Fedora 25 : perl-File-Path (2017-dd42592f9a)

This release fixes a possible setting arbitrary mode on an arbitrary file in rmtree and removetree calls known as CVE-2017-6512. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically...

Debian DLA-986-1 : zookeeper security update

It was discovered that Zookeeper, a service for maintaining configuration information, didn't restrict access to the computationally expensive wchp/wchc commands which could result in denial of service by elevated CPU consumption. This update disables those two commands by default. The new...

Ubuntu 14.04 LTS / 16.04 LTS : libmwaw vulnerability (USN-3319-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3319-1 advisory. It was discovered that libmwaw incorrectly handled certain malformed document files. If a user or automated system were tricked into opening a special...

Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3315-1)

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, obtain sensitive information, spoof the addressbar contents, or execute...

Debian DLA-985-1 : libsndfile security update

It was discovered that there was a vulnerability in libsndfile, a library for reading/writing audio files. A specially crafted AIFF 'Audio Interchange File Format' file could result in an out-of-bounds memory read. For Debian 7 'Wheezy', this issue has been fixed in libsndfile version...

EulerOS 2.0 SP2 : nss (EulerOS-SA-2017-1109)

According to the version of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A null pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application...

EulerOS 2.0 SP1 : openjpeg (EulerOS-SA-2017-1088)

According to the versions of the openjpeg package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in OpenJPEG. A specially crafted JPEG2000 image could cause...

EulerOS 2.0 SP1 : ghostscript (EulerOS-SA-2017-1100)

According to the version of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that ghostscript did not properly validate the parameters passed to the .rsdparams and .eqproc functions. During its execution, a...

Ubuntu 16.04 LTS : lintian vulnerability (USN-3310-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3310-1 advisory. Jakub Wilk discovered that lintian incorrectly handled deserializing certain YAML files. If a user or automated system were tricked into running lintian on a...

Debian DLA-980-1 : ming security update

It was found that ming, a library to parse and generate SWF Flash files, is susceptible to an integer overflow that would lead into out of bound memory writes via a maliciously crafted file. For Debian 7 'Wheezy', these problems have been fixed in version 1:0.4.4-1.1+deb7u3. We recommend that you...

Ubuntu 14.04 LTS / 16.04 LTS : libnl vulnerability (USN-3311-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3311-1 advisory. It was discovered that libnl incorrectly handled memory when performing certain operations. A local attacker could possibly use this issue to cause...

Ubuntu 14.04 LTS : Puppet vulnerabilities (USN-3308-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3308-1 advisory. Dennis Rowe discovered that Puppet incorrectly handled the search path. A local attacker could use this issue to possibly execute arbitrary code...

Virtuozzo 7 : readykernel-patch (VZA-2017-045)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - The tcpv6synrecvsock function in net/ipv6/tcpipv6.c in the Linux kernel mishandles inheritance, which allows local...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3579)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3579 advisory. - net/packet: fix overflow in check for tpreserve Andrey Konovalov Orabug: 26143545 CVE-2017-7308 - net/packet: fix overflow in check for tpframenr Andrey...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3580)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3580 advisory. - net/packet: fix overflow in check for tpreserve Andrey Konovalov Orabug: 26143552 CVE-2017-7308 - net/packet: fix overflow in check for tpframenr Andrey...

Tenable Nessus Agent Installed (Windows)

Binary data tenablenessusagentinstalledwin.nbin...

Ubuntu 14.04 LTS / 16.04 LTS : NVIDIA graphics drivers vulnerabilities (USN-3305-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3305-1 advisory. It was discovered that the NVIDIA graphics drivers contained flaws in the kernel mode layer. A local attacker could use these issues to cause...

Tenable Nessus Agent 6.10.x < 6.10.5 Multiple Vulnerabilities (TNS-2017-10)

The version of Nessus Agent installed on the remote host is 6.10.x prior to 6.10.5. It is, therefore, affected by the following vulnerabilities : - A denial of service vulnerability exists in the agent mode functionality due to insecure permissions. An authenticated, remote attacker can exploit...

Oracle Linux 7 : nss (ELSA-2017-1365)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-1365 advisory. 3.28.4-1.2.0.1 - Added nss-vendor.patch to change vendor 3.28.4-1.2 - Include CKBI 2.14 and updated CA constraints from NSS 3.28.5 3.28.4-1.1 - Fix zero-length...

SUSE SLES12 Security Update : postgresql93 (SUSE-SU-2017:1441-1)

This update for postgresql93 fixes the following issues: The PostgreSQL package was updated to 9.3.17, bringing various bug and security fixes. Bug fixes : - bsc1029547: Fix tests with timezone 2017a - CVE-2017-7486: Restrict visibility of pgusermappings.umoptions, to protect passwords stored as...