[R1] Nessus 8.13.2 Fixes Multiple Third-party Vulnerabilities

Nessus leverages third-party software to help provide underlying functionality. One of the third-party components OpenSSL was found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with good practice, Tenable opted to upgrade t...

Google Chrome < 89.0.4389.114 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 89.0.4389.114. It is, therefore, affected by multiple vulnerabilities as referenced in the 202103stable-channel-update-for-desktop30 advisory. - Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114...

SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2021:0947-1)

This update for python3 fixes the following issues : python36 was updated to 3.6.13 CVE-2021-23336: Fixed a potential web cache poisoning by using a semicolon in query parameters use of semicolon as a query string separator bsc1182379. Note that Tenable Network Security has extracted the precedin...

SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2021:0955-1)

This update for openssl-11 fixes the security issue : CVE-2021-3449: An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signaturealgorithms extension but includes a signaturealgorithmscert...

SUSE SLES12 Security Update : sudo (SUSE-SU-2021:0928-1)

This update for sudo fixes the following issues : Fixed a potential crash on exit as a result of the fix of CVE-2021-3156 bsc1181090 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically...

SUSE SLED15 / SLES15 Security Update : gnutls (SUSE-SU-2021:0935-1)

This update for gnutls fixes the following issues : CVE-2021-20232: Fixed a use after free issue which could have led to memory corruption and other potential consequences bsc1183456. CVE-2021-20231: Fixed a use after free issue which could have led to memory corruption and other potential...

Debian DLA-2606-1 : lxml security update

An issue has been found in lxml, a pythonic binding for the libxml2 and libxslt libraries. Due to missing input sanitization, XSS is possible for the HTML5 formaction attribute. For Debian 9 stretch, this problem has been fixed in version 3.7.1-1+deb9u4. We recommend that you upgrade your lxml...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4890-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4890-1 advisory. Piotr Krysiuk discovered that the BPF subsystem in the Linux kernel did not properly compute a speculative execution limit on pointer...

Cisco IOS XE Software SD WAN Privilege Escalation (cisco-sa-sdwan-clipriv-9TO2QGVp)

According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information. TRUSTED...

RHEL 8 : firefox (RHSA-2021:0990)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0990 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

EulerOS 2.0 SP5 : mutt (EulerOS-SA-2021-1690)

According to the version of the mutt package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $sslforcetls was processed if an IMAP server's initial server response was invalid...

Debian DLA-2605-1 : mariadb-10.1 security update

A remote code execution issue was discovered in MariaDB. An untrusted search path leads to eval injection, in which a database SUPER user can execute OS commands after modifying wsrepprovider and wsrepnotifycmd. For Debian 9 stretch, this problem has been fixed in version 10.1.48-0+deb9u2. We...

EulerOS 2.0 SP5 : curl (EulerOS-SA-2021-1672)

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.CVE-2020-8285...

Cisco IOS XE Software IOx for Command Injection (cisco-sa-iox-cmdinj-RkSURGHG)

According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. Please see the included Cisco BIDs and Cisco Security Advisory for more information. TRUSTED...

Ubuntu 18.04 LTS / 20.04 LTS : libzstd vulnerabilities (USN-4760-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4760-1 advisory. It was discovered that libzstd incorrectly handled file permissions. A local attacker could possibly use this issue to access certain files,...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : GLib vulnerabilities (USN-4759-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4759-1 advisory. Krzesimir Nowak discovered that GLib incorrectly handled certain large buffers. A remote attacker could use this issue to cause...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Privoxy vulnerabilities (USN-4886-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4886-1 advisory. It was discovered that Privoxy incorrectly handled CGI requests. An attacker could possibly use this issue to cause a denial of...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : OpenLDAP vulnerability (USN-4744-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4744-1 advisory. Pasi Saarinen discovered that OpenLDAP incorrectly handled certain short timestamps. A remote attacker could possibly use this issue to...

Ubuntu 20.04 LTS : OpenSSH vulnerability (USN-4762-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4762-1 advisory. It was discovered that the OpenSSH ssh-agent incorrectly handled memory. A remote attacker able to connect to the agent could use this issue to cause it to crash,...

Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-4879-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4879-1 advisory. It was discovered that the Marvell WiFi-Ex device driver in the Linux kernel did not properly validate ad- hoc SSIDs. A local attacker could use this to...