macOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-001) (Meltdown)

The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components : - Audio - curl - IOHIDFamily - Kernel - LinkPresentation - QuartzCore - Sandbox - Security - WebKit - Wi-Fi ...

Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3540-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3540-2 advisory. USN-3540-1 addressed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware...

SUSE SLES11 Security Update : rsync (SUSE-SU-2018:0172-1)

This update for rsync fixes one issues. This security issue was fixed : - CVE-2018-5764: The parsearguments function in options.c did not prevent multiple --protect-args uses, which allowed remote attackers to bypass an argument-sanitization protection mechanism bsc1076503 Note that Tenable Netwo...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3542-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3542-1 advisory. Jann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel...

Ubuntu 17.10 : linux vulnerabilities (USN-3541-1) (Meltdown) (Spectre)

Jann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, including kernel memory. This update provide...

SUSE SLES11 Security Update : kernel (SUSE-SU-2018:0171-1) (Meltdown) (Spectre)

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. This update is only provided as a fix update for IBM Z platform. - CVE-2017-5753 / 'Spectre Attack': IBM Z fixes were included but not enabled in the previous update. This update enables those fixes...

Debian DLA-1249-2 : smarty3 regression update

It was previously discovered that there was a code-injection vulnerability in smarty3, a PHP template engine. A via specially crafted filename in comments could result in arbitrary code execution. However, the fix in 3.1.10-2+deb7u2 was incorrect. For Debian 7 'Wheezy', this regression has been...

Debian DLA-1252-1 : couchdb security update

CVE-2017-12635 Prevent non-admin users to give themselves admin privileges. CVE-2017-12636 Blacklist some configuration options to prevent execution of arbitrary shell commands as the CouchDB user For Debian 7 'Wheezy', these problems have been fixed in version 1.2.0-5+deb7u1. We recommend that y...

Fedora 26 : webkitgtk4 (2018-690989736a) (Spectre)

This update includes improvements to mitigate the effects of Spectre CVE-2017-5753 and CVE-2017-5715 : - Disable SharedArrayBuffers from Web API. - Reduce the precision of high resolution time to 1ms. Additional fixes : - Fix API documentation generation with newer gtk-doc. Note that Tenable...

SUSE SLES11 Security Update : rsync (SUSE-SU-2018:0117-1)

This update for rsync fixes the following issues: Security issues fixed : - CVE-2017-17434: The daemon in rsync did not check for fnamecmp filenames in the daemonfilterlist data structure in the recvfiles function in receiver.c and also did not apply the sanitizepaths protection mechanism to...

SUSE SLED12 / SLES12 Security Update : ncurses (SUSE-SU-2018:0120-1)

This update for ncurses fixes the following issues: Security issues fixed : - CVE-2017-13728: Fix infinite loop in the nextchar function in compscan.c bsc1056136. - CVE-2017-13730: Fix illegal address access in the function ncreadentrysource bsc1056131. - CVE-2017-13733: Fix illegal address acces...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0113-1) (Meltdown) (Spectre)

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes. This update is only provided as a fix update for IBM Z platform. - CVE-2017-5753 / 'Spectre Attack': IBM Z fixes were included but not enabled in the previous update. This update enables those fixes. -...

Ubuntu 14.04 LTS / 16.04 LTS : Bind vulnerability (USN-3535-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3535-1 advisory. Jayachandran Palanisamy discovered that the Bind resolver incorrectly handled fetch cleanup sequencing. A remote attacker could possibly use this issu...

Solaris 10 (x86) : 149176-13 (deprecated)

SunOS 5.10x86: qlc patch. Date this patch was last updated by Sun : Jan/16/18 This plugin has been deprecated and either replaced with individual 149176 patch-revision plugins, or deemed non-security related. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2018/03/12. Deprecated and...

Solaris 10 (sparc) : 149175-13 (deprecated)

SunOS 5.10: qlc patch. Date this patch was last updated by Sun : Jan/16/18 This plugin has been deprecated and either replaced with individual 149175 patch-revision plugins, or deemed non-security related. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2018/03/12. Deprecated and either...

Ubuntu 14.04 LTS / 16.04 LTS : Transmission vulnerability (USN-3533-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3533-1 advisory. It was discovered that Transmission incorrectly handled certain POST requests to the RPC server and allowed DNS rebinding attack. An attacker could...

[R2] SecurityCenter 5.6.1 Fixes Multiple Third-party Vulnerabilities

SecurityCenter leverages third-party software to help provide underlying functionality. One of the third-party components OpenSSL was found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with good practice, Tenable opted to...

Fedora 27 : webkitgtk4 (2017-3433c9245d)

This update addresses the following vulnerabilities : - CVE-2017-13798, CVE-2017-13788, CVE-2017-13803 Additional fixes : - Improve calculation of font metrics to prevent scrollbars from being shown unnecessarily in some cases. - Fix handling of null capabilities in WebDriver implementation. Note...

Fedora 27 : phpMyAdmin (2017-cad79c7c6c)

Upstream announcement : Welcome to phpMyAdmin 4.7.7, a regular maintenance release containing bug fixes and a security fix. The security vulnerability is a XSRF/CSRF flaw; you can read more at https://www.phpmyadmin.net/security/PMASA-2017-9/ As a result of this, we recommend all users upgrade...

Fedora 27 : 2:qemu (2017-8db9c497f9)

Fix ppc64 KVM failure bz 1501936 - CVE-2017-15038: 9p: information disclosure when reading extended attributes bz 1499111 - CVE-2017-15268: potential memory exhaustion via websock connection to VNC bz 1496882 ---- qemu-pr-helper didn't work due to a change in the libmultipath/libmpathpersist APIs...