Type: Vulnerability. Microsoft Windows is prone to a local privilege-escalation vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Windows is prone to a remote code-execution vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Internet Explorer and Edge are prone to an information disclosure vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Internet Explorer and Edge are prone to a remote privilege-escalation vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Windows is prone to a remote code-execution vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Internet Explorer and Edge are prone to a remote privilege-escalation vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Internet Explorer is prone to a remote memory-corruption vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Internet Explorer and Edge are prone to a remote memory-corruption vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Windows is prone to an information-disclosure vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Internet Explorer and Edge are prone to a remote memory-corruption vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Windows is prone to a local privilege-escalation vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Windows is prone to an information-disclosure vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Internet Explorer and Edge are prone to a remote memory-corruption vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Edge is prone to a remote code-execution vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Windows is prone to a remote code-execution vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Internet Explorer is prone to multiple information-disclosure vulnerabilities; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Edge is prone to a security-bypass vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Windows Graphics Component is prone to a local privilege-escalation vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Edge is prone to a remote memory-corruption vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Windows is prone to an information-disclosure vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Edge is prone to a remote memory-corruption vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Windows is prone to a remote privilege-escalation vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Edge is prone to a remote memory-corruption vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Windows is prone to a local privilege-escalation vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Edge is prone to a remote memory-corruption vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Windows is prone to a local privilege-escalation vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Windows is prone to a local privilege-escalation vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Windows is prone to a local privilege-escalation vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Windows is prone to a local privilege-escalation vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Windows is prone to a local privilege-escalation vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Windows is prone to a local privilege-escalation vulnerability; fixes are available.
October 11, 2016
Type: Vulnerability. Microsoft Office is prone to a remote memory-corruption vulnerability; fixes are available.
October 11, 2016
security update
October 8, 2016
security update
October 6, 2016
security update
October 6, 2016
security update
October 5, 2016
security update
October 5, 2016
security update
October 4, 2016
security update
October 3, 2016
security update
October 1, 2016
security update
September 30, 2016
security update
September 28, 2016
security update
September 27, 2016
Type: Vulnerability. Adobe Flash Player is prone to multiple unspecified memory-corruption vulnerabilities; fixes are available.
September 27, 2016
security update
September 27, 2016
security update
September 25, 2016
security update
September 25, 2016
security update
September 24, 2016
security update
September 23, 2016
security update
September 23, 2016
security update
September 22, 2016
security update
September 21, 2016
Type: Vulnerability. Microsoft Edge is prone to a remote memory-corruption vulnerability; fixes are available.
September 21, 2016
Type: Vulnerability. Microsoft Internet Explorer and Edge are prone to a remote memory-corruption vulnerability; fixes are available.
September 21, 2016
Type: Vulnerability. Microsoft Internet Explorer and Edge are prone to a remote memory-corruption vulnerability; fixes are available.
September 20, 2016
Type: Vulnerability. Microsoft Internet Explorer is prone to a remote privilege-escalation vulnerability; fixes are available.
September 20, 2016
Type: Vulnerability. Microsoft Edge is prone to a remote memory-corruption vulnerability; fixes are available.
September 20, 2016
Dawid Golunski of LegalHackers discovered that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation. For the stable distribution (jessie), this problem has been fixed in version 8.0.14-1+deb8u3. For the unstable distribution (sid), this problem will be fixed soon. We recommend that you upgrade your tomcat8 packages.
September 16, 2016
Dawid Golunski of LegalHackers discovered that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation. For the stable distribution (jessie), this problem has been fixed in version 7.0.56-3+deb8u4. We recommend that you upgrade your tomcat7 packages.
