Debian DLA-1392-1 : linux security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service. CVE-2018-1093 Wen Xu reported that a crafted ext4 filesystem image could trigger an out-of-bounds read in the ext4validblockbitmap function. A local user able to mount arbitrary filesystems coul...

Hacking, tracking, stealing and sinking ships

At Infosecurity Europe this year, we demonstrated multiple methods to interrupt the shipping industry, several of which haven’t been demonstrated in public before, to our knowledge. Some of these issues were simply through poor security hygiene on board, but others were linked to the protocols us...

CVE-2016-10639

redis-srvr is a npm wrapper for redis-server. redis-srvr downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the networ...

CVE-2016-10688

CVE-2016-10688 affects the Haxe 3 toolkit (haxe3): it downloads resources over HTTP, making it vulnerable to a Man‑in‑the‑Middle (MitM) where an attacker on the network can intercept and replace the downloaded resource, potentially enabling remote code execution. The available documents consisten...

CVE-2016-10686

fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the...

CVE-2016-10691

CVE-2016-10691 affects the windows-seleniumjar package, which downloads the Selenium Jar over HTTP. The underlying issue is insecure binary/resource retrieval that can be intercepted in a privileged network position, enabling an attacker to swap the downloaded binary and potentially achieve remot...

CVE-2018-11712

CVE-2018-11712 affects WebKitGTK/WebKitGTK+ libsoup backend. The WebKit source file SocketStreamHandleImplSoup.cpp failed to verify TLS certificates for WebSocket connections in WebKitGTK+ 2.20.0 and 2.20.1, enabling a potential man‑in‑the‑middle or spoofing scenario. The connected documents conf...

Man-in-the-Middle (MitM)

dalek-browser-ie-canary is vulnerable to man-in-the-middle MitM attacks. This is because it downloads binary resources via HTTP, allowing MitM attacks. Also, it may potentially cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker ...

Fedora 27 : 1:xmlrpc (2018-6e6f1003d6)

Security fix for CVE-2016-5003, CVE-2016-5002 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Virtuozzo 7 : readykernel-patch (VZA-2018-038)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccpwritexmit function in...

Fedora 27 : poppler (2018-26fcc67bfd)

Security fix for CVE-2017-18267. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 703...

CVE-2016-10623

macaca-chromedriver-zxa is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver-zxa downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker...

Remote code execution

libxl provides Node bindings for the libxl library for reading and writing excel XLS and XLSX spreadsheets. libxl downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested zip file with an...

Remote code execution

atom-node-module-installer installs node modules for atom-shell applications. atom-node-module-installer binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled...

CVE-2016-10624

selenium-chromedriver is a simple utility for downloading the Selenium Webdriver for Google Chrome selenium-chromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary wit...

CVE-2017-2860

CVE-2017-2860 is an out-of-bounds-read denial-of-service vulnerability in Natus Xltek NeuroWorks 8, specifically in the KeyTree lookup entry handling. A specially crafted network packet can cause a crash when the first KeyTree element is not an ItemList, leading to an access violation and DoS. Th...

Fedora 27 : ca-certificates (2018-ed35b82337)

This is an update to version 2.24 of the Mozilla CA trust list, which has been published as part of the NSS 3.37 release. Please refer to the upstream release notes for the changes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS3.37 releasenotes Note that Tenable Network Securi...

VMware Horizon View Client 4.x < 4.8.0 Privilege Escalation Vulnerability (VMSA-2018-0014)

The version of VMware Horizon View Client installed on the remote host is 4.x prior to 4.8.0. It is, therefore, affected by a privilege escalation vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. C Tenab...

Remote code execution

galenframework-cli is the node wrapper for the Galen Framework. galenframework-cli below 2.3.1 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled...

Virtuozzo 7 : anaconda / anaconda-core / anaconda-dracut / etc (VZA-2018-037)

According to the versions of the anaconda / anaconda-core / anaconda-dracut / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a...