Debian DLA-2943-1 : ruby-sidekiq - LTS security update

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-2943 advisory. - Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used. CVE-2021-30151 - In api.rb in...

Debian DLA-2946-1 : tryton-proteus - LTS security update

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-2946 advisory. - An XXE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Applicati...

[SECURITY] [DLA 2943-1] ruby-sidekiq security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2943-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta March 10, 2022 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 2944-1] nbd security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2944-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb March 10, 2022 https://wiki.debian.org/LTS -...

USN-5320-1: Expat vulnerabilities and regression

USN-5288-1 fixed several vulnerabilities in Expat. For CVE-2022-25236 it caused a regression and an additional patch was required. This update address this regression and several other vulnerabilities. It was discovered that Expat incorrectly handled certain files. An attacker could possibly use...

Debian DLA-2942-1 : firefox-esr - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2942 advisory. - If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts, they were able to craft a link that, when clicked, woul...

[SECURITY] [DLA 2940-1] linux security update

Debian LTS Advisory DLA-2940-1 [email protected] https://www.debian.org/lts/security/ Ben Hutchings March 09, 2022 https://wiki.debian.org/LTS Package : linux Version : 4.9.303-1 CVE ID : CVE-2021-3640 CVE-2021-3752 CVE-2021-4002 CVE-2021-4083 CVE-2021-4155 CVE-2021-4202 CVE-2021-28711...

Exploit for Improper Initialization in Linux Linux_Kernel

Information c Exploit Title: Local Privilege Escalation...

Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5317-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5317-1 advisory. Nick Gregory discovered that the Linux kernel incorrectly handled network offload functionality. A local attacker could use this to cause a denial of...

Ubuntu 16.04 ESM / 18.04 LTS : Linux kernel vulnerabilities (USN-5319-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5319-1 advisory. Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that hardware mitigations added by Intel to the...

KB5011491: Windows 10 LTS 1507 Security Update (March 2022)

The remote Windows host is missing security update 5011491. It is, therefore, affected by multiple vulnerabilities: - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2022-23283, CVE-2022-24459, CVE-2022-23284, CVE-2022-23296, CVE-2022-23287,...

Debian DLA-2938-1 : twisted - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2938 advisory. - Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an...

Ubuntu 20.04 LTS : Redis vulnerability (USN-5316-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5316-1 advisory. Reginaldo Silva discovered that due to a packaging issue, a remote attacker with the ability to execute arbitrary Lua scripts could possibly escape the Lua sandbo...

[SECURITY] [DLA 2935-1] expat security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2935-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort March 07, 2022 https://wiki.debian.org/LTS -...

Debian DLA-2931-1 : cyrus-sasl2 - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2931 advisory. - In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. CVE-2022-24407 Note that Nessus has no...

Debian DLA-2933-1 : firefox-esr - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2933 advisory. Two security issues have been found in the Mozilla Firefox web browser, which result in the execution of arbitrary code. For Debian 9 stretch, these problems have...

Debian DLA-2937-1 : gif2apng - LTS security update

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-2937 advisory. Three issues have been discovered in gif2apng: tool for converting animated GIF images to APNG format. CVE-2021-45909 heap-based buffer overflow vulnerability in t...

Ubuntu 16.04 ESM : GNU C Library vulnerabilities (USN-5310-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5310-2 advisory. USN-5310-1 fixed several vulnerabilities in GNU. This update provides the corresponding update for Ubuntu 16.04 ESM. Tenable has extracted the preceding...

Jenkins Enterprise and Operations Center 2.277.x < 2.277.43.0.6 / 2.303.x < 2.303.30.0.5 / 2.319.3.3 Multiple DoS (CloudBees Security Advisory 2022-02-09)

The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.277.x prior to 2.277.43.0.6, 2.303.x prior to 2.303.30.0.5, or 2.x prior to 2.319.3.3. It is, therefore, affected by multiple vulnerabilities: - XStream is an open source java library to serialize...

Debian DLA-2934-1 : freecad - LTS security update

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2934 advisory. - Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands via a crafted filename. CVE-2021-45844 Note that...