SUSE SLED12 Security Update : python-tornado (SUSE-SU-2016:1195-1)

The python-tornado module was updated to version 4.2.1, which brings several fixes, enhancements and new features. The following security issues have been fixed : - A path traversal vulnerability in StaticFileHandler, in which files whose names started with the staticpath directory but were not...

Debian DLA-452-1 : smarty3 security update

Smarty3, a template engine for PHP, allowed remote attackers to bypass the secure mode restrictions and execute arbitrary PHP code as demonstrated by 'literal' in a template. For Debian 7 'Wheezy', these problems have been fixed in version 3.1.10-2+deb7u1. We recommend that you upgrade your smart...

Ubuntu 16.04 LTS : Libtasn1 vulnerability (USN-2957-2)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2957-2 advisory. USN-2957-1 fixed a vulnerability in Libtasn1. This update provides the corresponding update for Ubuntu 16.04 LTS. Tenable has extracted the preceding description...

Fedora 23 : xen-4.5.3-2.fc23 (2016-35d7b09908)

x86 shadow pagetables: address width overflow XSA-173, CVE-2016-3960 Qemu: net: buffer overflow in stellarisenet emulator CVE-2016-4001 Qemu: net: buffer overflow in MIPSnet emulator CVE-2016-4002 qemu: Infinite loop vulnerability in usbehci using siTD process CVE-2016-4037 Note that Tenable...

Ubuntu 16.04 LTS : ubuntu-core-launcher vulnerability (USN-2956-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2956-1 advisory. Zygmunt Krynicki discovered that ubuntu-core-launcher did not properly sanitize its input and contained a logic error when determining the mountpoint of bind moun...

Tenable Nessus 6.0.x < 6.6 Multiple Vulnerabilities

According to its self-reported version, the Tenable Nessus application running on the remote host is 6.x prior to 6.6. It is, therefore, affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input. An authenticated,...

Oracle Linux 5 : nss / and / nspr (ELSA-2016-0684)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0684 advisory. nspr 4.11.0-0.1 - Rebase to NSPR 4.11 - Resolves: Bug 1297943 - Rebase RHEL 5.11.z to NSPR 4.11 in preparation for Firefox 45 nss 3.21.0-6 - Fix...

SUSE SLED12 / SLES12 Security Update : yast2-users (SUSE-SU-2016:1138-1)

yast2-users was updated to fix one security issue. This security issue was fixed : - CVE-2016-1601: Empty passwords fields in /etc/shadow after SLES 12 SP1 autoyast installation bsc974220. This update includes a script that fixes installations that we're affected by this problem. It is run...

Fedora 22 : ansible1.9-1.9.6-1.fc22 (2016-28ff51a3f5)

Update to 1.9.6. Fixes bug 1327744 as well as CVE-2016-3096 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

SUSE SLES11 Security Update : freetype2 (SUSE-SU-2016:1149-1)

This update of the freetype2 library fixes two security issues : - An infinite loop in parseencoding in t1load.c CVE-2014-9745, bsc945849 - Use of uninitialized memory in psparserloadfield, t42parsefontmatrix and t1parsefontmatrix CVE-2014-9747, bsc947966 Note that Tenable Network Security has...

Tenable Log Correlation Engine (LCE) < 4.8.0 Libxml2 DoS

The version of Tenable Log Correlation Engine LCE installed on the remote host is a version prior to 4.8.0. It is, therefore, affected by a denial of service vulnerability in the bundled version of Libxml2 due to an infinite loop condition in the xzdecomp function. An unauthenticated, remote...

Oracle Linux 5 / 7 : java-1.7.0-openjdk (ELSA-2016-0676)

The remote Oracle Linux 5 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0676 advisory. 1:1.7.0.101-2.6.6.1.0.1 - Update DISTRONAME in specfile 1:1.7.0.101-2.6.6.1 - added Patch666 fontpath.patch to fix tck regressions - Resolves:...

Ubuntu 14.04 LTS : MySQL vulnerabilities (USN-2953-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2953-1 advisory. Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to...

Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2016-0675)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0675 advisory. 1:1.7.0.101-2.6.6.1.0.1 - Update DISTRONAME in specfile 1:1.7.0.101-2.6.6.1 - added Patch666 fontpath.patch to fix tck regressions - Resolves:...

Fedora 23 : kernel-4.4.7-300.fc23 (2016-8e858f96b8)

The 4.4.7 update contains a number of important fixes across the kernel tree Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2016-0650)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0650 advisory. 1:1.8.0.91-0.b14 - Add additional fix to Zero patch to properly handle result on 64-bit big-endian - Resolves: rhbz1325422 1:1.8.0.91-0.b14 - Revert...

Solaris 10 (sparc) : 152097-71 (deprecated)

JavaSE 7: update 171 patch equivalent to JDK 7u171, 64bit. Date this patch was last updated by Sun : Jan/16/18 This plugin has been deprecated and either replaced with individual 152097 patch-revision plugins, or deemed non-security related. C Tenable Network Security, Inc. @DEPRECATED@ Disabled ...

Ubuntu 14.04 LTS : OptiPNG vulnerabilities (USN-2951-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2951-1 advisory. Gustavo Grieco discovered that OptiPNG incorrectly handled memory. A remote attacker could use this issue with a specially crafted image file to cause...

SUSE SLED12 / SLES12 Security Update : libgcrypt (SUSE-SU-2016:1089-1)

libgcrypt was updated to fix one security issue. This security issue was fixed : - CVE-2015-7511: Side-channel attack on ECDH with Weierstrass curves bsc965902. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

Gratipay: bring grtp.co up to A grade on SSLLabs

Issues at https://grtp.co/ reference for Weak SSL Ciphers:https://www.owasp.org/index.php/TestingforWeakSSL/TLSCiphers,InsufficientTransportLayerProtectionOTG-CRYPST-001 Weak SSL Ciphers supported at port 443: TLS 1.0: TLSECDHERSAWITH3DESEDECBCSHA ec 256 - C TLSDHERSAWITH3DESEDECBCSHA dh 1024 - D...