Fedora 31 : weechat (2020-db890b4800)

New version, fixes a lot of bugs some of them security. In the same update, fixed up epel7 build to latest version as well. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean...

Debian DLA-2144-1 : qemu security update

Two out-of-bounds heap buffer accesses were found in QEMU, a fast processor emulator, which could result in denial of service or abitrary code execution. For Debian 8 'Jessie', these problems have been fixed in version 1:2.1+dfsg-12+deb8u14. We recommend that you upgrade your qemu packages. NOTE:...

Debian DLA-2146-1 : libvncserver security update

In libvncserver, through libvncclient/cursor.c, there is a possibility of a heap overflow, as reported by Pavel Cheremushkin. For Debian 8 'Jessie', this problem has been fixed in version 0.9.9+dfsg2-6.1+deb8u7. We recommend that you upgrade your libvncserver packages. NOTE: Tenable Network...

CVE-2019-19135

In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which allows man in the middle attackers to reuse encrypted user credentials sent over the network...

CVE-2019-19135

In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which allows man in the middle attackers to reuse encrypted user credentials sent over the network...

The Web’s Bot Containment Unit Needs Your Help

Anyone who's seen the 1984 hit movie Ghostbusters likely recalls the pivotal scene where a government bureaucrat orders the shutdown of the ghost containment unit, effectively unleashing a pent-up phantom menace on New York City. Now, something similar is in danger of happening in cyberspace:...

Design/Logic Flaw

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows an attacker on the same network segment to stop the network functio...

CVE-2020-5546

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows an attacker on the same network segment to stop the network functio...

CVE-2020-5546

The CVE-2020-5546 entry affects Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier, where the TCP function is vulnerable to an argument-delimiter injection. The root cause is improper neutralization of input parameters, enabling a same-network attacker to stop net...

CVE-2020-5543

CVE-2020-5543 affects Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware 1.0.7 and earlier. The vulnerability is a session management flaw in the TCP function that could allow a remote attacker to stop network functions or execute malware via a specially crafted packet. Connected sources c...

Debian DLA-2142-1 : slirp security update

It was discovered that there was a buffer overflow vulnerability in slirp, a SLIP/PPP emulator for using a dial up shell account. This was caused by the incorrect usage of return values from snprintf3. For Debian 8 'Jessie', this issue has been fixed in slirp version 1:1.0.17-7+deb8u2. We recomme...

SUSE SLED15 / SLES15 Security Update : wireshark (SUSE-SU-2020:0693-1)

This update for wireshark and libmaxminddb fixes the following issues : Update wireshark to new major version 3.2.2 and introduce libmaxminddb for GeoIP support bsc1156288. New features include : Added support for 111 new protocols, including WireGuard, LoRaWAN, TPM 2.0, 802.11ax and QUIC Improve...

Mozilla Network Security Service: Multiple vulnerabilities

Background The Mozilla Network Security Service NSS is a library implementing security features like SSL v.2/v.3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME and X.509 certificates. Description Multiple vulnerabilities have been discovered in Mozilla Network Security Service NSS. Please review...

EulerOS Virtualization for ARM 64 3.0.2.0 : samba (EulerOS-SA-2020-1231)

According to the versions of the samba packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A flaw was found in samba 4.0.0 before samba 4.9.15 and samba 4.10.x before 4.10.10. An attacker can crash AD DC LDAP...

EulerOS Virtualization for ARM 64 3.0.2.0 : rsync (EulerOS-SA-2020-1257)

According to the versions of the rsync package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The recvfiles function in receiver.c in the daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, proceeds wit...

EulerOS Virtualization for ARM 64 3.0.2.0 : nss-softokn (EulerOS-SA-2020-1252)

According to the versions of the nss-softokn packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted...

EulerOS Virtualization for ARM 64 3.0.2.0 : freetype (EulerOS-SA-2020-1224)

According to the versions of the freetype package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The FreeType engine is a free and portable font rendering engine, developed to provide advanced font support for a...

EulerOS Virtualization for ARM 64 3.0.2.0 : libgcrypt (EulerOS-SA-2020-1189)

According to the versions of the libgcrypt package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and...

Fedora 31 : monit (2020-9c19202d55)

Update to 5.26.0 includes security fix for CVE-2019-11454 and CVE-2019-11455 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora 31 : mbedtls (2020-0ab860bb95)

Update to 2.16.5 Release notes: https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.5-and-2.7.14-r eleased Security Advisory: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security -advisory-2020-02 Note that Tenable Network Security has extracted the preceding description...