Tenable Nessus <= 8.13.2 Privilege Escalation Vulnerability (TNS-2021-07)

Tenable Nessus is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tenable:nessus";...

Tenable Nessus <= 8.13.1 Multiple Third-party Vulnerabilities (TNS-2021-05)

Tenable Nessus is prone to multiple third-party vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tenable:nessus";...

RHEL 7 : libldb (RHSA-2021:1072)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1072 advisory. The libldb packages provide an extensible library that implements an LDAP-like API to access remote LDAP servers, or use local TDB databases. Securit...

RHEL 8 : flatpak (RHSA-2021:1068)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1068 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: file forwarding feature...

Debian DLA-2619-1 : python3.5 security update

Three security issues have been discovered in python3.5 : CVE-2021-3177 Python 3.x has a buffer overflow in PyCArgrepr in ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input. This occurs because sprintf is...

Tenable Nessus 8.9.0 < 8.13.2 Multiple Vulnerabilities (TNS-2021-05)

According to its self-reported version, the Tenable Nessus application running on the remote host is 8.9.0 prior to 8.13.2. It is, therefore, affected by multiple vulnerabilities: - An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : curl vulnerabilities (USN-4898-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4898-1 advisory. Viktor Szakats discovered that curl did not strip off user credentials from referrer header fields. A remote attacker could...

Debian DLA-2612-1 : leptonlib security update

Several issues have been found by ClusterFuzz in leptonlib, an image processing library. All issues are related to heap-based buffer over-read in several functions or a denial of service application crash with crafted data. For Debian 9 stretch, these problems have been fixed in version...

Tenable SecurityCenter 5.13.x < 5.18.0 DoS (TNS-2021-06)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is version 5.13.x 5.18.0 and affected by the following OpenSSL denial of service vulnerability: - An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : SpamAssassin vulnerability (USN-4899-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4899-1 advisory. Damian Lukowski discovered that SpamAssassin incorrectly handled certain CF files. If a user or automated system were tricked into using a...

[R1] Nessus 8.13.2 Fixes Multiple Third-party Vulnerabilities

Nessus leverages third-party software to help provide underlying functionality. One of the third-party components OpenSSL was found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with good practice, Tenable opted to upgrade t...

Google Chrome < 89.0.4389.114 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 89.0.4389.114. It is, therefore, affected by multiple vulnerabilities as referenced in the 202103stable-channel-update-for-desktop30 advisory. - Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114...

Debian DLA-2606-1 : lxml security update

An issue has been found in lxml, a pythonic binding for the libxml2 and libxslt libraries. Due to missing input sanitization, XSS is possible for the HTML5 formaction attribute. For Debian 9 stretch, this problem has been fixed in version 3.7.1-1+deb9u4. We recommend that you upgrade your lxml...

SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2021:0947-1)

This update for python3 fixes the following issues : python36 was updated to 3.6.13 CVE-2021-23336: Fixed a potential web cache poisoning by using a semicolon in query parameters use of semicolon as a query string separator bsc1182379. Note that Tenable Network Security has extracted the precedin...

SUSE SLED15 / SLES15 Security Update : gnutls (SUSE-SU-2021:0935-1)

This update for gnutls fixes the following issues : CVE-2021-20232: Fixed a use after free issue which could have led to memory corruption and other potential consequences bsc1183456. CVE-2021-20231: Fixed a use after free issue which could have led to memory corruption and other potential...

SUSE SLES12 Security Update : sudo (SUSE-SU-2021:0928-1)

This update for sudo fixes the following issues : Fixed a potential crash on exit as a result of the fix of CVE-2021-3156 bsc1181090 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically...

SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2021:0955-1)

This update for openssl-11 fixes the security issue : CVE-2021-3449: An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signaturealgorithms extension but includes a signaturealgorithmscert...

Cisco IOS XE Software SD WAN Privilege Escalation (cisco-sa-sdwan-clipriv-9TO2QGVp)

According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information. TRUSTED...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4890-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4890-1 advisory. Piotr Krysiuk discovered that the BPF subsystem in the Linux kernel did not properly compute a speculative execution limit on pointer...

RHEL 8 : firefox (RHSA-2021:0990)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0990 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...