SUSE SLES12 Security Update : qemu (SUSE-SU-2018:1363-1) (Spectre)

This update for qemu fixes several issues. This security issue was fixed : - CVE-2018-3639: Spectre v4 vulnerability mitigation support for KVM guests bsc1092885. Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all pri...

Comcast Patches Router Bug That Leaked Some Wi-Fi Passwords

Comcast patched a bug Monday that under certain conditions leaked customer SSID names and passwords of Xfinity routers. The flaw was accessible via the Comcast website used by customers to activate and manage their Xfinity router. The bug did not affect Comcast customers that used their own priva...

Fedora 27 : guava (2018-e4c2507720)

Security fix for CVE-2018-10237 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 7030...

Fedora 27 : xdg-utils (2018-b753813bf0)

New upstream bugfix release, includes security fix for CVE-2017-18266 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

DynoRoot DHCP - Client Command Injection Exploit

Exploit for linux platform in category local exploits Exploit Title: DynoRoot DHCP - Client Command Injection Exploit Author: Kevin Kirsche Exploit Repository: https://github.com/kkirsche/CVE-2018-1111 Exploit Discoverer: Felix Wilhelm Vendor Homepage: https://www.redhat.com/ Version: RHEL 6.x /...

SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2018:1327-1)

This update for curl fixes several issues: Security issues fixed : - CVE-2018-1000301: Fixed a RTSP bad headers buffer over-read could crash the curl client bsc1092098 Non security issues fixed : - If the DEFAULTSUSE cipher list is not available use the HIGH cipher alias before failing. bsc108682...

Mozilla Firefox ESR < 52.8

The version of Firefox ESR installed on the remote Windows host is prior to 52.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-12 advisory. - Mozilla developers backported selected changes in the Skia library to the ESR52 branch of Firefox. These changes...

Ubuntu 17.10 : DPDK vulnerability (USN-3642-2)

USN-3642-1 fixed a vulnerability in DPDK. This update provides the corresponding update for Ubuntu 17.10. Maxime Coquelin discovered that DPDK incorrectly handled guest physical ranges. A malicious guest could use this issue to possibly access sensitive information. Note that Tenable Network...

Critical Linux Flaw Opens the Door to Full Root Access

Red Hat has patched a vulnerability affecting the DHCP client packages that shipped with Red Hat Enterprise Linux 6 and 7. A successful exploit could give an attacker root access and full control over enterprise endpoints. According to an alert issued Wednesday from US-CERT, the critical-rated...

Fedora 26 : patch (2018-88a4219528)

Security fix for CVE-2018-1000156 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Fedora 27 : flac (2018-46f48df07d)

Security fix for CVE-2017-6888. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 7030...

Fedora 27 : patch (2018-23a1b5975a)

Security fix for CVE-2018-1000156 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

EulerOS 2.0 SP3 : kernel (EulerOS-SA-2018-1121)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual SDM was mishandled in the...

Fedora 27 : mysql-mmm (2018-e31f52c5ee)

Multi-Master Replication Manager for MySQL mmmagentd Remote Command Injection Vulnerabilities This update adds data sanitization to inputs for the mmm agent. Multiple exploitable remote command injection vulnerabilities exist in the MySQL Master-Master Replication Manager MMM mmmagentd daemon...

Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2018-029)

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - An industry-wide issue was found in the way many modern microprocessor designs have implemented...

Fedora 26 : guava (2018-db8f322bb0)

Security fix for CVE-2018-10237 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 7030...

Code injection

An issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices. The admin login session cookie is insecurely generated making admin session hijacking possible. When an admin logs in, a session cookie is generated using the time of day rounded to 10ms. Since the web server returns its...

CVE-2018-10252

CVE-2018-10252 affects Actiontec WCB6200Q prior to firmware 1.1.10.20a. The admin login session cookie is generated insecurely (time-of-day rounded to 10 ms), allowing an attacker to step through possible session IDs and hijack admin sessions. Once a valid session is obtained, the attacker can ad...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1239-1)

This update for the Linux Kernel 4.4.120-9270 fixes one issue. The following security issue was fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace could lead to memory corruption, possibly a denial of service or privilege escalation bsc1090036. Note that Tenable Network...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1234-1)

This update for the Linux Kernel 3.12.61-52101 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace could lead to memory corruption, possibly a denial of service or privilege escalation bsc1090036. - CVE-2017-0861:...