Slackware 14.0 / 14.1 / 14.2 / current : ntp (SSA:2019-067-01)

New ntp packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2019-067-01. The text itself is copyright C Slackware Linux,...

Citrix Falls Prey to Password-Spraying Attack

Citrix is warning that its internal network has been hit by international cybercriminals. The digital workspace and enterprise networks vendor said in a website notice that the FBI contacted it on Wednesday, saying that there was evidence of a successful cyberattack on its network. While details...

EulerOS 2.0 SP5 : ghostscript (EulerOS-SA-2019-1065)

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ghostscript: access bypass in psi/zdevice2.c 700153 CVE-2018-19475 - ghostscript: access bypass in psi/zicc.c 700169 CVE-2018-19476 -...

EulerOS 2.0 SP5 : rsyslog (EulerOS-SA-2019-1073)

According to the version of the rsyslog packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp...

EulerOS Virtualization 2.5.2 : openssl (EulerOS-SA-2019-1084)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private Logging

Summary Security Vulnerabilities affect IBM Cloud Private Logging Vulnerability Details CVEID: CVE-2018-10904 DESCRIPTION: glusterfs could allow a remote authenticated attacker to execute arbitrary code on the system, caused by improper validation of file paths in the trusted.io-stats-dump extend...

Avoiding Security Misconfiguration

Security Misconfiguration exposes networks to risk on premises and the cloud. What do you need to know to limit firewall security misconfiguration?...

Fedora 28 : drupal7-link (2019-ff4e1a73a5)

https://www.drupal.org/project/link/releases/7.x-1.6 - https://www.drupal.org/sa-contrib-2019-020 - https://www.drupal.org/sa-core-2019-003 - https://www.drupal.org/project/link/releases/7.x-1.5 - https://www.drupal.org/project/link/releases/7.x-1.5-beta3 Note that Tenable Network Security has...

Ubuntu 18.10 : linux, linux-azure, linux-gcp, linux-kvm, linux-raspi2 vulnerabilities (USN-3903-1)

Jason Wang discovered that the vhost net driver in the Linux kernel contained an out of bounds write vulnerability. An attacker in a guest virtual machine could use this to cause a denial of service host system crash or possibly execute arbitrary code in the host kernel. CVE-2018-16880 Jann Horn...

Fedora 28 : ming (2019-4fdf19459d)

Fixes: CVE-2018-6358, CVE-2018-7867, CVE-2018-7868, CVE-2018-7870, CVE-2018-7871, CVE-2018-7872, CVE-2018-7875, CVE-2018-9165. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically...

Legion - An Easy-To-Use, Super-Extensible And Semi-Automated Network Penetration Testing Tool That Aids In Discovery, Reconnaissance And Exploitation Of Information Systems

Legion, a fork of SECFORCE's Sparta, is an open source, easy-to-use, super-extensible and semi-automated network penetration testing framework that aids in discovery, reconnaissance and exploitation of information systems. Legion is developed and maintained by GoVanguard. More information about...

Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20190305)

Security Fixes : - OpenJDK: memory disclosure in FileChannelImpl Libraries, 8206290 CVE-2019-2422 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid122640; scriptversion"1.4";...

Debian DLA-1705-1 : sox security update

Multiple vulnerabilities have been discovered in SoX Sound eXchange, a sound processing program : CVE-2017-11332 The startread function wav.c is affected by a divide-by-zero vulnerability when processing WAV file with zero channel count. This flaw might be leveraged by remote attackers using a...

BSides SF 2019: Remote-Root Bug in Logitech Harmony Hub Patched and Explained

SAN FRANCISCO – Users of Logitech’s Harmony Hub have been wide open to an attack for years because of four unpatched vulnerabilities that left any IoT device connected at risk to remote takeover. The bugs were patched by Logitech in November, but for the first time the researchers that discovered...

SUSE SLED15 / SLES15 Security Update : freerdp (SUSE-SU-2019:0539-1)

This update for freerdp to version 2.0.0rc4 fixes the following issues : Security issues fixed : CVE-2018-0886: Fix a remote code execution vulnerability CredSSP bsc1085416, bsc1087240, bsc1104918 CVE-2018-8789: Fix several denial of service vulnerabilities in the in the NTLM Authentication modul...

Carbon Black and Chronicle: Stronger Cybersecurity through Big Data and Analytics

This is another exciting day for cybersecurity professionals, for Carbon Black and for me personally. It’s also a very exciting way to kick of RSA 2019! Earlier today, we announced an exciting new integration with Chronicle Security to harness the power of big data and analytics. Our goal is to...

Fedora 28 : openocd (2019-f0add5eed0)

fix for CVE-2018-5704 RHBZ 1534844 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Netwo...

Fedora 28 : ansible (2019-c54511eaab)

Update to bugfix release 2.7.8. Fixes also CVE-2019-3828 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Debian DLA-1702-1 : advancecomp security update

Several vulnerabilities were discovered in advancecomp, a collection of recompression utilities. CVE-2018-1056 Joonun Jang discovered that the advzip tool was prone to a heap-based buffer overflow. This might allow an attacker to cause a denial of service application crash or other unspecified...

[SECURITY] Fedora 28 Update: nss-3.42.1-1.fc28

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...