72c509222788127c3449442ce79d5f2bb6a03e63fee7e3522725b77a66b344Ubuntu Security Notice 3161-2 - USN-3161-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the TTY implementation in the Linux kernel. A local attacker could use this to expose sensitive information. Various other issues were also addressed.
f967f95be34ef9e42707f6f9d05fc2a0295cb3fa848e8c2db2a69175405727d6Ubuntu Security Notice 3161-1 - Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the TTY implementation in the Linux kernel. A local attacker could use this to expose sensitive information. It was discovered that the Video For Linux Two implementation in the Linux kernel did not properly handle multiple planes when processing a VIDIOC_DQBUF ioctl. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.
d02ed1312a4662e3772b03a3dd3c24630bbaf9000053e2e30980817c514b43e8
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed