Thank you for reading the Linux Advisory Watch Security Newsletter. The purpose of this document is to provide our readers with a quick summary of each week's vendor security bulletins and pointers on methods to improve the security posture of your open source system. Vulnerabilities affect nearly every vendor virtually every week, so be sure to read through to find the updates your distributor have made available.

LinuxSecurity.com Feature Extras:

- Social engineering is the practice of learning and obtaining valuable information by exploiting human vulnerabilities. It is an art of deception that is considered to be vital for a penetration tester when there is a lack of information about the target that can be exploited.

- When you’re dealing with a security incident it’s essential you – and the rest of your team – not only have the skills they need to comprehensively deal with an issue, but also have a framework to support them as they approach it. This framework means they can focus purely on what they need to do, following a process that removes any vulnerabilities and threats in a proper way – so everyone who depends upon the software you protect can be confident that it’s secure and functioning properly.

  Debian: DSA-3991-1: qemu security update (Oct 3)
 

Multiple vulnerabilities were found in in qemu, a fast processor emulator: CVE-2017-9375
  Debian: DSA-3990-1: asterisk security update (Oct 3)
 

Klaus-Peter Junghann discovered that insufficient validation of RTCP packets in Asterisk may result in an information leak. Please see the upstream advisory at http://downloads.asterisk.org/pub/security/AST-2017-008.html for
  Debian: DSA-3989-1: dnsmasq security update (Oct 2)
 

Felix Wilhelm, Fermin J. Serna, Gabriel Campana, Kevin Hamacher, Ron Bowes and Gynvael Coldwind of the Google Security Team discovered several vulnerabilities in dnsmasq, a small caching DNS proxy and DHCP/TFTP server, which may result in denial of service, information
  Debian: DSA-3988-1: libidn2-0 security update (Sep 30)
 

An integer overflow vulnerability was discovered in decode_digit() in libidn2-0, the GNU library for Internationalized Domain Names (IDNs), allowing a remote attacker to cause a denial of service against an application using the library (application crash).
  Debian: DSA-3987-1: firefox-esr security update (Sep 29)
 

Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, buffer overflows and other implementation errors may lead to the execution of arbitrary code, denial of service, cross-site scripting or bypass of
  Debian: DSA-3986-1: ghostscript security update (Sep 29)
 

Several vulnerabilities were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which may result in denial of service if a specially crafted Postscript file is processed.
  Debian: DSA-3985-1: chromium-browser security update (Sep 28)
 

Several vulnerabilities have been discovered in the chromium web browser. CVE-2017-5111
 
  Fedora 25: samba Security Update (Oct 6)
 

Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163
  Fedora 26: dnsmasq Security Update (Oct 6)
 

CVE-2017-14491 CVE-2017-14492 CVE-2017-14493 CVE-2017-14494 CVE-2017-14495 CVE-2017-14496
  Fedora 25: MySQL-zrm Security Update (Oct 6)
 

Fix command logging
  Fedora 26: MySQL-zrm Security Update (Oct 5)
 

Fix command logging
  Fedora 27: yadifa Security Update (Oct 5)
 

20170912: YADIFA 2.2.6 --- Fixes an issue where a maliciously crafted message may block the server.
  Fedora 26: kernel Security Update (Oct 4)
 

Rebase to the 4.13 series of kernels
  Fedora 25: kernel Security Update (Oct 4)
 

The 4.12.14 stable kernel update contains a number of important fixes across the tree.
  Fedora 27: openvpn Security Update (Oct 4)
 

Maintenance release with several minor upstream bugfixes and a security fix related to legacy configurations deploying the deprecated `key-method 1` configuration option ([CVE-2017-12166](https://community.openvpn.net/openvpn/wiki/CVE-2017-12166)). From this update of, OpenVPN will use the lz4 compression library from Fedora
  Fedora 27: ImageMagick Security Update (Oct 4)
 

6.9.9-15
  Fedora 27: rubygem-rmagick Security Update (Oct 4)
 

6.9.9-15
  Fedora 27: libwmf Security Update (Oct 4)
 

- Related: CVE-2017-6362 remove problematic function
  Fedora 27: ImageMagick Security Update (Oct 4)
 

6.9.9-15
  Fedora 27: rubygem-rmagick Security Update (Oct 4)
 

6.9.9-15
  Fedora 27: openvpn Security Update (Oct 4)
 

Maintenance release with several minor upstream bugfixes and a security fix related to legacy configurations deploying the deprecated `key-method 1` configuration option ([CVE-2017-12166](https://community.openvpn.net/openvpn/wiki/CVE-2017-12166)). From this update of, OpenVPN will use the lz4 compression library from Fedora
  Fedora 27: libwmf Security Update (Oct 4)
 

- Related: CVE-2017-6362 remove problematic function
  Fedora 26: mingw-LibRaw Security Update (Oct 2)
 

Update to version 0.18.5, see for details.
  Fedora 26: perl Security Update (Oct 2)
 

Update perl(:MODULE_COMPAT_*) ---- Security fix for CVE-2017-12837 CVE-2017-12883 (see <;)
  Fedora 26: openvpn Security Update (Oct 2)
 

Maintenance release with several minor upstream bugfixes and a security fix related to legacy configurations deploying the deprecated `key-method 1` configuration option ([CVE-2017-12166](https://community.openvpn.net/openvpn/wiki/CVE-2017-12166)). From this update of, OpenVPN will use the lz4 compression library from Fedora
  Fedora 26: firefox Security Update (Oct 2)
 

- Updated to latest upstream (56.0)
  Fedora 27: perl Security Update (Oct 2)
 

Update perl(:MODULE_COMPAT_*) ---- Security fix for CVE-2017-12837 CVE-2017-12883 (see <;)
  Fedora 27: nodejs Security Update (Oct 2)
 

https://github.com/nodejs/node/blob/v8.6.0/doc/changelogs/CHANGELOG_V8.md https://groups.google.com/forum/#!topic/nodejs-sec/EatXB-MujW0
  Fedora 27: ruby Security Update (Oct 2)
 

Update to the Ruby 2.4.2.
  Fedora 25: xen Security Update (Oct 1)
 

xen: various flaws (#1490884) Missing NUMA node parameter verification [XSA-231, CVE-2017-14316] Missing check for grant table [XSA-232, CVE-2017-14318] cxenstored: Race in domain cleanup [XSA-233, CVE-2017-14317] insufficient grant unmapping checks for x86 PV guests [XSA-234, CVE-2017-14319]
  Fedora 25: pkgconf Security Update (Sep 30)
 

# Security fixes - fix crash in edge case where a .pc file has misquoting in a fragment list. # Other bug fixes: - fix logic edge case when comparing relocated paths
  Fedora 25: moodle Security Update (Sep 30)
 

Patches for CVE-2017-12156, CVE-2017-12157.
  Fedora 25: php-horde-passwd Security Update (Sep 30)
 

**passwd 5.0.7** * [jan] Officially support PHP 7. * [jan] SECURITY: Fix open redirects.
  Fedora 25: php-horde-wicked Security Update (Sep 30)
 

**wicked 2.0.8** * [jan] SECURITY: Fix unauthorized access to page attachments.
  Fedora 25: php-horde-nag Security Update (Sep 30)
 

**nag 4.2.17** * [jan] SECURITY: Fix unauthorized access to task exports. * [jan] Fix regression when exporting single tags to iCalendar CATEGORIES. * [jan] Officially support PHP 7.
  Fedora 27: dnsmasq Security Update (Sep 30)
 

Fixes CVE-2017-13704
  Fedora 27: git Security Update (Sep 30)
 

These releases are about hardening `git shell` that is used on servers against an unsafe user input, which `git cvsserver` copes with poorly. From the release notes: * "git cvsserver" no longer is invoked by "git shell" by default, as it is old and largely unmaintained. * Various Perl scripts did not use safe_pipe_capture() instead of backticks, leaving them susceptible to
  Fedora 27: MySQL-zrm Security Update (Sep 30)
 

Fix command logging
  Fedora 27: poppler Security Update (Sep 30)
 

- CVE-2017-14520 Floating point exception in Splash::scaleImageYuXd
  Fedora 27: mingw-LibRaw Security Update (Sep 30)
 

Update to version 0.18.5, see for details.
  Fedora 27: chromium Security Update (Sep 30)
 

Update to 61.0.3163.100. Security fix for CVE-2017-5111, CVE-2017-5112, CVE-2017-5113, CVE-2017-5114, CVE-2017-5115, CVE-2017-5116, CVE-2017-5117, CVE-2017-5118, CVE-2017-5119, CVE-2017-5120, CVE-2017-5121, CVE-2017-5122
  Fedora 27: httpd Security Update (Sep 30)
 

This is a release fixing a security fix applied upstream, known as "optionsbleed" in popular parlance. It is relevant for hosted and co-located instances of Fedora (and why wouldn't you?).
  Fedora 27: samba Security Update (Sep 30)
 

