EulerOS 2.0 SP3 : tomcat (EulerOS-SA-2019-2675)

According to the versions of the tomcat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to...

Fedora 31 : libyang (2019-dfe0b42bc5)

Rebase to version 1.0.101 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2019:3318-1)

This update for samba fixes the following issues : CVE-2019-14861: Fixed a DNSServer RPC server crash, that allowed an authenticated user to crash the DCE/RPC DNS management server by creating records with matching the zone name bsc1158108. CVE-2019-14870: Fixed a DelegationNotAllowed not being...

EulerOS 2.0 SP3 : libpcap (EulerOS-SA-2019-2612)

According to the version of the libpcap package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.CVE-2019-15165 Note that Tenable...

openSUSE Security Update : postgresql (openSUSE-2019-2685)

This update for postgresql fixes the following issues : - Changed permissions, so that the directory can only be used by users in the postgres group bsc1123886. - Moved bash profile out of /var/lib to allow transactional updates bsc1100397. This update was imported from the SUSE:SLE-15:Update...

Fedora 30 : 12:dhcp / 32:bind / bind-dyndb-ldap / dnsperf (2019-c703d2304a)

New minor release with fix for latest CVE Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenabl...

CVE-2019-18337

CVE-2019-18337 affects Siemens/CCS: an authentication bypass in CCS’s XML-based protocol (default ports 5444/5440) allows remote attackers to read the CCS user database, including obfuscated passwords, for all versions

CVE-2019-18299

SPPA-T3000 MS3000 Migration Server (all versions) is affected by CVE-2019-18303 (and related CVEs in the same family). A network-accessible attacker can trigger a Denial-of-Service by sending specifically crafted packets to port 5010/tcp. The Red Hat advisories for CVE-2019-18303, CVE-2019-18301,...

Advantech DiagAnywhere Server

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Advantech Equipment: DiagAnywhere Server Vulnerability: Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability may allow remote code execution. 3. TECHNICAL...

nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate

A heap-based buffer overflow was found in the NSCEncryptUpdate function in Mozilla nss. A remote attacker could trigger this flaw via SRTP encrypt or decrypt operations, to execute arbitrary code with the permissions of the user running the application compiled with nss. While the attack complexi...

CVE-2019-11756

A use-after-free flaw was found in Mozilla Network Security Services NSS related to PK11 session handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled with NSS...

Denial Of Service (DoS)

Network Security Services NSS is vulnerable to denial of service DoS. It is possible due to out-of-bounds writes when passing an output buffer smaller than the block size to NSCEncryptUpdate...

EulerOS 2.0 SP2 : libjpeg-turbo (EulerOS-SA-2019-2407)

According to the versions of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The cjpeg utility in libjpeg allows remote attackers to cause a denial of service NULL pointer dereference and application crash or execu...

Fedora 30 : 1:libuv (2019-1686ae9b59)

Update to Node.js upstream release 12.13.1 https://nodejs.org/en/blog/release/v12.13.1/ Also fixes an issue where running npm -g was risky on RPM-installed systems. Fedora's packaged NPM will now install global content in /usr/local instead of /usr where it could conflict with RPM-provided...

EulerOS 2.0 SP2 : coreutils (EulerOS-SA-2019-2417)

According to the version of the coreutils package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSI...

EulerOS 2.0 SP2 : perl (EulerOS-SA-2019-2419)

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of servic...

D-Link DIR-615 CVE-2019-19743 Privilege Escalation Vulnerability

Description D-Link DIR-615 is prone to a privilege-escalation vulnerability. An attacker may exploit this issue to gain elevated privileges. Technologies Affected D-Link DIR-615 Recommendations Block external access at the network boundary, unless external parties require service. If applicable,...

Fedora 31 : 1:xpdf (2019-224d8cb07a)

Apply upstream fix for CVE-2019-17064. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable...

Siemens XHQ Operations Intelligence

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: XHQ Operations Intelligence Vulnerabilities: Cross-site Request Forgery, Improper Neutralization of Script-Related HTML Tags in a Web Page, Improper Input Validation 2. RISK...

EulerOS 2.0 SP2 : java-1.8.0-openjdk (EulerOS-SA-2019-2374)

According to the version of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.Security...