This update for lcms2 fixes the following issues :

CVE-2018-16435: A integer overflow was fixed in the AllocateDataSet function in cmscgats.c, that could lead to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile. (bsc#1108813)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_0-openjdk to version 7u201 fixes the following issues :

Security issues fixed :

CVE-2018-3136: Manifest better support (bsc#1112142)

CVE-2018-3139: Better HTTP Redirection (bsc#1112143)

CVE-2018-3149: Enhance JNDI lookups (bsc#1112144)

CVE-2018-3169: Improve field accesses (bsc#1112146)

CVE-2018-3180: Improve TLS connections stability (bsc#1112147)

CVE-2018-3214: Better RIFF reading support (bsc#1112152)

CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35 (bsc#1112153)

CVE-2018-16435: heap-based buffer overflow in SetData function in cmsIT8LoadFromFile

CVE-2018-2938: Support Derby connections (bsc#1101644)

CVE-2018-2940: Better stack walking (bsc#1101645)

CVE-2018-2952: Exception to Pattern Syntax (bsc#1101651)

CVE-2018-2973: Improve LDAP support (bsc#1101656)

CVE-2018-3639 cpu speculative store bypass mitigation

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_8_0-openjdk to version 8u191 fixes the following issues :

Security issues fixed :

CVE-2018-3136: Manifest better support (bsc#1112142)

CVE-2018-3139: Better HTTP Redirection (bsc#1112143)

CVE-2018-3149: Enhance JNDI lookups (bsc#1112144)

CVE-2018-3169: Improve field accesses (bsc#1112146)

CVE-2018-3180: Improve TLS connections stability (bsc#1112147)

CVE-2018-3214: Better RIFF reading support (bsc#1112152)

CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35 (bsc#1112153)

CVE-2018-3183: Improve script engine support (bsc#1112148)

CVE-2018-16435: heap-based buffer overflow in SetData function in cmsIT8LoadFromFile

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was an integer overflow vulnerability in the 'Little CMS 2' colour management library. A specially crafted input file could lead to a heap-based buffer overflow.

For Debian 8 'Jessie', this issue has been fixed in lcms2 version 2.6-3+deb8u2.

We recommend that you upgrade your lcms2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2018-16435

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2018-17478 CVE-2018-17479. Update to 70.0.3538.110.

----

Update to chromium 70.0.3538.77. Fixes CVE-2018-16435 CVE-2018-17462 CVE-2018-17463 CVE-2018-17464 CVE-2018-17465 CVE-2018-17466 CVE-2018-17467 CVE-2018-17468 CVE-2018-17469 CVE-2018-17470 CVE-2018-17471 CVE-2018-17473 CVE-2018-17474 CVE-2018-17475 CVE-2018-17476 CVE-2018-5179 CVE-2018-17477

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the lcms2 package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Little CMS (aka Little Color Management System) 2.9 has     an integer overflow in the AllocateDataSet function in     cmscgats.c, leading to a heap-based buffer overflow in     the SetData function via a crafted file in the second     argument to cmsIT8LoadFromFile.(CVE-2018-16435)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the lcms2 package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - Little CMS (aka Little Color Management System) 2.9 has     an integer overflow in the AllocateDataSet function in     cmscgats.c, leading to a heap-based buffer overflow in     the SetData function via a crafted file in the second     argument to cmsIT8LoadFromFile.(CVE-2018-16435)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202105-18 (LittleCMS: User-assisted execution of arbitrary code)

    It was discovered that LittleCMS (aka Little Color Management System)       had an integer overflow in the AllocateDataSet function in cmscgats.c.
  Impact :

    A remote attacker could entice a user or automated system to open a       specially crafted file containing malicious color data, possibly       resulting in execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
120148	SUSE SLED15 / SLES15 Security Update : lcms2 (SUSE-SU-2018:3498-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/10	medium
121059	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2019:0049-1) (Spectre)	Nessus	SuSE Local Security Checks	2019/1/10	2026/1/9	critical
121091	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:0057-1)	Nessus	SuSE Local Security Checks	2019/1/11	2024/6/27	critical
117350	Debian DLA-1496-1 : lcms2 security update	Nessus	Debian Local Security Checks	2018/9/7	2024/8/8	medium
120500	Fedora 29 : lcms2 (2018-6ac39c63c4)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/5	medium
120933	Fedora 28 : chromium (2018-fd194a1f14)	Nessus	Fedora Local Security Checks	2019/1/3	2024/6/28	critical
145163	EulerOS 2.0 SP3 : lcms2 (EulerOS-SA-2021-1081)	Nessus	Huawei Local Security Checks	2021/1/20	2024/1/29	medium
146707	EulerOS 2.0 SP2 : lcms2 (EulerOS-SA-2021-1313)	Nessus	Huawei Local Security Checks	2021/2/22	2024/1/19	medium
151329	EulerOS Virtualization for ARM 64 3.0.2.0 : lcms2 (EulerOS-SA-2021-2098)	Nessus	Huawei Local Security Checks	2021/7/2	2023/12/11	medium
156979	GLSA-202105-18 : LittleCMS: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	2022/1/24	2023/12/21	medium

检测

插件搜索

medium

critical

critical

medium

medium

critical

medium

medium

medium

medium