Tenable SecurityCenter < 5.3.2 Multiple Vulnerabilities (TNS-2016-09)

The Tenable SecurityCenter application installed on the remote host is either prior to version 5.3.2 or is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of PHP : - A signedness error exists in the GD Graphics library in gdgd2.c due to...

MySQL Server Login Possible

Nessus was able to log into the remote MySQL server using the supplied credentials. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid91823; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate", value:"2026/01/27"; scriptnameenglish:"MySQL Server Log...

Debian DLA-524-1 : squidguard security update

It was discovered that there was a reflected cross-site scripting vulnerability in squidguard, a filter and redirector plugin for Squid. For Debian 7 'Wheezy', this issue has been fixed in squidguard version 1.5-1+deb7u1. We recommend that you upgrade your squidguard packages. NOTE: Tenable Netwo...

Ubuntu 14.04 LTS / 16.04 LTS : Wget vulnerability (USN-3012-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3012-1 advisory. Dawid Golunski discovered that Wget incorrectly handled filenames when being redirected from an HTTP to an FTP URL. A malicious server could possibly...

Debian DLA-517-1 : imagemagick security update

The code did not check the integer didn't overflow before trying to resize a buffer. A specially crafted file could result in using memory past the end of the allocated buffer. This security CVEs for this issue CVE-2016-4563 along with CVE-2016-4562 and CVE-2016-4564 were based on a security...

Debian DLA-520-1 : horizon security update

It was discovered that there was an XSS vulnerability in horizon, a Django module providing web interaction with OpenStack. For Debian 7 'Wheezy', this issue has been fixed in horizon version 2012.1.1-10+deb7u1. We recommend that you upgrade your horizon packages. NOTE: Tenable Network Security h...

SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2016:1563-1)

ntp was updated to version 4.2.8p8 to fix five security issues. These security issues were fixed : - CVE-2016-4953: Bad authentication demobilizes ephemeral associations bsc982065. - CVE-2016-4954: Processing spoofed server packets bsc982066. - CVE-2016-4955: Autokey association reset bsc982067. ...

SUSE SLES11 Security Update : ntp (SUSE-SU-2016:1584-1)

ntp was updated to version 4.2.8p8 to fix five security issues. These security issues were fixed : - CVE-2016-4953: Bad authentication demobilizes ephemeral associations bsc982065. - CVE-2016-4954: Processing spoofed server packets bsc982066. - CVE-2016-4955: Autokey association reset bsc982067. ...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:1596-1)

The SUSE Linux Enterprise 12 GA kernel was updated to fix one security issue. The following security bug was fixed : - CVE-2016-1583: Prevent the usage of mmap when the lower file system does not allow it. This could have lead to local privilege escalation when ecryptfs-utils was installed and...

FreeBSD : botan -- cryptographic vulnerability (f771880c-31cf-11e6-8e82-002590263bf5)

MITRE reports : The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x before 1.11.9 improperly uses a single random base, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a DH group. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Ubuntu 16.04 LTS : Linux kernel (Qualcomm Snapdragon) vulnerability (USN-3008-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3008-1 advisory. Jann Horn discovered that eCryptfs improperly attempted to use the mmap handler of a lower filesystem that did not implement one, causing a recursive page fault t...

Debian DLA-505-1 : libpdfbox-java security update

Apache PDFBox did not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity XXE attacks via a crafted PDF. This may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspectiv...

Debian DLA-506-1 : dhcpcd5 security update

Two vulnerabilities were discovered in dhcpcd5 a DHCP client package. A remote on a local network attacker can possibly execute arbitrary code or cause a denial of service attack by crafted messages. CVE-2014-7912 The getoption function does not validate the relationship between length fields and...

Ubuntu 14.04 LTS / 16.04 LTS : ImageMagick vulnerabilities (USN-2990-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2990-1 advisory. Nikolay Ermishkin and Stewie discovered that ImageMagick incorrectly sanitized untrusted input. A remote attacker could use these issues to...

Ubuntu 14.04 LTS / 16.04 LTS : nginx vulnerability (USN-2991-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2991-1 advisory. It was discovered that nginx incorrectly handled saving client request bodies to temporary files. A remote attacker could possibly use this issue to...

Oracle Linux 7 : squid (ELSA-2016-1139)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1139 advisory. - Related: 1330576 - CVE-2016-4553 squid: Cache poisoning issue in HTTP Request handling - Related: 1334491 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556...

Oracle Linux 6 : squid34 (ELSA-2016-1140)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2016-1140 advisory. - Resolves: 1334499 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556 squid34: various flaws - Resolves: 1334506 - CVE-2016-4553 squid34: squid: Cache...

Oracle Linux 6 : squid (ELSA-2016-1138)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2016-1138 advisory. - Related: 1334489 - CVE-2016-4554 CVE-2016-4556 squid: various flaws - Resolved: 1334489 - CVE-2016-4554 CVE-2016-4556 squid: various flaws - Related:...

Debian DLA-498-1 : ruby-activemodel-3.2 security update

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters. For Debian 7 'Wheezy', these problems...

Oracle Linux 5 : openssl (ELSA-2016-1137)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-1137 advisory. - fix CVE-2014-3570 - Bignum squaring may produce incorrect results - fix CVE-2014-3571 - DTLS segmentation fault in dtls1getrecord - fix CVE-2014-3572 - ECDHE...