Fedora 25 : thunderbird (2017-fce0c6fd46)

For changes see: https://www.mozilla.org/en-US/thunderbird/45.8.0/releasenotes/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Ubuntu 14.04 LTS / 16.04 LTS : libarchive vulnerabilities (USN-3225-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3225-1 advisory. It was discovered that libarchive incorrectly handled hardlink entries when extracting archives. A remote attacker could possibly use this...

Fedora 25 : knot / knot-resolver (2017-038e821698)

Knot Resolver 1.2.3 2017-02-23 ================================ Bugfixes -------- - Disable storing GLUE records into the cache even in the non-default QUERYPERMISSIVE mode - iterate: skip answer RRs that don't match the query - layer/iterate: some additional processing for referrals - lib/resolv...

Ubuntu 14.04 LTS / 16.04 LTS : LXC vulnerability (USN-3224-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3224-1 advisory. Jann Horn discovered that LXC incorrectly verified permissions when creating virtual network interfaces. A local attacker could possibly use this issu...

Fedora 25 : GraphicsMagick (2017-c71a0f40f0)

Backport fixes for multiple security vulnerabilities. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Debian DLA-849-1 : linux security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or have other impacts. CVE-2016-9588 Jim Mattson discovered that the KVM implementation for Intel x86 processors does not properly handle BP and OF exceptions in an L2 neste...

Oracle Linux 7 : firefox (ELSA-2017-0461)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2017-0461 advisory. 52.0-4.0.1 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 52.0-4 - Update to 52.0 ESR b4 52.0-3 - Added fix for...

Fedora 24 : cacti (2017-a513be0939)

Update to 1.0.4 Release notes : http://www.cacti.net/releasenotes100.php http://www.cacti.net/releasenotes101.php http://www.cacti.net/releasenotes102.php http://www.cacti.net/releasenotes103.php http://www.cacti.net/releasenotes104.php Note that Tenable Network Security has extracted the...

Ubuntu 16.04 LTS : Linux kernel (AWS) vulnerability (USN-3220-3)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3220-3 advisory. USN-3220-1 fixed a vulnerability in the Linux kernel. This update provides the corresponding updates for the Linux kernel for Amazon Web Services AWS. Alexander...

CVE-2017-6543

Tenable Nessus before 6.10.2 as used alone or in Tenable Appliance before 4.5.0 was found to contain a flaw that allowed a remote, authenticated attacker to upload a crafted file that could be written to anywhere on the system. This could be used to subsequently gain elevated privileges on the...

Code injection

Tenable Nessus before 6.10.2 as used alone or in Tenable Appliance before 4.5.0 was found to contain a flaw that allowed a remote, authenticated attacker to upload a crafted file that could be written to anywhere on the system. This could be used to subsequently gain elevated privileges on the...

CVE-2017-6543

Tenable Nessus before 6.10.2 as used alone or in Tenable Appliance before 4.5.0 was found to contain a flaw that allowed a remote, authenticated attacker to upload a crafted file that could be written to anywhere on the system. This could be used to subsequently gain elevated privileges on the...

CVE-2017-6543

The CVE-2017-6543 entry refers to Tenable Nessus prior to 6.10.2 (and Tenable Appliance prior to 4.5.0) on Windows, with an arbitrary file upload flaw that a remote, authenticated attacker could exploit to write files anywhere and potentially gain elevated privileges after reboot. The connected N...

Ubuntu 14.04 LTS / 16.04 LTS : network-manager-applet vulnerability (USN-3217-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3217-1 advisory. Frederic Bardy and Quentin Biguenet discovered that network-manager-applet incorrectly checked permissions when connecting to certain wireless network...

Ubuntu 16.04 LTS : Linux kernel vulnerability (USN-3220-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3220-1 advisory. Alexander Popov discovered that the NHDLC line discipline implementation in the Linux kernel contained a double-free vulnerability. A local attacker could use thi...

Ubuntu 14.04 LTS : Linux kernel vulnerability (USN-3219-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3219-1 advisory. Alexander Popov discovered that the NHDLC line discipline implementation in the Linux kernel contained a double-free vulnerability. A local attacker could use thi...

Ubuntu 12.04 LTS : linux-lts-trusty vulnerability (USN-3219-2)

USN-3219-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 14.04 LTS for Ubuntu 12.04 LTS. Alexander Popov discovered that the NHDLC line discipline implementation in the Linux...

[R6] Tenable Appliance 4.5.0 Fixes Multiple Vulnerabilities

The Tenable Appliance has recently been discovered to contain several vulnerabilities. One exists in the underlying operating system kernel, two in the Appliance web interface, and multiple issues in bundled applications. Since the Appliance ships with other Tenable products, please consult the...

Tenable SecurityCenter 5.4.x <= 5.4.3 PHP Object Deserialization Remote File Deletion (TNS-2017-05)

According to its version, the installation of Tenable SecurityCenter on the remote host is affected by a PHP object deserialization vulnerability in the PluginParser.php script. An authenticated, remote attacker can exploit this, by uploading a specially crafted PHP object, to delete arbitrary...

SUSE SLES12 Security Update : openssh (SUSE-SU-2017:0607-1)

This update for openssh fixes the following issues : - CVE-2016-8858: prevent resource depletion during key exchange bsc1005480 - CVE-2016-10009: limit directories for loading PKCS11 modules to avoid privilege escalation bsc1016366 - CVE-2016-10011: Prevent possible leaks of host private keys to...