SUSE SLED15 / SLES15 Security Update : bzip2 (SUSE-SU-2019:1846-1)

This update for bzip2 fixes the following issues : Security issue fixed : CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors bsc1139083. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable...

Ubuntu 16.04 LTS / 18.04 LTS : Exiv2 vulnerabilities (USN-4056-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4056-1 advisory. It was discovered that Exiv2 incorrectly handled certain PSD files. An attacker could possibly use this issue to cause a denial of service...

Solaris 10 (sparc) : 125731-15

SunOS 5.10: XML and XSLT libraries patch. Date this patch was last updated by Sun : Jul/15/19 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid126717; scriptversion"1.3";...

Ubuntu 16.04 LTS / 18.04 LTS : Zipios vulnerability (USN-4057-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4057-1 advisory. Mike Salvatore discovered that Zipios mishandled certain malformed ZIP files. An attacker could use this vulnerability to cause a denial of service or...

SUSE SLED12 / SLES12 Security Update : Test update for SUSE:SLE-12-SP5:Update (security) (SUSE-SU-2019:1793-1)

This is a security test update for SUSE:SLE-12-SP5:Update Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora 29 : python36 (2019-7df59302e0)

Update Python 3.6 to 3.6.9, the latest security release of the 3.6 branch. Changelog for 3.6.9 final and 3.6.9 release candidate 1. Includes security fixes for CVE-2019-9636, CVE-2019-9740, CVE-2019-10160. Note that Tenable Network Security has extracted the preceding description block directly...

Debian DLA-1852-1 : python3.4 security update

The urllib library in Python ships support for a second, not well known URL scheme for accessing local files 'localfile://'. This scheme can be used to circumvent protections that try to block local file access and only block the well-known 'file://' schema. This update addresses the vulnerabilit...

Ubuntu 16.04 LTS / 18.04 LTS : Firefox vulnerabilities (USN-4054-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4054-1 advisory. A sandbox escape was discovered in Firefox. If a user were tricked in to installing a malicious language pack, an attacker could exploit this...

Citrix SD-WAN Appliance 10.2.2 - Authentication Bypass Remote Command Execution

Citrix SD-WAN Appliance 10.2.2 - Authentication Bypass Remote Command Execution Exploit Title: Citrix SD-WAN Appliance 10.2.2 Auth Bypass and Remote Command Execution Date: 2019-07-12 Exploit Author: Chris Lyne @lynerc Vendor Homepage: https://www.citrix.com Product: Citrix SD-WAN Software Link:...

Slackware 14.2 / current : mozilla-firefox (SSA:2019-191-01)

New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2019-191-01. The text itself is copyright C Slackware Linux,...

Debian DLA-1850-1 : redis security update

It was discovered that there were two heap buffer overflows in the Hyperloglog functionality provided by the Redis in-memory key-value database. For Debian 8 'Jessie', these issues have been fixed in redis version 2:2.8.17-1+deb8u7. We recommend that you upgrade your redis packages. NOTE: Tenable...

Debian DLA-1851-1 : openjpeg2 security update

Two security vulnerabilities were discovered in openjpeg2, a JPEG 2000 image library. CVE-2016-9112 A floating point exception or divide by zero in the function opjpinextcprl may lead to a denial of service. CVE-2018-20847 An improper computation of values in the function opjgetencodingparameters...

SUSE SLED15 / SLES15 Security Update : ruby-bundled-gems-rpmhelper, ruby2.5 (SUSE-SU-2019:1804-1)

This update for ruby2.5 and ruby-bundled-gems-rpmhelper fixes the following issues : Changes in ruby2.5 : Update to 2.5.5 and 2.5.4 : https://www.ruby-lang.org/en/news/2019/03/15/ruby-2-5-5-released/ https://www.ruby-lang.org/en/news/2019/03/13/ruby-2-5-4-released/ Security issues fixed :...

Tenable Nessus < 8.5.0 Multiple Vulnerabilities (TNS-2019-04)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 8.5.0. It is, therefore, affected by multiple vulnerabilities: - A reflected XSS vulnerability due to improper validation of user-supplied input. An unauthenticated, remote attacker could...

OS Identification: iPhone or iPad

Only port 62078 is open on the remote host. It's highly likely to be an iPhone or an iPad. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid126588; scriptversion"1.3"; scriptcvsdate"Date: 2020/01/22"; scriptnameenglish:"OS Identification: iPhone or iPad";...

Ubuntu 16.04 LTS / 18.04 LTS : Apport vulnerability (USN-4051-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4051-1 advisory. Kevin Backhouse discovered a race-condition when reading the user's local Apport configuration. This could be used by a local attacker to cause Apport...

Ubuntu 16.04 LTS / 18.04 LTS : GLib vulnerability (USN-4049-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4049-1 advisory. It was discovered that GLib created directories and files without properly restricting permissions. An attacker could possibly use this issue to acces...

Ubuntu 16.04 LTS / 18.04 LTS : ZeroMQ vulnerability (USN-4050-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4050-1 advisory. It was discovered that ZeroMQ incorrectly handled certain application metadata. A remote attacker could use this issue to cause ZeroMQ to crash, or...

Fedora 30 : libvirt (2019-b2dfb13daf)

CVE-2019-10161: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API bz 1722463, bz 1720115 - CVE-2019-10166: virDomainManagedSaveDefineXML API exposed to readonly clients bz 1722462, bz 1720114 - CVE-2019-10167: arbitrary command execution via virConnectGetDomainCapabilities API bz...

Ubuntu 16.04 LTS / 18.04 LTS : libvirt vulnerabilities (USN-4047-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4047-1 advisory. Matthias Gerstner and Jn Tomko discovered that libvirt incorrectly handled certain API calls. An attacker could possibly use this issue to...