Fedora 29 : mupdf (2019-15af6a9a07)

rebase to 1.15.0 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security, Inc...

Fedora 28 : libmediainfo / mediaconch / mediainfo (2019-7155125125)

Update to 19.04. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security, Inc...

Fedora 30 : kernel (2019-b318b2c6f3)

The 5.0.17 update contains a number of important fixes across the tree Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducin...

Ubuntu 16.04 LTS / 18.04 LTS : curl vulnerabilities (USN-3993-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3993-1 advisory. Wenchao Li discovered that curl incorrectly handled memory in the curlurlset function. A remote attacker could use this issue to cause curl t...

Fedora 30 : nss (2019-481a343318)

Updates the nss package to upstream NSS 3.44. For details about new functionality and a list of bugs fixed in this release please see the upstream release notes https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS3.44 releasenotes Note that Tenable Network Security has extracted the...

Ubuntu 16.04 LTS / 18.04 LTS : LibRaw vulnerabilities (USN-3989-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3989-1 advisory. It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked into processing a specially crafted...

SUSE SLED15 / SLES15 Security Update : ffmpeg (SUSE-SU-2019:1299-1)

This update for ffmpeg fixes the following issues : Security issue fixed : CVE-2018-14395: Fixed a divide-by-zero error in libavformat/movenc.c that allowed attackers to cause a DoS bsc1101889 CVE-2018-14394: Fixed a divide-by-zero error in libavformat/movenc.c that allowed attackers to cause a D...

Fedora 28 : 2:qemu / libvirt (2019-6e146a714c) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

Define md-clear CPUID bit. Assuming an updated host kernel and microcode, the md-clear bit will be automatically exposed to guests using the QEMU '-cpu host' arg, or libvirt 'host-model' or 'host-passthrough' configurations. Guests using a named CPU model it must be manually updated to add this...

SUSE SLED15 / SLES15 Security Update : nmap (SUSE-SU-2019:1290-1)

This update for nmap fixes the following issues : Security issue fixed : CVE-2018-15173: Fixed a remote denial of service attack via a crafted TCP-based service bsc1104139. Non-security issue fixed: Add missing runtime dependency python-xml which prevented zenmap from starting bsc1133512. Note th...

Slack Bug Allows Remote File Hijacking, Malware Injection

A remotely exploitable vulnerability in the Windows desktop app version of the Slack collaboration platform has been uncovered, which allows attackers to alter where files from Slack are downloaded. Nefarious types could redirect the files to their own SMB server; and, they could manipulate the...

Virtuozzo 7 : bpftool / cpupools / cpupools-features / etc (VZA-2019-039)

According to the version of the bpftool / cpupools / cpupools-features / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - The Microarchitectural Store Buffer Data MDS is a series of hardware vulnerabilities which allow speculativ...

Fedora 30 : 2:qemu / libvirt (2019-f910d35647) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

Define md-clear CPUID bit. Assuming an updated host kernel and microcode, the md-clear bit will be automatically exposed to guests using the QEMU '-cpu host' arg, or libvirt 'host-model' or 'host-passthrough' configurations. Guests using a named CPU model it must be manually updated to add this...

Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2019-037)

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the implementation of the 'fill buffer', a mechanism used by modern CPUs when a...

Fedora 28 : kernel / kernel-headers (2019-c36afa818c) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

The 5.0.16 stable updates contain a number of important fixes across the tree. Most importantly, these updates address the kernel portion of the MDS CVEs. ---- The 5.0.14 update contains a number of important fixes across the tree. There is no kernel-headers or kernel-tools build this time. Note...

Ubuntu 14.04 LTS : libvirt update (USN-3985-2) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan Horea Lutas, Andrei Lutas, Volodymyr Pikhur, Stephan van Schaik, Alyssa Milburn, Sebastian Osterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida, Moritz Lipp, Michael Schwarz, and Daniel Gruss discovered...

VMware Workstation 15.x < 15.1.0 DLL-hijacking Vulnerability (VMSA-2019-0007)

The version of VMware Workstation installed on the remote host is 15.x prior to 15.1.0. It is, therefore, affected by DLL-hijacking vulnerability. An authenticated, attacker can exploit this to gain privileged or administrator access to the host system. C Tenable Network Security, Inc...

Fedora 30 : memcached (2019-2bd8e73268)

Security fix for CVE-2019-11596 ---- Update to the lastest upstream release. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Debian DLA-1787-1 : linux-4.9 security update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

Multiple researchers have discovered vulnerabilities in the way the Intel processor designs have implemented speculative forwarding of data filled into temporary microarchitectural structures buffers. This flaw could allow an attacker controlling an unprivileged process to read sensitive...

SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2019:1248-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

This update for xen fixes the following issues : Four new speculative execution information leak issues have been identified in Intel CPUs. bsc1111331 CVE-2018-12126: Microarchitectural Store Buffer Data Sampling MSBDS CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling MFBDS...

[R1] Nessus Agent 7.4.0 Fixes One Third-party Vulnerability

Nessus Agent leverages third-party software to help provide underlying functionality. One of the third-party components OpenSSL was found to contain a single vulnerability, and updated versions have been made available by the providers. Out of caution and in line with good practice, Tenable opted...