Photon OS 2.0: Linux PHSA-2020-2.0-0245

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0245. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid136901...

NewStart CGSL CORE 5.04 / MAIN 5.04 : openjpeg2 Vulnerability (NS-SA-2020-0026)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openjpeg2 packages installed that are affected by a vulnerability: - opjt1clbldecodeprocessor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a different issue th...

VLC < 2.2.9 Type Conversion Vulnerability

The version of VLC media player installed on the remote host is earlier than 2.2.9. It is, therefore, affected by a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid free, because the type of a box may be changed between a read operation and ...

RHEL 7 : openvswitch2.11 (RHSA-2020:2296)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2296 advisory. Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic...

Fedora 30 : netdata (2020-c807d02b1f)

Exclude arch s390x on el8 ---- Update from upstream Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora 31 : log4net (2020-847775bf79)

Security fix for CVE-2018-1285 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Telnetd - Remote Code Execution (CVE-2020-10188)

A buffer overflow condition exists in telnetd due to incorrect bounds checks in the services handling of short writes and urgent data. An unauthenticated, remote attacker can exploit this, via specially crafted telnet packets, to execute arbitrary code on the remote server. C Tenable Network...

Fedora 30 : openconnect (2020-bc22f06aa3)

Update to 8.10 release CVE-2020-12823 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable...

Fedora 31 : exim (2020-93d7305d71)

This is an update fixing out-of-bounds read in the SPA authenticator. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 30 : log4net (2020-cfc319e067)

Security fix for CVE-2018-1285 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Debian DLA-2216-1 : ruby-rack security update

There was a possible directory traversal vulnerability in the Rack::Directory app that is bundled with Rack. If certain directories exist in a director that is managed by Rack::Directory, an attacker could, using this vulnerability, read the contents of files on the server that were outside of th...

EulerOS 2.0 SP8 : postgresql (EulerOS-SA-2020-1587)

According to the version of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found in PostgreSQL's 'ALTER ... DEPENDS ON EXTENSION', where sub-commands did not perform authorization checks. An authenticated...

Cisco Firepower Management Center File Overwrite (cisco-sa-fmcai-z5dQObVN)

File overwrite vulnerability exist in the web UI of Cisco Firepower Management Center due to insufficient input validation. An authenticated, remote attacker can exploit this by sending crafted input to the web UI in order to overwrite files on the file system of the affected device. Please see t...

SUSE SLED15 / SLES15 Security Update : libxml2 (SUSE-SU-2020:1299-1)

This update for libxml2 fixes the following issues : CVE-2019-20388: Fixed a memory leak in xmlSchemaPreRun bsc1161521. CVE-2019-19956: Fixed a memory leak bsc1159928. CVE-2020-7595: Fixed an infinite loop in an EOF situation bsc1161517. Note that Tenable Network Security has extracted the...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : ClamAV vulnerabilities (USN-4370-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4370-1 advisory. It was discovered that ClamAV incorrectly handled parsing ARJ archives. A remote attacker could possibly use this issue to cause...

SUSE SLED15 / SLES15 Security Update : python (SUSE-SU-2020:1339-1)

This update for python fixes the following issues : Security issues fixed : CVE-2019-18348: Fixed a CRLF injection via the host part of the url passed to urlopen. Now an InvalidURL exception is raised bsc1155094. CVE-2019-9674: Improved the documentation to reflect the dangers of zip-bombs...

SUSE SLED15 / SLES15 Security Update : gstreamer-plugins-base (SUSE-SU-2020:1300-1)

This update for gstreamer-plugins-base fixes the following issue : Security issue fixed : CVE-2019-9928: Fixed a heap-based overflow in the rtsp connection parser bsc1133375. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory...

Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2020-037)

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category may cause...

Fedora 31 : abcm2ps (2020-7016bb7a0d)

New upstream release with fixes for CVEs and other enhancements. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 30 : abcm2ps (2020-eb7a965fcf)

New upstream release with fixes for CVEs and other enhancements. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...