Scientific Linux Security Update : lasso on SL7.x i686/x86_64 (2021:2989)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:2989-1 advisory. - lasso: XML signature wrapping vulnerability when parsing SAML responses CVE-2021-28091 Note that Nessus has not tested for this issue but has instead...

Scientific Linux Security Update : java-1.8.0-openjdk on SL7.x i686/x86_64 (2021:2845)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:2845-1 advisory. - OpenJDK: Incorrect comparison during range check elimination Hotspot, 8264066 CVE-2021-2388 - OpenJDK: FTP PASV command response can cause...

Scientific Linux Security Update : java-11-openjdk on SL7.x i686/x86_64 (2021:2784)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:2784-1 advisory. - OpenJDK: Incorrect comparison during range check elimination Hotspot, 8264066 CVE-2021-2388 - OpenJDK: FTP PASV command response can cause...

Scientific Linux Security Update : kernel on SL7.x x86_64 (2021:2725)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:2725-1 advisory. - kernel: sizet-to-int conversion vulnerability in the filesystem layer CVE-2021-33909 - kernel: use-after-free in net/bluetooth/hcievent.c when...

Scientific Linux Security Update : linuxptp on SL7.x x86_64 (2021:2658)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:2658-1 advisory. - linuxptp: missing length check of forwarded messages CVE-2021-3570 Note that Nessus has not tested for this issue but has instead relied only on the...

New Google Scorecards Tool Scans Open-Source Software for More Security Risks

Google has launched an updated version of Scorecards, its automated security tool that produces a "risk score" for open source initiatives, with improved checks and capabilities to make the data generated by the utility accessible for analysis. "With so much software today relying on open-source...

Two Google plans that could make open source code more secure

Recently Google announced that it will fund the further development of Rust. Rust is a low-level programming language that is designed to be more memory secure than other popular programming languages, such as C. Google has also proposed an end-to-end framework for supply chain integrity which it...

Google Releases New Framework to Prevent Software Supply Chain Attacks

As software supply chain attacks emerge as a point of concern in the wake of SolarWinds and Codecov security incidents, Google is proposing a solution to ensure the integrity of software packages and prevent unauthorized modifications. Called "Supply chain Levels for Software Artifacts" SLSA, and...

Scientific Linux Security Update : libwebp on SL7.x i686/x86_64 (2021:2260)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:2260-1 advisory. - libwebp: heap-based buffer overflow in PutLE16 CVE-2018-25011 - libwebp: heap-based buffer overflow in WebPDecodeInto functions CVE-2020-36328 ...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2021:0656)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:0656-1 advisory. - Mozilla: Content Security Policy violation report could have contained the destination of a redirect CVE-2021-23968, CVE-2021-23969 - Mozilla:...

Scientific Linux Security Update : wpa_supplicant on SL7.x x86_64 (2021:0808)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:0808-1 advisory. - wpasupplicant: Use-after-free in P2P provision discovery processing CVE-2021-27803 Note that Nessus has not tested for this issue but has instead relied...

Scientific Linux Security Update : bind on SL7.x i686/x86_64 (2021:0671)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:0671-1 advisory. - bind: Buffer overflow in the SPNEGO implementation affecting GSSAPI security policy negotiation CVE-2020-8625 Note that Nessus has not tested for this...

Scientific Linux Security Update : grub2 on SL7.x x86_64 (2021:0699)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:0699-1 advisory. - grub2: acpi command allows privileged user to load crafted ACPI tables when Secure Boot is enabled CVE-2020-14372 - grub2: Use-after-free in...

Scientific Linux Security Update : flatpak on SL7.x x86_64 (2021:0411)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:0411-1 advisory. - flatpak: sandbox escape via spawn portal CVE-2021-21261 Note that Nessus has not tested for this issue but has instead relied only on the application's...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2021:0290)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:0290-1 advisory. - Mozilla: Cross-origin information leakage via redirected PDF requests CVE-2021-23953 - Mozilla: Type confusion when using logical assignment...

Scientific Linux Security Update : dnsmasq on SL7.x x86_64 (2021:0153)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2021:0153-1 advisory. - dnsmasq: loose address/port check in replyquery makes forging replies easier for an off-path attacker CVE-2020-25684 - dnsmasq: loose query nam...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2020:5561)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2020:5561-1 advisory. - chromium-browser: Uninitialized Use in V8 CVE-2020-16042 - Mozilla: Heap buffer overflow in WebGL CVE-2020-26971 - Mozilla: CSS Sanitizer...

Scientific Linux Security Update : kernel on SL7.x x86_64 (2020:5437)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2020:5437-1 advisory. - kernel: metadata validator in XFS may cause an inode with a valid, user-creatable extended attribute to be flagged as corrupt CVE-2020-14385 -...

Scientific Linux Security Update : net-snmp on SL7.x i686/x86_64 (2020:5350)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2020:5350-1 advisory. - net-snmp: Improper Privilege Management in EXTEND MIB may lead to privileged commands execution CVE-2020-15862 Note that Nessus has not tested for this...

Scientific Linux Security Update : firefox on SL7.x x86_64 (2020:5239)

The remote Scientific Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the SLSA-2020:5239-1 advisory. - Mozilla: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code CVE-2020-26951 - Mozilla: Memory safety bugs...