EulerOS 2.0 SP1 : dhcp (EulerOS-SA-2018-1072)

According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An out-of-bound memory access flaw was found in the way dhclient processed a DHCP response packet. A malicious DHCP server could potentially use...

EulerOS 2.0 SP2 : squid (EulerOS-SA-2018-1075)

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability i...

Fedora 27 : ghostscript (2018-3247413570)

Security fix for CVE-2018-10194. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 703...

macOS : Apple Safari 11.1 APPLE-SA-2018-04-24-3 Multiple Vulnerabilities

The version of Apple Safari installed on the remote macOS or Mac OS X host is 11.1, but is missing the security fix APPLE-SA-2018-04-24-3. It is, therefore, affected by multiple vulnerabilities as described in the HT208741 security advisory. C Tenable Network Security, Inc. include"compat.inc"; i...

Fedora 27 : anki (2018-70fac3f07e)

Update to new upstream release 2.0.50. - fix a security issue in .apkg imports - fix a problem with plugin download - use python send2trash module from system - use correct shebang for python2 - upstream changelog: https://apps.ankiweb.net/docs/changes.html Note that Tenable Network Security has...

Debian DLA-1360-1 : lucene-solr security update

It was discovered that there was an XML external entity expansion XXE vulnerability in lucene-solr, a search engine library for Java. It could be exploited to read arbitrary local files from the Solr server or the internal network. For Debian 7 'Wheezy', this issue has been fixed in lucene-solr...

CVE-2017-17257

Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R007C01, V200R007C02, V200R008C20, V200R008C30, AR1200-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR150 V200R006C10, V200R007C00, V200R007C01, V200R007C02, V200R008C20,...

Debian DLA-1359-1 : ruby1.8 security update

Multiple vulnerabilities were found in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2017-17742 Aaron Patterson reported that WEBrick bundled with Ruby was vulnerable to an HTTP response splitting vulnerability. It wa...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:1048-1)

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.126 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-1091: In the flushtmregstothread function in arch/powerpc/kernel/ptrace.c, a guest kernel crash can be triggered from unprivileged userspace...

Hackers Behind Healthcare Espionage Infect X-Ray and MRI Machines

Security researchers have uncovered a new hacking group that is aggressively targeting healthcare organizations and related sectors across the globe to conduct corporate espionage. Dubbed "Orangeworm," the hacking group has been found installing a wormable trojan on machines hosting software used...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0991-1)

This update for the Linux Kernel 3.12.74-606485 fixes one issue. The following security issue was fixed : - CVE-2018-7566: The Linux kernel had a buffer overflow via an SNDRVSEQIOCTLSETCLIENTPOOL ioctl write operation to /dev/snd/seq by a local user bsc1083488. Note that Tenable Network Security...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1003-1)

This update for the Linux Kernel 4.4.114-9267 fixes several issues. The following security issues were fixed : - CVE-2017-13166: Prevent elevation of privilege vulnerability in the v4l2 video driver bsc1085447. - CVE-2018-1068: A flaw in the implementation of 32-bit syscall interface for bridging...

Oracle Weblogic Server 10.3.6.0 12.1.3.0 12.2.1.2 12.2.1.3 - Deserialization Remote Command Execution

Oracle Weblogic Server 10.3.6.0 12.1.3.0 12.2.1.2 12.2.1.3 - Deserialization Remote Command Execution -- coding: utf-8 -- Oracle Weblogic Server 10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3 Deserialization Remote Command Execution Vulnerability CVE-2018-2628 IMPORTANT: Is provided only for educational ...

An Intelligent Network Security Scanner: Red Team Arsenal

Red Team Arsenal is a web/network security scanner which has the capability to scan all company’s online facing assets and provide an holistic security view of any security anomalies. It’s a closely linked collections of security engines to conduct/simulate attacks and monitor public facing asset...

Juniper Junos Connectionless Network Protocol (CLNP) Packet Handling Unspecified Remote Code Execution / DoS (JSA10844)

According to its self-reported version number, the remote Juniper Junos device is affected by an unspecified flaw that is triggered when handling Connectionless Network Protocol CLNP packets. This allows a remote attacker to crash a device or execute arbitrary code. Note: This issue is only...

Debian DLA-1356-1 : libreoffice security update

Fuzzing by the OSS-Fuzz project found two memory safety issues in LibreOffice, which could result in an application crash or possibly other unspecified impact. For Debian 7 'Wheezy', these problems have been fixed in version 1:3.5.4+dfsg2-0+deb7u11. We recommend that you upgrade your libreoffice...

CVE-2018-2833

The CVE-2018-2833 entry concerns Oracle Hospitality Simphony, specifically the Enterprise Management Console subcomponent, affecting versions 2.7–2.10. The vulnerability is exploitable over HTTP from a low-privilege network-access attacker and can lead to unauthorized creation, deletion, or modif...

CVE-2018-2798

CVE-2018-2798 affects Oracle Java/OpenJDK with the AWT component (and related JRE/JDK bundles). The connected advisories describe an issue: unbounded memory allocation during deserialization in the Container (AWT) path, enabling potentially unauthenticated network-accessed exploitation. Public di...

CVE-2018-2759

CVE-2018-2759 affects the MySQL Server component (InnoDB). Affected are Oracle MySQL 5.7.x with 5.7.21 and earlier. The vulnerability allows a high-privilege attacker with network access via multiple protocols to cause a hang or crash (complete DOS) of MySQL Server (CVSS 3.0 shows A=High, Availab...

CVE-2018-2790

CVE-2018-2790 affects Oracle Java SE/Java SE Embedded (OpenJDK in Linux distributions) with a JAR manifest handling flaw. Public sources in Debian and CentOS advisories cite it among OpenJDK issues for multiple Java versions (6u181, 7u171, 8u162, 10; Embedded 8u161). The connected docs identify t...