IPv6, it’s waiting for you

IPv6 is an expression IT professionals are likely to have seen or heard at one time, but what exactly is it? Let us give you a quick introduction, and then try to explain what it does differently by comparing it to its predecessor, IPv4. IPv4 and IPv6 are both Internet communications protocols...

Design/Logic Flaw

A vulnerability has been identified in RUGGEDCOM ROS for RSL910 devices All versions ROS V5.0.1, RUGGEDCOM ROS for all other devices All versions ROS V4.3.4, SCALANCE XB-200/XC-200/XP-200/XR300-WG All versions between V3.0 including and V3.0.2 excluding, SCALANCE XR-500/XM-400 All versions betwee...

F5 Networks BIG-IP : glibc vulnerability (K31211252)

Multiple stack-based buffer overflows in the GNU C Library aka glibc or libc6 before 2.23 allow context-dependent attackers to cause a denial of service application crash or possibly execute arbitrary code via a long argument to the 1 nan, 2 nanf, or 3 nanl function. CVE-2014-9761 C Tenable Netwo...

Debian DLA-1221-1 : ruby1.9.1 security update

Several vulnerabilities have been discovered in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2017-17405 A command injection vulnerability in Net::FTP might allow a malicious FTP server the execution of arbitrary...

Red Hat Single User Mode

The remote Red Hat system does not have authorization for single user mode enabled. An attacker with physical access can enter single user mode with root privileges via the LILO or GRUB boot menu. TRUSTED...

Suricata Denial of Service Vulnerability

Suricata is a set of network intrusion detection system IDS, intrusion prevention system IPS and network security monitoring engine developed by the Open Information Security Foundation OISF and its supported vendors, which supports multi-threading, built-in IPv6, and the ability to load...

Debian DLA-1212-1 : otrs2 security update

Four vulnerabilities were discovered in the Open Ticket Request System which could result in information disclosure or the execution of arbitrary shell commands by logged-in agents. For Debian 7 'Wheezy', these problems have been fixed in version 3.3.18-1deb7u2. We recommend that you upgrade your...

nginx < 1.13.3 Integer Overflow Vulnerability

This plugin has been deprecated since it duplicates plugin ID 118151 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2020/04/27. Deprecated by sambarcgipathdisclosure.nasl. include'compat.inc'; if description scriptid105359; scriptversion"1.14";...

EulerOS 2.0 SP2 : python (EulerOS-SA-2017-1335)

According to the version of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - CPython aka Python up to 2.7.13 is vulnerable to an integer overflow in the PyStringDecodeEscape function in stringobject.c, resulting in heap-base...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:3332-1)

This update for the Linux Kernel 3.12.69-606435 fixes several issues. The following security issues were fixed : - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrmuser.c allowed local users to gain privileges or cause a denial of service use-after-free via a crafted SORCVBUF...

EulerOS 2.0 SP2 : postgresql (EulerOS-SA-2017-1341)

According to the versions of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Privilege escalation flaws were found in the initialization scripts of PostgreSQL. An attacker with access to the postgres user account coul...

Debian DLA-1207-1 : erlang security update (ROBOT)

An erlang TLS server configured with cipher suites using RSA key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack against RSA, which when exploited, may result in plaintext recovery of encrypted messages and/or a Man-in-the-middle MiTM attack, despite...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:3307-1)

This update for the Linux Kernel 3.12.61-52101 fixes several issues. The following security issues were fixed : - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrmuser.c allowed local users to gain privileges or cause a denial of service use-after-free via a crafted SORCVBUF...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:3312-1)

This update for the Linux Kernel 3.12.74-606445 fixes several issues. The following security issues were fixed : - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrmuser.c allowed local users to gain privileges or cause a denial of service use-after-free via a crafted SORCVBUF...

Fedora 25 : firefox (2017-2c15e19fb5)

Update to latest upstream version. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Debian DLA-1205-1 : simplesamlphp security update

The simplesamlphp package in wheezy is vulnerable to multiple attacks on authentication-related code, leading to unauthorized access and information disclosure. CVE-2017-12867 The SimpleSAMLAuthTimeLimitedToken class allows attackers with access to a secret token to extend its validity period by...

Debian DLA-1206-1 : tiff security update

In LibTIFF 4.0.8, there is a heap-based buffer overflow in the t2pwritepdf function in tools/tiff2pdf.c. This heap overflow could lead to different damages. For example, a crafted TIFF document can lead to an out-of-bounds read in TIFFCleanup, an invalid free in TIFFClose or t2pfree, memory...

[SECURITY] Fedora 25 Update: openssh-7.4p1-5.fc25

SSH Secure SHell is a program for logging into and executing commands on a remote machine. SSH is intended to replace rlogin and rsh, and to provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forward...

Virtuozzo 7 : readykernel-patch (VZA-2017-111)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - dccpdisconnect set the socket state to DCCPCLOSED but did not properly free some of the resources associated with th...

CVE-2017-8865

CVE-2017-8865 affects Elemental Path’s CogniToys Dino, with firmware version 0.0.794 and earlier. The vulnerability allows an attacker on the network to replay VoIP traffic between a Dino device and a remote server to another Dino device, indicating a capture-replay flaw in the Dino’s communicati...