Security fix for CVE-2017-12150 CVE-2017-12151 CVE-2017-12163
  Fedora 27: LibRaw Security Update (Sep 30)
 

Fix for possible buffer overrun in kodak_65000 decoder Fix for possible heap overrun in Canon makernotes parser Fix for CVE-2017-13735 CVE-2017-14265: Additional check for X-Trans CFA pattern data
  Fedora 27: php-horde-passwd Security Update (Sep 30)
 

**passwd 5.0.7** * [jan] Officially support PHP 7. * [jan] SECURITY: Fix open redirects.
  Fedora 27: php-horde-wicked Security Update (Sep 30)
 

**wicked 2.0.8** * [jan] SECURITY: Fix unauthorized access to page attachments.
  Fedora 27: pkgconf Security Update (Sep 30)
 

# Security fixes - fix crash in edge case where a .pc file has misquoting in a fragment list. # Other bug fixes: - fix logic edge case when comparing relocated paths
  Fedora 27: libmspack Security Update (Sep 30)
 

Security fix for CVE-2017-6419 and CVE-2017-11423
  Fedora 27: php-horde-Horde-Image Security Update (Sep 30)
 

**Horde_Image 2.5.1** * [mjr] SECURITY: Fix more potential places for command injections.
  Fedora 27: emacs Security Update (Sep 30)
 

Rebuilt against new ImageMagick ---- rhbz#1490649 - emacs-25.3 is available rhbz#1490410 - unsafe enriched mode translations (security)
  Fedora 27: ImageMagick Security Update (Sep 30)
 

ImageMagick 6.9.9-13
  Fedora 27: rubygem-rmagick Security Update (Sep 30)
 

ImageMagick 6.9.9-13
  Fedora 27: python-jwt Security Update (Sep 30)
 

Upgrade to 1.5.3 and also note that 1.5.1 fixed CVE-2017-11424.
  Fedora 27: mpg123 Security Update (Sep 30)
 

Update to upstream release 1.25.6
  Fedora 27: pure-ftpd Security Update (Sep 30)
 

This is an update fixing loading the configuration file.
  Fedora 27: LibRaw Security Update (Sep 30)
 

Patch for CVE-2017-14348 ---- Fix for possible heap overrun in Canon makernotes parser Fix for CVE-2017-13735 CVE-2017-14265: Additional check for X-Trans CFA pattern data ---- LibRaw 0.18.3 Fix for CVE-2017-13735 Additional checks for X-Trans CFA pattern data ---- Patch for CVE-2017-13735.
  Fedora 27: jasper Security Update (Sep 30)
 

Rebase to the latest upstream version 2.0.14. This update contains security fix for CVS -2017-1000050.
  Fedora 27: libbson Security Update (Sep 30)
 

This release fixes a crash whwhen parsing an empty code string of a codewscope type. It also make functions for checking library version available for C++ programs.
  Fedora 27: libwpd Security Update (Sep 30)
 

new upstream release ---- * heap overflow in libwpd
  Fedora 27: mingw-LibRaw Security Update (Sep 30)
 

Update to version 0.18.4, see https://github.com/LibRaw/LibRaw/blob/0.18-stable/Changelog.txt for details. ---- Update to version 0.18.3, see for details.
  Fedora 27: bluez Security Update (Sep 30)
 

Security fix for CVE-2017-1000250 ---- - This update adds support for cable pairing for PlayStation 3 and 4 controllers. - Add scripts to automatically btattach serial-port / uart connected Broadcom HCIs found on some Atom based x86 hardware
  Fedora 27: xen Security Update (Sep 30)
 

xen: various flaws (#1490884) Missing NUMA node parameter verification [XSA-231, CVE-2017-14316] Missing check for grant table [XSA-232, CVE-2017-14318] cxenstored: Race in domain cleanup [XSA-233, CVE-2017-14317] insufficient grant unmapping checks for x86 PV guests [XSA-234, CVE-2017-14319]
  Fedora 27: rawtherapee Security Update (Sep 30)
 

Security fix for CVE-2017-13735
  Fedora 27: drupal7-views Security Update (Sep 30)
 

* [7.x-3.18](https://www.drupal.org/project/views/releases/7.x-3.18) * [7.x-3.17](https://www.drupal.org/project/views/releases/7.x-3.17) * [Moderately Critical - Access Bypass - DRUPAL-SA- CONTRIB-2017-068](https://www.drupal.org/node/2902604)
  Fedora 27: firefox Security Update (Sep 30)
 

