Google Launches GUAC Open Source Project to Secure Software Supply Chain

Google on Thursday announced that it's seeking contributors to a new open source initiative called Graph for Understanding Artifact Composition, also known as GUAC, as part of its ongoing efforts to beef up the software supply chain. "GUAC addresses a need created by the burgeoning efforts across...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:6998)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:6998-1 advisory. - expat: a use-after-free in the doContent function in xmlparse.c CVE-2022-40674 Note that Nessus has not tested for this issue but has instead relied onl...

Scientific Linux Security Update : bind on SL7.x i686/x86_64 (2022:6765)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:6765-1 advisory. - bind: memory leak in ECDSA DNSSEC verification code CVE-2022-38177 - bind: memory leaks in EdDSA DNSSEC verification code CVE-2022-38178 Note...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:6710)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:6710-1 advisory. - Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh tag CVE-2022-3033 - Mozilla: Bypassing...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2022:6711)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:6711-1 advisory. - Mozilla: Bypassing FeaturePolicy restrictions on transient pages CVE-2022-40959 - Mozilla: Data-race when parsing non-UTF-8 URLs in threads...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2022:6179)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:6179-1 advisory. - Mozilla: Address bar spoofing via XSLT error handling CVE-2022-38472 - Mozilla: Cross-origin XSLT Documents would have inherited the parent's...

Scientific Linux Security Update : systemd on SL7.x i686/x86_64 (2022:6160)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:6160-1 advisory. - systemd-resolved: use-after-free when dealing with DnsStream in resolved-dns-stream.c CVE-2022-2526 Note that Nessus has not tested for this issue but h...

Scientific Linux Security Update : kernel on SL7.x x86_64 (2022:5937)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:5937-1 advisory. - Incomplete cleanup of multi-core shared buffers aka SBDR CVE-2022-21123 - Incomplete cleanup of microarchitectural fill buffers aka SBDS...

Scientific Linux Security Update : java-11-openjdk on SL7.x i686/x86_64 (2022:5687)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:5687-1 advisory. - OpenJDK: integer truncation issue in Xalan-J JAXP, 8285407 CVE-2022-34169 - OpenJDK: class compilation issue Hotspot, 8281859 CVE-2022-21540 -...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2022:5479)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:5479-1 advisory. - Mozilla: CSP sandbox header without allow-scripts can be bypassed via retargeted javascript: URI CVE-2022-34468 - Mozilla: Use-after-free in...

Scientific Linux Security Update : kernel on SL7.x x86_64 (2022:5232)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:5232-1 advisory. - kernel: race condition in perfeventopen leads to privilege escalation CVE-2022-1729 Note that Nessus has not tested for these issues but has instead...

Scientific Linux Security Update : postgresql on SL7.x i686/x86_64 (2022:5162)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:5162-1 advisory. - postgresql: Autovacuum, REINDEX, and others omit security restricted operation sandbox CVE-2022-1552 Note that Nessus has not tested for this issue but...

Scientific Linux Security Update : xz on SL7.x i686/x86_64 (2022:5052)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:5052-1 advisory. - gzip: arbitrary-file-write vulnerability CVE-2022-1271 Note that Nessus has not tested for this issue but has instead relied only on the application's...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:4891)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:4891-1 advisory. - Mozilla: Braille space character caused incorrect sender email to be shown for a digitally signed email CVE-2022-1834 - Mozilla: Cross-Origin...

Scientific Linux Security Update : gzip on SL7.x x86_64 (2022:2191)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:2191-1 advisory. - gzip: arbitrary-file-write vulnerability CVE-2022-1271 Note that Nessus has not tested for this issue but has instead relied only on the application's...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:1725)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:1725-1 advisory. - Mozilla: Bypassing permission prompt in nested browsing contexts CVE-2022-29909 - Mozilla: iframe Sandbox bypass CVE-2022-29911 - Mozilla:...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2022:1703)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:1703-1 advisory. - Mozilla: Bypassing permission prompt in nested browsing contexts CVE-2022-29909 - Mozilla: iframe Sandbox bypass CVE-2022-29911 - Mozilla:...

Scientific Linux Security Update : java-11-openjdk on SL7.x i686/x86_64 (2022:1440)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:1440-1 advisory. - OpenJDK: Defective secure validation in Apache Santuario Libraries, 8278008 CVE-2022-21476 - OpenJDK: Unbounded memory allocation when compilin...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:1302)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:1302-1 advisory. - Mozilla: Use-after-free in NSSToken objects CVE-2022-1097 - Mozilla: Out of bounds write due to unexpected WebAuthN Extensions CVE-2022-28281 -...

Scientific Linux Security Update : log4j on SL6.x, SL7.x i686/x86_64 (2021:5206)

The remote Scientific Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:5206-1 advisory. - log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender CVE-2021-4104 Note that Nessus has not tested for this...