Ubuntu 18.04 LTS / 20.04 LTS : Flatpak vulnerability (USN-4721-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4721-1 advisory. Simon McVittie discovered that flatpak-portal service allowed sandboxed applications to execute arbitrary code on the host system a sandbox escape. A...

EulerOS 2.0 SP5 : sox (EulerOS-SA-2021-1231)

According to the versions of the sox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - SoX Sound eXchange is a sound file format converter SoX can convert between many different digitized sound formats and perform simple sound...

RHEL 8 : RHV-M (ovirt-engine) 4.4.z security, upd[ovirt-4.4.4] 0-day (Moderate) (RHSA-2021:0383)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0383 advisory. The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform that allows system administrators to view and...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Apport vulnerabilities (USN-4720-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4720-1 advisory. Itai Greenhut discovered that Apport incorrectly parsed certain files in the /proc filesystem. A local attacker could use this...

Ubuntu 16.04 LTS / 18.04 LTS : fastd vulnerability (USN-4718-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4718-1 advisory. It was discovered that fastd incorrectly handled certain packets. An attacker could possibly use this issue to cause a denial of service. Tenable has...

SUSE SLED15 / SLES15 Security Update : openvswitch (SUSE-SU-2021:0258-1)

This update for openvswitch fixes the following issues : openvswitch was updated to 2.13.2 CVE-2020-27827: Fixed a memory leak when parsing lldp packets bsc1181345 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable ha...

Debian DLA-2536-1 : libsdl2 security update

Several issues have been found in libsdl2, a library for portable low level access to a video framebuffer, audio output, mouse, and keyboard. All issues are related to either buffer overflow, integer overflow or heap-based buffer over-read, resulting in a DoS or remote code execution by using...

EulerOS 2.0 SP8 : php (EulerOS-SA-2021-1163)

According to the version of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - FILTERVALIDATEURL accepts URLs with invalid userinfoCVE-2020-7071 Note that Tenable Network Security has extracted the preceding description block...

EulerOS 2.0 SP8 : curl (EulerOS-SA-2021-1137)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP...

EulerOS 2.0 SP8 : lua (EulerOS-SA-2021-1154)

According to the version of the lua packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal3,2^31.CVE-2020-24370 Not...

Debian DLA-2538-1 : mariadb-10.1 security update

Two vulnerabilities were fixed by upgrading the MariaDB database server packages to the latest version on the 10.1 branch. For Debian 9 stretch, these problems have been fixed in version 10.1.48-0+deb9u1. We recommend that you upgrade your mariadb-10.1 packages. For the detailed security status o...

Debian DLA-2537-1 : ffmpeg security update

Two vulnerabilities have been discovered in ffmpeg, a widely used multimedia framework. CVE-2019-17539 a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer CVE-2020-35965 an out-of-bounds write because of errors in calculations of when to...

EulerOS 2.0 SP8 : nss-softokn (EulerOS-SA-2021-1155)

According to the versions of the nss-softokn packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Network Security Services NSS before 3.46, several cryptographic primitives had missing length checks. In cases where the application...

CentOS 8 : edk2 (CESA-2019:0968)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:0968 advisory. - edk2: Buffer Overflow in BlockIo service for RAM disk CVE-2018-12180 Note that Nessus has not tested for this issue but has instead relied only on the...

Ubuntu 20.04 LTS : TCMU vulnerability (USN-4707-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4707-1 advisory. It was discovered that TCMU lacked a check for transport-layer restrictions, allowing remote attackers to read or write files via directory traversal in an XCOPY...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4709-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4709-1 advisory. It was discovered that the LIO SCSI target implementation in the Linux kernel performed insufficient identifier checking in certain XCOPY requests. An...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel regression (USN-4712-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4712-1 advisory. USN-4576-1 fixed a vulnerability in the overlay file system implementation in the Linux kernel. Unfortunately, that fix introduced a regression that...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4711-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4711-1 advisory. It was discovered that the LIO SCSI target implementation in the Linux kernel performed insufficient identifier checking in certain XCOPY...

Rockwell Automation FactoryTalk Linx and FactoryTalk Services Platform

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Rockwell Automation Equipment: FactoryTalk Linx and FactoryTalk Services Platform Vulnerabilities: Classic Buffer overflow, Improper Check or Handling of Exceptional Conditions 2. RISK EVALUATION...

Debian DLA-2534-1 : sudo security update

The Qualys Research Labs discovered a heap-based buffer overflow vulnerability in sudo, a program designed to provide limited super user privileges to specific users. Any local user sudoers and non-sudoers can exploit this flaw for root privilege escalation. For Debian 9 stretch, this problem has...