F5 Networks BIG-IP : Net-SNMP vulnerability (K15883)

Array index error in the handlensExtendOutput2Table function in agent/mibgroup/agent/extend.c in Net-SNMP 5.7.1 allows remote authenticated users to cause a denial of service out-of-bounds read and snmpd crash via an SNMP GET request for an entry not in the extension table. CVE-2012-2141 C Tenabl...

SOL15883 - Net-SNMP vulnerability CVE-2012-2141

Vulnerability Recommended Actions If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not...

OracleVM 3.1 : xen (OVMSA-2013-0001)

The remote OracleVM system is missing necessary patches to address critical security updates : - VT-d: fix interrupt remapping source validation for devices behind legacy bridges Using SVTVERIFYBUS here doesn't make sense native Linux also uses SVTVERIFYSIDSQ here instead. CVE-2012-5634 - When xe...

OracleVM 2.2 : xen (OVMSA-2012-0048)

The remote OracleVM system is missing necessary patches to address critical security updates : - XSA-12: prevent a 64 bit guest setting reserved bits in DR7 orabug 14554090 CVE-2012-3494 - XSA-14: Don't BUGON PoD operations on a non-translated guest orabug 14554272 CVE-2012-3496 - XSA-17: console...

OracleVM 3.1 : xen (OVMSA-2012-0057)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2012-0057 for details. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory...

OracleVM 2.2 : xen (OVMSA-2012-0058)

The remote OracleVM system is missing necessary patches to address critical security updates : XSA-27: hvm: Limit the size of large HVM op batches orabug 15907978 CVE-2012-5511 XSA-29: add missing guest address range checks to XENMEMexchange handlers orabug 15907996 CVE-2012-5513 XSA-30: xen: fix...

OracleVM 2.2 : xen (OVMSA-2012-0036)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2012-3432 / XSA-10: HVM guest user mode MMIO emulation DoS vulnerability orabug 14463558 CVE-2012-3432 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were...

OracleVM 3.1 : xen (OVMSA-2012-0046)

The remote OracleVM system is missing necessary patches to address critical security updates : - Xen Security Advisory CVE-2012-4411 / XSA-19 version 2 guest administrator can access qemu monitor console Disable qemu monitor by default. The qemu monitor is an overly powerful feature which must be...

OracleVM 2.2 : xen (OVMSA-2013-0074)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86: check segment descriptor read result in 64-bit OUTS emulation XSA-67 Matthew Daley orabug 17571640 CVE-2013-4368 - x86: properly set up fbld emulation operand address XSA-66 Jan Beulich orabug...

OracleVM 3.2 : kernel-uek (OVMSA-2013-0003)

The remote OracleVM system is missing necessary patches to address critical security updates : - bonding: fixup typo in rlb mode of bond and bridge fix Guru Anbalagane Orabug: 16069448 - bonding: rlb mode of bond should not alter ARP originating via bridge zheng.li Orabug: 14650975 - compilation...

OracleVM 3.2 : kernel-uek (OVMSA-2013-0008)

The remote OracleVM system is missing necessary patches to address critical security updates : - kmod: make requestmodule killable Oleg Nesterov Orabug: 16286305 CVE-2012-4398 - kmod: introduce callmodprobe helper Oleg Nesterov Orabug: 16286305 CVE-2012-4398 - usermodehelper: implement UMHKILLABL...

OracleVM 3.0 : xen (OVMSA-2012-0050)

The remote OracleVM system is missing necessary patches to address critical security updates : - compat/gnttab: Prevent infinite loop in compat code c/s 20281:95ea2052b41b, which introduces Grant Table version 2 hypercalls introduces a vulnerability whereby the compat hypercall handler can fall...

OracleVM 3.1 : xen (OVMSA-2012-0021)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86-64: detect processors subject to AMD erratum 121 and refuse to bootCVE-2006-0744 - guest denial of service on syscall/sysenter exception generation CVE-2012-0217,CVE-2012-0218 - Remove unnecessary...

OracleVM 3.0 : xen (OVMSA-2013-0002)

The remote OracleVM system is missing necessary patches to address critical security updates : - VT-d: fix interrupt remapping source validation for devices behind legacy bridges Using SVTVERIFYBUS here doesn't make sense native Linux also uses SVTVERIFYSIDSQ here instead. CVE-2012-5634...

OracleVM 3.0 : xen (OVMSA-2012-0040)

The remote OracleVM system is missing necessary patches to address critical security updates : - console: bounds check whenever changing the cursor due to an escape code The device model used by fully virtualised HVM domains, qemu, does not properly handle escape VT100 sequences when emulating...

OracleVM 3.1 : xen (OVMSA-2012-0051)

The remote OracleVM system is missing necessary patches to address critical security updates : - libxc: builder: limit maximum size of kernel/ramdisk. Allowing user supplied kernels of arbitrary sizes, especially during decompression, can swallow up dom0 memory leading to either virtual address...

OracleVM 2.2 : xen (OVMSA-2012-0022)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2012-0217 CVE-2012-0218: guest DoS on syscall/sysenter exception generation orabug 13993157 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted fr...

Important: Red Hat Security Advisory: Red Hat JBoss Operations Network 3.3.0 update

Red Hat JBoss Operations Network 3.2.3, which fixes multiple security issues and several bugs, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give...

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...

SOL15863 - Libtiff vulnerabilities CVE-2012-1173 and CVE-2012-2088

Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, or does not list a version that is later than the version you...