September 16, 2016
Risk Medium Date Discovered September 13, 2016 Description Microsoft Internet Explorer and Edge are prone to an information disclosure vulnerability. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted webpage. Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks. Edge and Internet explorer […]
September 15, 2016
Several vulnerabilities have been discovered in the chromium web browser. CVE-2016-5170 A use-after-free issue was discovered in Blink/Webkit. CVE-2016-5171 Another use-after-free issue was discovered in Blink/Webkit. CVE-2016-5172 Choongwoo Han discovered an information leak in the v8 javascript library. CVE-2016-5173 A resource bypass issue was discovered in extensions. CVE-2016-5174 Andrey Kovalev discoved a way to bypass […]
September 15, 2016
It was discovered that there was a CSRF vulnerability in mailman, a web-based mailing list manager, which could allow an attacker to obtain a user’s password. For the stable distribution (jessie), this problem has been fixed in version 1:2.1.18-2+deb8u1. For the unstable distribution (sid), this problem has been fixed in version 1:2.1.23-1. We recommend that […]
September 15, 2016
Risk High Date Discovered September 13, 2016 Description Microsoft ASP.NET Core MVC is prone to multiple privilege escalation vulnerabilities. Attackers can exploit these issues to gain elevated privileges. Microsoft ASP.NET Core MVC 1.0.0 is vulnerable. Technologies Affected Microsoft ASP.NET Core MVC 1.0.0 Recommendations Block external access at the network boundary, unless external parties require service. […]
September 14, 2016
Risk Medium Date Discovered September 13, 2016 Description Microsoft Application Virtualization is prone to an information-disclosure vulnerability. An attacker can leverage this issue to obtain sensitive information that may aid in further attacks. Technologies Affected Microsoft Office 2007 SP3 Microsoft Office 2010 Service Pack 2 (32-bit editions) Microsoft Office 2010 Service Pack 2 (64-bit editions) […]
September 14, 2016
Dawid Golunski discovered that the mysqld_safe wrapper provided by the MySQL database server insufficiently restricted the load path for custom malloc implementations, which could result in privilege escalation. The vulnerability was addressed by upgrading MySQL to the new upstream version 5.5.52, which includes additional changes, such as performance improvements, bug fixes, new features, and possibly […]
September 14, 2016
Risk High Date Discovered September 13, 2016 Description Microsoft Office is prone to a remote memory-corruption vulnerability because it fails to properly handle objects in memory. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. […]
September 13, 2016
Risk High Date Discovered September 13, 2016 Description Microsoft Office is prone to a remote memory-corruption vulnerability because it fails to properly handle objects in memory. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. […]
September 13, 2016
Risk High Date Discovered September 13, 2016 Description Microsoft Office is prone to a remote memory-corruption vulnerability because it fails to properly handle objects in memory. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. […]
September 13, 2016
Risk High Date Discovered September 13, 2016 Description Microsoft Windows is prone to a remote code-execution vulnerability. Successful exploits will allow an attacker to execute arbitrary code on the target system. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for […]
September 13, 2016
Risk Medium Date Discovered September 13, 2016 Description Microsoft Office is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. An attacker can exploit this issue to perform unauthorized actions; other attacks are also possible. Technologies Affected Microsoft Outlook 2007 Microsoft Outlook 2010 (32-bit editions) Service Pack 2 Microsoft Outlook 2010 […]
September 13, 2016
Risk High Date Discovered September 13, 2016 Description Microsoft Office is prone to a remote memory-corruption vulnerability because it fails to properly handle objects in memory. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. […]
September 13, 2016
Risk High Date Discovered September 13, 2016 Description Microsoft Office is prone to a remote memory-corruption vulnerability because it fails to properly handle objects in memory. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. […]
September 13, 2016
Risk High Date Discovered September 13, 2016 Description Microsoft Office is prone to a remote memory-corruption vulnerability because it fails to properly handle objects in memory. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. […]
September 13, 2016
Risk High Date Discovered September 13, 2016 Description Microsoft Office is prone to a remote memory-corruption vulnerability because it fails to properly handle objects in memory. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. […]
September 13, 2016
Risk High Date Discovered September 13, 2016 Description Microsoft Office is prone to a remote memory-corruption vulnerability because it fails to properly handle objects in memory. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial of service conditions. […]
September 13, 2016
Multiple vulnerabilities in OpenJPEG, a JPEG 2000 image compression / decompression library, may result in denial of service or the execution of arbitrary code if a malformed JPEG 2000 file is processed. For the stable distribution (jessie), these problems have been fixed in version 2.1.0-2+deb8u1. We recommend that you upgrade your openjpeg2 packages.