Update to the latest upstream version.
  Fedora 27: openjpeg2 Security Update (Sep 30)
 

This update fixes CVE-2017-12982, CVE-2017-14040, CVE-2017-14041 and two other security vulnerabilities.
  Fedora 27: mingw-libzip Security Update (Sep 30)
 

Update to version 1.3.0, see https://libzip.org/news/ for details. ---- This update backports security fix for CVE-2017-14107.
  Fedora 27: file Security Update (Sep 30)
 

- fix a possible stack based buffer overflow (CVE-2017-1000249)
  Fedora 27: freexl Security Update (Sep 30)
 

This update fixes a Cisco Talos CVE: "A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability."
  Fedora 27: FlightGear Security Update (Sep 30)
 

This update fixes a security bug in the FGLogger subsystem, to prevent it from overwriting arbitrary files the user has write access to (CVE-2017-13709)
  Fedora 27: cyrus-imapd Security Update (Sep 30)
 

Update to latest upstream version 3.0.4. This fixes a handful bugs, including one security issue (CVE-2017-14230).
  Fedora 27: libgcrypt Security Update (Sep 30)
 

Minor security update
  Fedora 27: rubygems Security Update (Sep 30)
 

Update to RubyGems 2.6.13.
  Fedora 27: krb5 Security Update (Sep 30)
 

- Prevent applications from accidentally implementing CVE-2017-11462 (double free if sec_context is copied). - fc26+: Add ccselect hostrealm module for ccache selection based on service hostname.
  Fedora 27: lightdm Security Update (Sep 30)
 

- lightdm-1.24.0 - Disable guest login as system default preset (CVE-2017-8900) - Modernize spec-file
  Fedora 27: libzip Security Update (Sep 30)
 

**Version 1.3.0** It contains fixes for two possible security problems. The problems were identified by Brian 'geeknik' Carpenter and Agostino Sarubbo using AFL. The changes are: * Support bzip2 compressed zip archives * Improve file progress callback code * Fix zip_fdopen() * CVE-2017-12858: Fix double free(). * CVE-2017-14107: Improve EOCD64 parsing.
  Fedora 27: mimedefang Security Update (Sep 30)
 

MIMEDefang 2.81 Sys::Syslog has a developer tag added (like 0.33_01 on Debian Stretch). * Make mimedefang and mimedefang-multiplexor write their PID files as root to avoid an unprivileged user tampering with the pidfiles. Thanks to Michael Orlitzky for pointing this issue out.
  Fedora 26: php-horde-nag Security Update (Sep 30)
 

**nag 4.2.17** * [jan] SECURITY: Fix unauthorized access to task exports. * [jan] Fix regression when exporting single tags to iCalendar CATEGORIES. * [jan] Officially support PHP 7.
  Fedora 26: php-horde-wicked Security Update (Sep 30)
 

**wicked 2.0.8** * [jan] SECURITY: Fix unauthorized access to page attachments.
  Fedora 26: php-horde-passwd Security Update (Sep 30)
 

**passwd 5.0.7** * [jan] Officially support PHP 7. * [jan] SECURITY: Fix open redirects.
  Fedora 27: gd Security Update (Sep 30)
 

**Version 2.2.5** - 2017-08-30 * **Security** - Double-free in gdImagePngPtr(). **CVE-2017-6362** - Buffer over-read into uninitialized memory. **CVE-2017-7890** * **Fixed** - Fix #109: XBM reading fails with printed error - Fix #338: Fatal and normal libjpeg/ibpng errors not distinguishable - Fix #357: 2.2.4: Segfault in test suite - Fix #386:
  Fedora 27: mingw-libidn2 Security Update (Sep 30)
 

Libidn2 2.0.4 (released 2017-08-30) integer overflow in bidi.c/_isBidi() * Fix integer overflow in puny_decode.c/decode_digit() * Improve docs * Fix idna_free() to idn_free() * Update fuzzer corpora
  Fedora 25: mercurial Security Update (Sep 28)
 

Security fix for CVE-2017-1000115, CVE-2017-1000116
  Fedora 25: php-horde-Horde-Image Security Update (Sep 28)
 

**Horde_Image 2.5.1** * [mjr] SECURITY: Fix more potential places for command injections.
  Fedora 26: php-horde-Horde-Image Security Update (Sep 28)
 

**Horde_Image 2.5.1** * [mjr] SECURITY: Fix more potential places for command injections.
  Fedora 26: moodle Security Update (Sep 28)
 

