Security Updates for Microsoft Azure Site Recovery (March 2022)

The Microsoft Azure Site Recovery installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands...

Security Updates for Microsoft Azure Site Recovery (April 2022)

The Microsoft Azure Site Recovery installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands...

Security Updates for Microsoft Azure Site Recovery (August 2022)

The Microsoft Azure Site Recovery installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands...

Vulnerabilities fixed in WatchGuard firewalls

Several vulnerabilities have been fixed in WatchGuard firewall products. An unauthenticated remote malicious agent could vulnerability potentially exploit it to execute arbitrary code under root privileges. To be exploited, however, the management interface, however, must be accessible via the...

Scientific Linux Security Update : rsync on SL7.x x86_64 (2022:6170)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:6170-1 advisory. - rsync: remote arbitrary files write inside the directories of connecting peers CVE-2022-29154 Note that Nessus has not tested for this issue but has...

Scientific Linux Security Update : systemd on SL7.x i686/x86_64 (2022:6160)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:6160-1 advisory. - systemd-resolved: use-after-free when dealing with DnsStream in resolved-dns-stream.c CVE-2022-2526 Note that Nessus has not tested for this issue but h...

Ubuntu: Security Advisory (USN-5373-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-4488-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 36 : thunderbird (2022-33dd0f2f3e)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-33dd0f2f3e advisory. Update to 102.2.0 ; https://www.mozilla.org/en-US/security/advisories/mfsa2022-36/ Tenable has extracted the preceding description block directly from the...

MGASA-2022-0309 Updated firefox/nss packages fix security vulnerability

An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin CVE-2022-38472. A cross-origin iframe referencing ...

Threat Source newsletter (Aug. 25, 2022) — We're still not talking about Ukraine enough

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. Russia’s invasion of Ukraine was once the most talked about story in the world. Six months into the conflict, modern attention spans have moved on to other news stories. But Ukraine Independence Day yesterday should...

SUSE-SU-2022:2892-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2022-2639: Fixed integer underflow that could lead to out-of-bounds write in reservesfasize bsc1202154. - CVE-2020-36516: Fixed TCP session data injection...

Cisco Releases Security Updates for Multiple Products

Cisco has released security updates for vulnerabilities affecting ACI Multi-Site Orchestrator, FXOS, and NX-OS software. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Securi...

Fedora 36 : firefox (2022-02d2625a01)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-02d2625a01 advisory. Firefox 104.0 release. For details, see https://www.mozilla.org/en-US/firefox/104.0/releasenotes/ Tenable has extracted the preceding description block...

RHEL 9 : curl (RHSA-2022:6157)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6157 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTT...

RHEL 8 : curl (RHSA-2022:6159)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6159 advisory. The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTT...

KB5016892: Update for the Extended Security Updates Licensing Preparation Package for Windows Server 2008 R2 SP1

KB5016892: Update for the Extended Security Updates Licensing Preparation Package for Windows Server 2008 R2 SP1 Introduction This update provides an additional set of licensing changes to enable installation of the ESU add-on key. This is one of the steps to prepare for installation of Extended...

KB5016891: Update for the Extended Security Updates Licensing Preparation Package for Windows Server 2008 SP2

KB5016891: Update for the Extended Security Updates Licensing Preparation Package for Windows Server 2008 SP2 Introduction This update provides an additional set of licensing changes to enable installation of the ESU add-on key. This is one of the steps to prepare for installation of Extended...

Microsoft Patch Tuesday August 2022: DogWalk, Exchange EOPs, 13 potentially dangerous, 2 funny, 3 mysterious vulnerabilities

Hello everyone! In this episode, lets take a look at the Microsoft Patch Tuesday August 2022 vulnerabilities. I use my Vulristics vulnerability prioritization tool as usual. I take comments for vulnerabilities from Tenable, Qualys, Rapid7, ZDI and Kaspersky blog posts. Also, as usual, I take into...

Mozilla Releases Security Updates for Firefox, Firefox ESR, and Thunderbird

Mozilla has released security updates to address vulnerabilities in Firefox, Firefox ESR, and Thunderbird. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Mozilla security advisories for Firefox...