September 12, 2016
Multiple vulnerabilities have been discovered in pdns, an authoritative DNS server. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-5426 / CVE-2016-5427 Florian Heinz and Martin Kluge reported that the PowerDNS Authoritative Server accepts queries with a qname’s length larger than 255 bytes and does not properly handle dot inside labels. A remote, […]
September 10, 2016
It was discovered that incorrect SASL authentication in the Inspircd IRC server may lead to users impersonating other users. For the stable distribution (jessie), this problem has been fixed in version 2.0.17-1+deb8u2. For the unstable distribution (sid), this problem has been fixed in version 2.0.23-1. We recommend that you upgrade your inspircd packages.
September 9, 2016
Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-7092 (XSA-185) Jeremie Boutoille of Quarkslab and Shangcong Luan of Alibaba discovered a flaw in the handling of L3 pagetable entries, allowing a malicious 32-bit PV guest administrator can escalate their privilege to that of the […]
September 9, 2016
It was discovered that incorrect SASL authentication in the Charybdis IRC server may lead to users impersonating other users. For the stable distribution (jessie), this problem has been fixed in version 3.4.2-5+deb8u2. For the unstable distribution (sid), this problem has been fixed in version 3.5.3-1. We recommend that you upgrade your charybdis packages.
September 7, 2016
Several vulnerabilities have been discovered in the chromium web browser. CVE-2016-5147 A cross-site scripting issue was discovered. CVE-2016-5148 Another cross-site scripting issue was discovered. CVE-2016-5149 Max Justicz discovered a script injection issue in extension handling. CVE-2016-5150 A use-after-free issue was discovered in Blink/Webkit. CVE-2016-5151 A use-after-free issue was discovered in the pdfium library. CVE-2016-5152 GiWan […]
September 6, 2016
CVE-2016-5696 Yue Cao, Zhiyun Qian, Zhongjie Wang, Tuan Dao, and Srikanth V. Krishnamurthy of the University of California, Riverside; and Lisa M. Marvel of the United States Army Research Laboratory discovered that Linux’s implementation of the TCP Challenge ACK feature results in a side channel that can be used to find TCP connections between specific […]
September 5, 2016
Hanno Boeck discovered multiple vulnerabilities in libidn, the GNU library for Internationalized Domain Names (IDNs), allowing a remote attacker to cause a denial of service against an application using the libidn library (application crash). For the stable distribution (jessie), these problems have been fixed in version 1.29-1+deb8u2. For the testing distribution (stretch), these problems have […]
September 2, 2016
Hanno Boeck and Marcin Noga discovered multiple vulnerabilities in libarchive; processing malformed archives may result in denial of service or the execution of arbitrary code. For the stable distribution (jessie), these problems have been fixed in version 3.1.2-11+deb8u2. For the testing distribution (stretch), these problems have been fixed in version 3.2.1-1. For the unstable distribution […]
August 31, 2016
Two vulnerabilities have been discovered in the server for the Tryton application platform, which may result in information disclosure of password hashes or file contents. For the stable distribution (jessie), these problems have been fixed in version 3.4.0-3+deb8u2. For the unstable distribution (sid), these problems have been fixed in version 4.0.4-1. We recommend that you […]
August 31, 2016
Two vulnerabilities were discovered in MuPDF, a lightweight PDF viewer. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2016-6265 Marco Grassi discovered a use-after-free vulnerability in MuPDF. An attacker can take advantage of this flaw to cause an application crash (denial-of-service), or potentially to execute arbitrary code with the privileges of the user […]
August 27, 2016
Alexander Sulfrian discovered a buffer overflow in the yy_get_next_buffer() function generated by Flex, which may result in denial of service and potentially the execution of code if operating on data from untrusted sources. Affected applications need to be rebuild. bogofilter will be rebuild against the updated flex in a followup update. Further affected applications should […]