Patches for CVE-2017-12156, CVE-2017-12157.
  Fedora 26: poppler Security Update (Sep 28)
 

- CVE-2017-14520 Floating point exception in Splash::scaleImageYuXd
  Fedora 26: git Security Update (Sep 28)
 

These releases are about hardening `git shell` that is used on servers against an unsafe user input, which `git cvsserver` copes with poorly. From the release notes: * "git cvsserver" no longer is invoked by "git shell" by default, as it is old and largely unmaintained. * Various Perl scripts did not use safe_pipe_capture() instead of backticks, leaving them susceptible to
  Fedora 26: pure-ftpd Security Update (Sep 28)
 

This is an update fixing loading the configuration file.
 
  Slackware: 2017-279-02: openjpeg Security Update (Oct 6)
 

New openjpeg packages are available for Slackware 14.2 and -current to fix security issues.
  Slackware: 2017-279-03: xorg-server Security Update (Oct 6)
 

New xorg-server packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.
  Slackware: 2017-279-01: curl Security Update (Oct 6)
 

New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.
  Slackware: 2017-271-01: mozilla-firefox Security Update (Sep 28)
 

New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues.
  Slackware: 2017-270-01: gegl Security Update (Sep 28)
 

New gegl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.
 
  SuSE: 2017:2655-1: important: portus (Oct 6)
 

An update that fixes one vulnerability is now available. An update that fixes one vulnerability is now available. An update that fixes one vulnerability is now available.
  openSUSE: 2017:2633-1: important: dnsmasq (Oct 3)
 

An update that fixes 6 vulnerabilities is now available. An update that fixes 6 vulnerabilities is now available. An update that fixes 6 vulnerabilities is now available.
  SuSE: 2017:2619-1: important: dnsmasq (Oct 2)
 

An update that fixes 8 vulnerabilities is now available. An update that fixes 8 vulnerabilities is now available. An update that fixes 8 vulnerabilities is now available.
  SuSE: 2017:2617-1: important: dnsmasq (Oct 2)
 

An update that fixes 8 vulnerabilities is now available. An update that fixes 8 vulnerabilities is now available. An update that fixes 8 vulnerabilities is now available.
  SuSE: 2017:2616-1: important: dnsmasq (Oct 2)
 

An update that solves 8 vulnerabilities and has three fixes An update that solves 8 vulnerabilities and has three fixes An update that solves 8 vulnerabilities and has three fixes is now available. is now available.
  openSUSE: 2017:2615-1: important: Mozilla Firefox and NSS (Oct 2)
 

An update that fixes 8 vulnerabilities is now available. An update that fixes 8 vulnerabilities is now available. An update that fixes 8 vulnerabilities is now available.
  SuSE: 2017:2438-2: important: Linux Kernel Live Patch 8 for SLE 12 SP1 (Oct 2)
 

An update that solves one vulnerability and has one errata An update that solves one vulnerability and has one errata An update that solves one vulnerability and has one errata is now available. is now available.
  SuSE: 2017:2611-1: important: xen (Oct 2)
 

An update that fixes three vulnerabilities is now available. An update that fixes three vulnerabilities is now available. An update that fixes three vulnerabilities is now available.
  openSUSE: 2017:2604-1: important: spice (Sep 30)
 

An update that fixes one vulnerability is now available. An update that fixes one vulnerability is now available. An update that fixes one vulnerability is now available.
  SuSE: 2017:2589-1: important: MozillaFirefox (Sep 28)
 

An update that fixes 16 vulnerabilities is now available. An update that fixes 16 vulnerabilities is now available. An update that fixes 16 vulnerabilities is now available.
 
  Ubuntu 3439-1: Ruby vulnerabilities (Oct 5)
 

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Ruby. Software Description: - ruby1.9.1: Object-oriented scripting language Details: It was discovered that Ruby incorrectly handled certain inputs. [More...]
  Ubuntu 3430-2: Dnsmasq vulnerabilities (Oct 3)
 

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 ESM Summary: Several security issues were fixed in Dnsmasq. Software Description: - dnsmasq: Small caching DNS proxy and DHCP/TFTP server Details: USN-3430-1 fixed several vulnerabilities in Dnsmasq. This update [More...]
  Ubuntu 3433-1: poppler vulnerabilities (Oct 2)
 

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 17.04 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: poppler could be made to crash if opened a specially crafted file. Software Description: - poppler: PDF rendering library Details: It was discovered that Poppler incorrectly handled certain files. [More...]