SUSE SLED15 / SLES15 Security Update : bzip2 (SUSE-SU-2019:1846-1)

This update for bzip2 fixes the following issues : Security issue fixed : CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors bsc1139083. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable...

Solaris 10 (sparc) : 125731-15

SunOS 5.10: XML and XSLT libraries patch. Date this patch was last updated by Sun : Jul/15/19 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid126717; scriptversion"1.3";...

Facing the cold chills

Have you ever felt the cold chill in your spine when the “fix engine” light comes on in your car? How about when one of your children turns pale and gets their first fever? It’s a feeling of helplessness and concern regarding what could be wrong. Then there’s the feeling of relief that comes with...

SUSE SLED12 / SLES12 Security Update : Test update for SUSE:SLE-12-SP5:Update (security) (SUSE-SU-2019:1793-1)

This is a security test update for SUSE:SLE-12-SP5:Update Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora 29 : python36 (2019-7df59302e0)

Update Python 3.6 to 3.6.9, the latest security release of the 3.6 branch. Changelog for 3.6.9 final and 3.6.9 release candidate 1. Includes security fixes for CVE-2019-9636, CVE-2019-9740, CVE-2019-10160. Note that Tenable Network Security has extracted the preceding description block directly...

Debian DLA-1852-1 : python3.4 security update

The urllib library in Python ships support for a second, not well known URL scheme for accessing local files 'localfile://'. This scheme can be used to circumvent protections that try to block local file access and only block the well-known 'file://' schema. This update addresses the vulnerabilit...

Migrating Network Protection to the Cloud with Confidence

For modern organizations, speed and agility is the key to success – built on enhanced IT efficiency and performance driven by the cloud. Anything less could see your business outpaced by the competition. As always, security must be a priority when migrating to the cloud, but network teams are bei...

CVE-2019-11719

When importing a curve25519 private key in PKCS8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services NSS library. This could lead to information disclosure. This vulnerability affects Firefox ESR 60.8, Firefox 68, and Thunderbird 60.8...

Debian DLA-1850-1 : redis security update

It was discovered that there were two heap buffer overflows in the Hyperloglog functionality provided by the Redis in-memory key-value database. For Debian 8 'Jessie', these issues have been fixed in redis version 2:2.8.17-1+deb8u7. We recommend that you upgrade your redis packages. NOTE: Tenable...

Slackware 14.2 / current : mozilla-firefox (SSA:2019-191-01)

New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2019-191-01. The text itself is copyright C Slackware Linux,...

UBUNTU-CVE-2019-11727

A vulnerability exists where it possible to force Network Security Services NSS to sign CertificateVerify with PKCS1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerabilit...

Debian DLA-1851-1 : openjpeg2 security update

Two security vulnerabilities were discovered in openjpeg2, a JPEG 2000 image library. CVE-2016-9112 A floating point exception or divide by zero in the function opjpinextcprl may lead to a denial of service. CVE-2018-20847 An improper computation of values in the function opjgetencodingparameters...

SUSE SLED15 / SLES15 Security Update : ruby-bundled-gems-rpmhelper, ruby2.5 (SUSE-SU-2019:1804-1)

This update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues : Changes in ruby2.5 : Update to 2.5.5 and 2.5.4 : https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/ Security issues fixed :...

OS Identification: iPhone or iPad

Only port 62078 is open on the remote host. It's highly likely to be an iPhone or an iPad. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid126588; scriptversion"1.3"; scriptcvsdate"Date: 2020/01/22"; scriptnameenglish:"OS Identification: iPhone or iPad";...

Mozilla Firefox Out-of-Bounds Read Vulnerability

Mozilla Firefox browser Firefox is a free, open source browser for Windows, Linux and MacOSX platforms. An out-of-bounds read vulnerability exists in the Network Security Services NSS library in Mozilla Firefox versions prior to 68 when importing a curve25519 private key in PKCS 8 format with a...

Dashboards to Use on Palo Alto Networks for Effective Management

Enterprises should expect to see more cyberattacks launched against them. The data that they now gather and store have made their infrastructures key targets for hackers. Customer data and intellectual property can be sold in the black market for profit, and sensitive information can also be used...

Microsoft Windows GDI Component CVE-2019-1094 Information Disclosure Vulnerability

Description Microsoft Windows is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 16...

Stormshield Network Security Cross-Site Scripting Vulnerability

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from Stormshield France. A cross-site scripting vulnerability exists in the command line interface of the SNS web server in Stormshield Network Security versions 2.0.0 through 2.13.0 and 3.0.0 through 3.7.1...

Security vulnerabilities fixed in Thunderbird 60.8 — Mozilla

As part of his winning Pwn2Own entry, Niklas Baumstark demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. When an inner window is reused, it does not consider the use of document.domain for cross-origin...

Emerson DeltaV Distributed Control System

1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Low skill level to exploit Vendor: Emerson Equipment: DeltaV Distributed Control System DCS Vulnerability: Use of Hard-coded Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain administrative...