11773 matches found
Debian DLA-928-1 : libsndfile security update
Multiple vulnerabilities were found in libsndfile, a popular library for reading/writing audio files. CVE-2017-7585 In libsndfile before 1.0.28, an error in the 'flacbuffercopy' function flac.c can be exploited to cause a stack-based buffer overflow via a specially crafted FLAC file. CVE-2017-758...
EulerOS 2.0 SP1 : bind (EulerOS-SA-2017-1025)
According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A denial of service flaw was found in the way BIND handled query responses when both DNS64 and RPZ were used. A remote attacker could use this fla...
EulerOS 2.0 SP1 : setroubleshoot, setroubleshoot-plugins (EulerOS-SA-2016-1033)
According to the versions of the setroubleshoot, setroubleshoot-plugins packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The setroubleshoot packages provide tools to help diagnose SELinux problems. When Access Vector Cache AVC messag...
Ubuntu 14.04 LTS / 16.04 LTS : NSS vulnerabilities (USN-3270-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3270-1 advisory. Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker...
Ubuntu 17.04 : qemu vulnerabilities (USN-3268-1)
Zhenhao Hong discovered that QEMU incorrectly handled the Virtio GPU device. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. CVE-2016-10028 It was discovered that QEMU incorrectly handled the JAZZ RC4030 device. A privileged attacker...
Debian DLA-913-1 : activemq security update
It was found that Apache ActiveMQ exposed a remote shutdown command in the ActiveMQConnection class. An attacker could use this flaw to achieve denial of service on a client. For Debian 7 'Wheezy', these problems have been fixed in version 5.6.0+dfsg-1+deb7u3. We recommend that you upgrade your...
Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3265-2)
The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3265-2 advisory. USN-3265-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enableme...
Ubuntu 14.04 LTS : Linux kernel vulnerability (USN-3264-1)
The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3264-1 advisory. Alexander Popov discovered that a race condition existed in the Stream Control Transmission Protocol SCTP implementation in the Linux kernel. A local attacker cou...
CISO Forum 2017
Last week I have attended CISO Forum 2017 in Moscow. I was talking there about "Vulnerability Quadrants: automated hot topic detection in public vulnerability CVE flow". Today I want to share my impressions about the forum itself. To be short, I liked it very much. Both exhibition and...
SUSE SLED12 / SLES12 Security Update : tigervnc (SUSE-SU-2017:1093-1)
This update for tigervnc provides the several fixes. These security issues were fixed : - CVE-2017-7392, CVE-2017-7396: Client can cause leak in VNC server bsc1031886 - CVE-2017-7395: Authenticated VNC client can crash VNC server bsc1031877 - CVE-2017-7394: Client can crash or block VNC server...
Tenable Appliance Unauthorized Administrator Password Manipulation Vulnerability
The Tenable Appliance is a browser-managed application that hosts a variety of Tenable enterprise applications, including Nessus, SecurityCenter SC and Passive Vulnerability Scanner PVS. An unauthorized administrator password manipulation vulnerability exists in Tenable Appliance, which can be...
Tenable Appliance Arbitrary Command Execution Vulnerability
Tenable Appliance is a browser management program developed by Tenable Network Security. An arbitrary command execution vulnerability exists in Tenable Appliance versions 3.5 through 4.4.0. A remote attacker can inject arbitrary commands by manipulating the tnsappliancesessionuser parameter...
CVE-2017-8050
Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password...
CVE-2017-8051
Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tnsappliancesessionuser parameter, a remote attacker can inject arbitrary commands...
CVE-2017-8050
Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password...
Command injection
Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tnsappliancesessionuser parameter, a remote attacker can inject arbitrary commands...
Design/Logic Flaw
Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password...
CVE-2017-8051
Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tnsappliancesessionuser parameter, a remote attacker can inject arbitrary commands...
CVE-2017-8051
Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tnsappliancesessionuser parameter, a remote attacker can inject arbitrary commands...