Ubuntu 18.04 LTS : Apache HTTP Server vulnerabilities (USN-3783-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3783-1 advisory. Robert Swiecki discovered that the Apache HTTP Server HTTP/2 module incorrectly destroyed certain streams. A remote attacker could possibly use this issu...

RHEL 6 / 7 : Red Hat JBoss Web Server 5.0 Service Pack 1 (RHSA-2018:2868)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2868 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the...

Debian DLA-1530-1 : imagemagick security update

Several security vulnerabilities were discovered in ImageMagick, an image manipulation program, that allow remote attackers to cause denial of service application crash, excessive memory allocation, or other unspecified effects or out of bounds memory access via DCM, PWP, CALS, PICT, BMP, DIB, or...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Firefox vulnerabilities (USN-3778-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3778-1 advisory. A crash was discovered in TransportSecurityInfo used for SSL, which could be triggered by data stored in the local cache director...

Ubuntu 18.04 LTS : HAProxy vulnerability (USN-3780-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3780-1 advisory. It was discovered that HAProxy incorrectly handled certain requests. An attacker could possibly use this issue to cause a denial of service. Tenable has extracted...

Fedora 27 : spamassassin (2018-6ed251c42b)

Fixed some small bugs in the previous package: Initial rules now have the correct version, sought channel config is dropped since it doesn't exist anymore and build / runtime deps adjusted. ---- Update to 3.4.2. Fixes CVE-2017-15705, CVE-2018-11780 and CVE-2018-11781 along with many other bugfixe...

Fedora 27 : glusterfs (2018-9a4d7ec61e)

3.12.14 GA Security Fix for CVE-2018-10904 Security Fix for CVE-2018-10907 Security Fix for CVE-2018-10911 Security Fix for CVE-2018-10913 Security Fix for CVE-2018-10914 Security Fix for CVE-2018-10923 Security Fix for CVE-2018-10926 Security Fix for CVE-2018-10927 Security Fix for CVE-2018-1092...

Ubuntu 16.04 LTS : Mutt vulnerabilities (USN-3719-3)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3719-3 advisory. USN-3719-1 fixed vulnerabilities in Mutt. Unfortunately, the fixes were not correctly applied to the packaging for Mutt in Ubuntu 16.04 LTS. This update...

Debian DLA-1522-1 : strongswan security update

Sze Yiu Chau and his team from Purdue University and The University of Iowa found several security issues in the gmp plugin for strongSwan, an IKE/IPsec suite. CVE-2018-16151 The OID parser in the ASN.1 code in gmp allows any number of random bytes after a valid OID. CVE-2018-16152 The...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : strongSwan vulnerabilities (USN-3771-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3771-1 advisory. It was discovered that strongSwan incorrectly handled IKEv2 key derivation. A remote attacker could possibly use this issue to...

Debian DLA-1519-1 : python2.7 security update

Multiple vulnerabilities were found in the CPython interpreter which can cause denial of service, information gain, and arbitrary code execution. CVE-2017-1000158 CPython aka Python is vulnerable to an integer overflow in the PyStringDecodeEscape function in stringobject.c, resulting in heap-base...

Solaris 10 (sparc) : 126206-13

SunOS 5.10: zebra ripd quagga patch. Date this patch was last updated by Sun : Sep/24/18 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid117683; scriptversion"1.4";...

SUSE SLES12 Security Update : gnutls (SUSE-SU-2018:2825-1)

This update for gnutls fixes the following issues : This update for gnutls fixes the following issues : Security issues fixed : Improved mitigations against Lucky 13 class of attacks 'Just in Time' PRIME + PROBE cache-based side channel attack can lead to plaintext recovery CVE-2018-10846,...

Tenable SecurityCenter < 5.7.1 Multiple Vulnerabilities (TNS-2018-12)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is prior to 5.7.1. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported...

SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2018:2778-1)

This update for ImageMagick fixes the following issues : The following security vulnerabilities were fixed : CVE-2018-16329: Prevent NULL pointer dereference in the GetMagickProperty function leading to DoS bsc1106858 CVE-2018-16323: ReadXBMImage left data uninitialized when processing an XBM fil...

macOS : Apple Safari < 12 Multiple Vulnerabilities

The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 12. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid117617; scriptversion"1.6"; scriptcvsdate"Date: 2019/11/01"; scriptcveid...

Debian DLA-1507-1 : libapache2-mod-perl2 security update

Jan Ingvoldstad discovered that libapache2-mod-perl2 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because contrary to the documentation there is no configuration option that permits Perl code for the administrator's control of HTTP request processi...

NUUO NVRMini2 3.8 - cgi_system Buffer Overflow (Enable Telnet) Exploit

Exploit Title: NUUO NVRMini2 3.8 - 'cgisystem' Buffer Overflow Enable Telnet Exploit Author: Jacob Baines Vendor Homepage: https://www.nuuo.com/ Device: NRVMini2 Software Link: https://www.nuuo.com/ProductNode.php?node=2 Versions: 3.8.0 and below Tested Against: 03.07.0000.0011 and 03.08.0000.000...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : ClamAV regression (USN-3722-5)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3722-5 advisory. USN-3722-1 fixed vulnerabilities in ClamAV. The new package introduced an issue which caused dpkg- reconfigure to enter an infinite loop...

EulerOS Virtualization 2.5.0 : dhcp (EulerOS-SA-2018-1241)

According to the version of the dhcp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - It was found that the DHCP daemon did not properly clean up closed OMAPI connections in certain cases. A remote attacker able to conne...