Fedora 30 : 2:qemu (2019-52a8f5468e)

CVE-2019-12155: qxl: NULL pointer dereference while releasing spice resources bz 1712727, bz 1712670 - CVE-2019-5008: NULL pointer dereference in hw/sparc64/sun4u.c leading to DoS bz 1705916, bz 1705915 - CVE-2018-20815: devicetree: heap buffer overflow while loading device tree blob bz 1693117,...

Ubuntu 16.04 LTS / 18.04 LTS : libvirt vulnerabilities (USN-4047-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4047-1 advisory. Matthias Gerstner and Jn Tomko discovered that libvirt incorrectly handled certain API calls. An attacker could possibly use this issue to...

SUSE SLES12 Security Update : php72 (SUSE-SU-2019:1724-1)

This update for php72 fixes the following issues : Security issues fixed : CVE-2019-11039: Fixed a heap-buffer-overflow on phpjpgget16 bsc1138173. CVE-2019-11040: Fixed an out-of-bounds read due to an integer overflow in iconv.c:phpiconvmimedecode bsc1138172. Note that Tenable Network Security ha...

Ubuntu 16.04 LTS / 18.04 LTS : ZNC vulnerability (USN-4044-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4044-1 advisory. Fix vulnerability where an authenticated non-admin users could load a module with a crafted name, then escalate privileges and run arbitrary code...

SUSE SLED15 / SLES15 Security Update : taglib (SUSE-SU-2019:1374-2)

This update for taglib fixes the following issues : CVE-2018-11439: The TagLib::Ogg::FLAC::File::scan function allowed remote attackers to cause information disclosure heap-based buffer over-read via a crafted audio file bsc1096180 Note that Tenable Network Security has extracted the preceding...

Fedora 29 : kernel / kernel-headers (2019-69c132b061)

Update to v5.1.15 ---- Update to v5.1.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable...

Security Camera Firm Arlo Zaps High-Severity Bugs

Two high-severity vulnerabilities in Arlo Technologies’ wireless home security camera gear have been patched. The flaws, which indirectly impact Arlo’s popular fleet of wireless home security cameras, are limited to adversaries with local network and physical access to Arlo Base Stations. Both...

Scientific Linux Security Update : firefox on SL7.x x86_64 (20190626)

Security Fixes : - Mozilla: Type confusion in Array.pop CVE-2019-11707 - Mozilla: Sandbox escape using Prompt:Open CVE-2019-11708 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid126434; scriptversion"1.11";...

Debian DLA-1842-1 : python-django security update

It was discovered that the Django Python web development framework did not correct identify HTTP connections when a reverse proxy connected via HTTPS. When deployed behind a reverse-proxy connecting to Django via HTTPS django.http.HttpRequest.scheme would incorrectly detect client requests made v...

CVE-2019-3962

Content Injection vulnerability in Tenable Nessus prior to 8.5.0 may allow an authenticated, local attacker to exploit this vulnerability by convincing another targeted Nessus user to view a malicious URL and use Nessus to send fraudulent messages. Successful exploitation could allow the...

CVE-2019-3962

Content Injection vulnerability in Tenable Nessus prior to 8.5.0 may allow an authenticated, local attacker to exploit this vulnerability by convincing another targeted Nessus user to view a malicious URL and use Nessus to send fraudulent messages. Successful exploitation could allow the...

Code injection

Content Injection vulnerability in Tenable Nessus prior to 8.5.0 may allow an authenticated, local attacker to exploit this vulnerability by convincing another targeted Nessus user to view a malicious URL and use Nessus to send fraudulent messages. Successful exploitation could allow the...

CVE-2019-3962

Content Injection vulnerability in Tenable Nessus prior to 8.5.0 may allow an authenticated, local attacker to exploit this vulnerability by convincing another targeted Nessus user to view a malicious URL and use Nessus to send fraudulent messages. Successful exploitation could allow the...

CVE-2019-3962

CVE-2019-3962 affects Tenable Nessus pre-8.5.0. An authenticated, local attacker can induce a targeted user to view a malicious URL and trigger Nessus to send fraudulent messages, allowing arbitrary text to be injected into the feed status, persisting after session expiration. Mitigation: upgrade...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel update (USN-4041-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4041-1 advisory. USN-4017-1 fixed vulnerabilities in the Linux kernel for Ubuntu. Unfortunately, the update introduced a regression that interfered with networking...

Fedora 30 : libtiff (2019-fa3e40f00a)

Fix for CVE-2018-19210. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security...

SUSE SLED15 / SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2019:1308-2)

This update for java-180-ibm fixes the following issues : Update to Java 8.0 Service Refresh 5 Fix Pack 35. Security issues fixed : CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes bsc1134718. CVE-2019-2698: Fixed out of bounds access flaw in the 2D component bsc1132729...

Fedora 29 : php-brumann-polyfill-unserialize / php-typo3-phar-stream-wrapper2 (2019-af7bef7165)

Two security updates have been released for PharStreamWrapper. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

RHEL 7 : redhat-virtualization-host (RHSA-2019:1594)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1594 advisory. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host,...

Ubuntu 16.04 LTS / 18.04 LTS : bzip2 vulnerabilities (USN-4038-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4038-1 advisory. Aladdin Mubaied discovered that bzip2 incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of...