August 26, 2016
This updates fixes many vulnerabilities in imagemagick: Various memory handling problems and cases of missing or incomplete input sanitising may result in denial of service or the execution of arbitrary code if malformed TIFF, WPG, RLE, RAW, PSD, Sun, PICT, VIFF, HDR, Meta, Quantum, PDB, DDS, DCM, EXIF, RGF or BMP files are processed. For […]
August 26, 2016
Andrew Carpenter of Critical Juncture discovered a cross-site scripting vulnerability affecting Action View in rails, a web application framework written in Ruby. Text declared as HTML safe will not have quotes escaped when used as attribute values in tag helpers. For the stable distribution (jessie), this problem has been fixed in version 2:4.1.8-1+deb8u4. For the […]
August 26, 2016
Two vulnerabilities were discovered in quagga, a BGP/OSPF/RIP routing daemon. CVE-2016-4036 Tamás Németh discovered that sensitive configuration files in /etc/quagga were world-readable despite containing sensitive information. CVE-2016-4049 Evgeny Uskov discovered that a bgpd instance handling many peers could be crashed by a malicious user when requesting a route dump. For the stable distribution (jessie), these […]
August 26, 2016
Felix Doerre and Vladimir Klebanov from the Karlsruhe Institute of Technology discovered a flaw in the mixing functions of Libgcrypt’s random number generator. An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. A first analysis on the impact of this bug for GnuPG shows that existing […]
August 18, 2016
Felix Doerre and Vladimir Klebanov from the Karlsruhe Institute of Technology discovered a flaw in the mixing functions of GnuPG’s random number generator. An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. A first analysis on the impact of this bug for GnuPG shows that existing […]
August 18, 2016
Multiple vulnerabilities were discovered in the dissectors for NDS, PacketBB, WSP, MMSE, RLC, LDSS, RLC and OpenFlow, which could result in denial of service or the execution of arbitrary code. For the stable distribution (jessie), these problems have been fixed in version 1.12.1+g01b65bf-4+deb8u8. For the testing distribution (stretch), these problems have been fixed in version […]
August 13, 2016
Multiple security issues have been found in Icedove, Debian’s version of the Mozilla Thunderbird mail client: Multiple memory safety errors may lead to the execution of arbitrary code or denial of service. For the stable distribution (jessie), this problem has been fixed in version 1:45.2.0-1~deb8u1. For the testing distribution (stretch), this problem has been fixed […]
August 13, 2016
Risk High Date Discovered August 9, 2016 Description Microsoft Internet Explorer and Edge are prone to a remote memory-corruption vulnerability due to a use-after-free error. Specifically, this issue occur within the ‘CAnchor’ object. Attackers can exploit this issue by enticing an unsuspecting user to view a specially crafted web page. Attackers can exploit this issue […]
August 11, 2016
Risk High Date Discovered August 9, 2016 Description Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel. A local attacker can exploit this issue to execute arbitrary code in kernel mode with elevated privileges. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 […]
August 11, 2016
Several vulnerabilities have been found in PostgreSQL-9.4, a SQL database system. CVE-2016-5423 Karthikeyan Jambu Rajaraman discovered that nested CASE-WHEN expressions are not properly evaluated, potentially leading to a crash or allowing to disclose portions of server memory. CVE-2016-5424 Nathan Bossart discovered that special characters in database and role names are not properly handled, potentially leading […]
August 11, 2016
Risk High Date Discovered August 9, 2016 Description Microsoft Windows is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. Attackers can exploit this issue to spoof and impersonate a legitimate user. Other attacks are also possible. Recommendations Deploy network intrusion detection systems to monitor network traffic for malicious activity. Deploy […]
August 10, 2016