Oracle Linux 7 : pacemaker (ELSA-2020-5453)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5453 advisory. - Prevent ACL bypass CVE-2020-25654 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has...

Oracle Linux 7 : sssd (ELSA-2019-2177)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2177 advisory. - Resolves: rhbz1660874 - CVE-2018-16838 sssd: improper implementation of GPOs due to too restrictive permissions rhel-7 Tenable has extracted the...

Oracle Linux 7 : libcgroup (ELSA-2019-2047)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-2047 advisory. 0.41-21 - fix CVE-2018-14348 resolves: 1612122 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

Oracle Linux 7 : httpd (ELSA-2020-3958)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3958 advisory. - Resolves: 1823262 - CVE-2020-1934 httpd: modproxyftp use of uninitialized value - Resolves: 1565491 - CVE-2017-15715 httpd: bypass with a trailing...

Oracle Linux 7 : resource-agents (ELSA-2020-5004)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5004 advisory. - Upgrade bundled python-httplib2 to fix CVE-2020-11078 Resolves: rhbz1850992 Tenable has extracted the preceding description block directly from the Oracle Lin...

Oracle Linux 7 : dovecot (ELSA-2020-1062)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1062 advisory. - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory...

Oracle Linux 7 : freerdp / and / vinagre (ELSA-2019-2157)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-2157 advisory. freerdp 2.0.0-1.rc4 - Update to 2.0.0-rc4 1291254 vinagre 3.22.0-12 - Apply the patch - Resolves: 1569552 3.22.0-11 - Set maximum length of RDP password to 255...

Oracle Linux 7 : ELSA-2017-1484-1: / kernel (ELSA-2017-14841)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-14841 advisory. - An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be jumped over the...

Oracle Linux 7 : httpd24-httpd (ELSA-2015-1666)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1666 advisory. - core: fix chunk header parsing defect CVE-2015-3183 - core: replace of apsomeauthrequired with apsomeauthnrequired and apforceauthn hook CVE-2015-318...

Oracle Linux 7 : olcne / kubernetes (ELSA-2020-5653)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5653 advisory. - CVE-2019-11254 kube-apiserver Denial of Service vulnerability from malicious YAML payloads - Golang CVE-2019-16276 - Golang CVE-2019-16276 Tenable has extract...

Oracle Linux 7 : ImageMagick (ELSA-2020-1180)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1180 advisory. autotrace 0.31.1-38 - Resolves: 1765205 rebuild against new IM emacs 1:24.3-23 - Resolves: 1765208 rebuild against new IM ImageMagick 6.9.10.68-3 -...

Oracle Linux 7 : tomcat (ELSA-2020-4004)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4004 advisory. - Resolves: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS - Resolves: CVE-2020-9484 tomca...

Oracle Linux 6 / 7 : openssl (ELSA-2016-3621)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-3621 advisory. - fix CVE-2016-2177 - possible integer overflow - fix CVE-2016-2178 - non-constant time DSA operations - fix CVE-2016-2179 - further DoS issues in...

Oracle Linux 7 : runc (ELSA-2019-4540)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2019-4540 advisory. - Apply patch for CVE-2019-5736 Wiekus Beukes - Resolves: 1412238 - CVE-2016-9962 - set init processes as non-dumpable, runc patch from Michael Crosby Tenable h...

Oracle Linux 7 : docker-engine / docker-cli (ELSA-2020-5728)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5728 advisory. - update to 19.03.11 for CVE-2020-13401 - apply e4931e664feac6fa8846f3f04268a0cc98822549, fixes CVE-2019-5736 - update to 19.03.11 for CVE-2020-13401 - apply...

Snappy PHAR deserialization vulnerability

Issue On March 17th the vulnerability CVE-2023-28115 was disclosed, allowing an attacker to gain remote code execution through PHAR deserialization. To fix this issue, the version 1.4.2 was released with an additional check in the affected function to prevent the usage of the phar:// wrapper...

[R1] Tenable Core on Oracle Linux 8 General Advisory

R1 Tenable Core on Oracle Linux 8 General Advisory Arnie Cabral Wed, 09/06/2023 - 06:19 Tenable Core is currently built on CentOS 7, which will be reaching end of life EoL on June 30, 2024. As a result of the approaching CentOS 7 EoL, Tenable Core is moving to Oracle Linux 8...

Freecycle Data Breach Impacts 7 Million Users

By Waqas The Freecycle data breach is the latest in a string of high-profile security incidents affecting online platforms in the United Kingdom. This is a post from HackRead.com Read the original post: Freecycle Data Breach Impacts 7 Million Users...

Security Bulletin: Due to use of Apache Cassandra , IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to an authenticated attacker to gaining elevated privileges.

Summary Apache cassandra is used by IBM Cloud Pak for Multicloud Management Monitoring as part of saving data on several components. Vulnerability Details CVEID:CVE-2023-30601 DESCRIPTION: Apache Cassandra could allow a local authenticated attacker to gain elevated privileges on the system, cause...

Security Bulletin: Due to use of FasterXML Jackson-databind, IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to a denial of service.

Summary Jackson-databind is used by IBM Cloud Pak for Multicloud Management Monitoring, as part of converting serializing/deserializing data formats from XML/JSON. Vulnerability Details CVEID:CVE-2022-42004 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a...