Fedora 31 : python-waitress (2020-65a7744e38)

Update to 1.4.3, fixing CVE-2019-16786 CVE-2019-16785 CVE-2019-16789 and adding various other hardening features. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and forma...

SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2020:0488-1)

This update for nodejs6 fixes the following issues : Security issues fixed : CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string CVE-2019-15604, bsc1163104. CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed...

Fedora 31 : NetworkManager-ssh (2020-28ae68ec60)

Fix privilege escalation https://bugzilla.redhat.com/showbug.cgi?id=1803499 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora 30 : python-waitress (2020-bdcc8ffc24)

Update to 1.4.3, fixing CVE-2019-16786 CVE-2019-16785 CVE-2019-16789 and adding various other hardening features. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and forma...

SUSE SLES15 Security Update : nodejs8 (SUSE-SU-2020:0454-1)

This update for nodejs8 fixes the following issues : Security issues fixed : CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string CVE-2019-15604, bsc1163104. CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed...

Cisco Email Security Appliance Content Filter Bypass Vulnerability (CSCvq66135)

According to its self-reported version, Cisco Email Security Appliance ESA is affected by an input-validation flaw related to the email message filtering feature that allows further attacks by allowing malicious content to pass through the device. Please see the included Cisco BID and Cisco...

Fedora 30 : python-psutil (2020-a06ebafad8)

Update to 5.6.7 to fix CVE-2019-18874 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable...

SUSE SLED15 / SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2020:0466-1)

This update for java-180-ibm fixes the following issues : Java 8.0 was updated to Service Refresh 6 Fix Pack 5 bsc1162972, bsc1160968 CVE-2020-2583: Unlink Set of LinkedHashSets CVE-2019-4732: Untrusted DLL search path vulnerability CVE-2020-2593: Normalize normalization for all CVE-2020-2604:...

EulerOS 2.0 SP8 : openjpeg2 (EulerOS-SA-2020-1168)

According to the versions of the openjpeg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - OpenJPEG through 2.3.1 has a heap-based buffer overflow in opjt1clbldecodeprocessor in openjp2/t1.c because of lack of...

Ubuntu 16.04 LTS / 18.04 LTS : rsync vulnerabilities (USN-4292-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4292-1 advisory. It was discovered that rsync incorrectly handled pointer arithmetic in zlib. An attacker could use this issue to cause rsync to crash,...

EulerOS 2.0 SP8 : python-urllib3 (EulerOS-SA-2020-1177)

According to the version of the python-urllib3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.CVE-2019-11236...

Ubuntu 18.04 LTS : mod-auth-mellon vulnerability (USN-4291-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4291-1 advisory. It was discovered that modauthmellon incorrectly handled certain requests. An attacker could possibly use this issue to redirect a user to a malicious URL. Tenabl...

Druva inSync inSyncCPHwnet64.exe RPC Type 5 Privilege Escalation

Druva inSync client for Windows exposes a network service on TCP port 6064 on the local network interface. inSync versions 6.6.3 and prior do not properly validate user-supplied program paths in RPC type 5 messages, allowing execution of arbitrary commands as SYSTEM. This module has been tested...

EulerOS 2.0 SP8 : python3 (EulerOS-SA-2020-1175)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service resource consumption via a ZIP bomb.CVE-2019-9674 -...

EulerOS 2.0 SP8 : poppler (EulerOS-SA-2020-1173)

According to the versions of the poppler packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dic...

Fedora 30 : hiredis (2020-f6cc7883b8)

Fix for CVE-2020-7105 hiredis: NULL pointer dereference in async.c and dict.c Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

EulerOS 2.0 SP5 : vim (EulerOS-SA-2020-1138)

According to the version of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group which may be different from the group ownershi...

EulerOS 2.0 SP5 : openslp (EulerOS-SA-2020-1120)

According to the version of the openslp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the...

Fedora 31 : mingw-SDL (2020-24652fe41c)

Security fix for CVE-2019-13616, CVE-2019-7572, CVE-2019-7572, CVE-2019-7573 CVE-2019-7576, CVE-2019-7574, CVE-2019-7575, CVE-2019-7577, CVE-2019-7577, CVE-2019-7578, CVE-2019-7635, CVE-2019-7637, CVE-2019-7638, CVE-2019-7636 Note that Tenable Network Security has extracted the preceding...

Fedora 30 : 1:nodejs / http-parser (2020-830d8a1a92)

Update to 10.19.0 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security, Inc...