Fedora 33 : grafana (2020-64e54abd9f)

update to upstream 7.3.6 Note regarding CVE-2020-27846: SAML is not supported in the open source version of Grafana, however the dependency on crewjam/saml is also present in the open source version. This update removes this dependency altogether. Note that Tenable Network Security has extracted...

Debian DLA-2516-1 : gssproxy security update

It was discovered that there was an issue in the gssproxy privilege separation caused by gssproxy not unlocking condmutex prior to calling pthreadexit. For Debian 9 'Stretch', this problem has been fixed in version 0.5.1-2+deb9u1. We recommend that you upgrade your gssproxy packages. For the...

Apache Flink JobManager Traversal

This module exploits an unauthenticated directory traversal vulnerability in Apache Flink versions 1.11.0 use auxiliary/scanner/http/apache/flinkjobmanagertraversal msf undefinedflinkjobmanagertraversal show actions ...actions... msf undefinedflinkjobmanagertraversal set ACTION msf...

EulerOS 2.0 SP9 : unbound (EulerOS-SA-2021-1037)

According to the version of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : libproxy vulnerability (USN-4673-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4673-1 advisory. Li Fei discovered that libproxy incorrectly handled certain PAC files. An attacker could possibly use this issue to cause a crash or execu...

Fedora 32 : guacamole-server (2020-bfde0ab889)

Updated SPEC file and rebuilt for new dependencies. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

EulerOS 2.0 SP9 : glibc (EulerOS-SA-2021-1005)

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The iconv function in the GNU C Library aka glibc or libc6 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an...

Debian DLA-2510-1 : libdatetime-timezone-perl new upstream release

This update includes the changes in tzdata 2020e for the Perl bindings. For the list of changes, see DLA-2510-1. For Debian 9 stretch, this problem has been fixed in version 1:2.09-1+2020e. We recommend that you upgrade your libdatetime-time zone-perl packages. For the detailed security status of...

SUSE SLES12 Security Update : xen (SUSE-SU-2020:3945-1)

This update for xen fixes the following issues : CVE-2020-29480: Fixed an issue which could have allowed leak of non-sensitive data to administrator guests bsc117949 XSA-115. CVE-2020-29481: Fixed an issue which could have allowd to new domains to inherit existing node permissions bsc1179498...

Fedora 33 : libmaxminddb (2020-8a8f8b244f)

New version 1.4.3. Security fix for CVE-2020-28241. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora 33 : mediawiki (2020-0be2d40e13)

https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December /000268.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible witho...

Fedora 32 : xen (2020-df772b417b)

xenstore watch notifications lacking permission checks XSA-115, CVE-2020-29480 1908091 Xenstore: new domains inheriting existing node permissions XSA-322, CVE-2020-29481 1908095 Xenstore: wrong path length check XSA-323, CVE-2020-29482 1908096 Xenstore: guests can crash xenstored via watchs...

SUSE SLES12 Security Update : PackageKit (SUSE-SU-2020:3909-1)

This update for PackageKit fixes the following issues : CVE-2020-16121: Fixed an information disclosure in InstallFiles, GetFilesLocal and GetDetailsLocal bsc1176930. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable...

SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:3902-1)

This update for MozillaFirefox fixes the following issues : Firefox Extended Support Release 78.6.0 ESR - Fixed: Various stability, functionality, and security fixes MFSA 2020-55 bsc1180039 - CVE-2020-16042 bmo1679003 Operations on a BigInt could have caused uninitialized memory to be exposed -...

SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2020:3903-1)

This update for MozillaFirefox fixes the following issues : Firefox Extended Support Release 78.6.0 ESR - Fixed: Various stability, functionality, and security fixes MFSA 2020-55 bsc1180039 - CVE-2020-16042 bmo1679003 Operations on a BigInt could have caused uninitialized memory to be exposed -...

Tenable SecurityCenter < 5.17.0 Multiple Vulnerabilities (TNS-2020-11)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is earlier than 5.17.0. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues nor the stand-alone patch but has instead relied only on the...

Virtuozzo 6 : qemu-guest-agent / qemu-img / qemu-kvm / etc (VZLSA-2020-4056)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4056 advisory. - QEMU: usb: out-of-bounds r/w access issue while processing usb packets CVE-2020-14364 Note that Nessus has not tested for this issue but has instea...

Virtuozzo 6 : python / python-devel / python-libs / python-test / etc (VZLSA-2019-1467)

An update for python is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

SUSE SLED15 / SLES15 Security Update : ceph (SUSE-SU-2020:3895-1)

This update for ceph fixes the following issues : Security issue fixed : CVE-2020-27781: Fixed a privilege escalation via the cephvolumeclient Python interface bsc1180155, bsc1179802. Non-security issues fixed : Update to 15.2.8-80-g1f4b6229ca : + Rebase on tip of upstream 'octopus' branch, SHA1...

CVE-2020-5808

In certain scenarios in Tenable.sc prior to 5.17.0, a scanner could potentially be used outside the user's defined scan zone without a particular zone being specified within the Automatic Distribution configuration...