Fedora 21 : xen-4.4.3-3.fc21 (2015-15946)

libxl fails to honour readonly flag on disks with qemu-xen XSA-142 possible fix ---- update to xen-4.4.3, including Use after free in QEMU/Xen block unplug protocol XSA-139, CVE-2015-5166, QEMU leak of uninitialized heap memory in rtl8139 device model XSA-140, CVE-2015-5165 Note that Tenable...

Fedora 21 : php-ZendFramework2-2.4.8-1.fc21 (2015-16032)

Zend Framework 2.4.8 Security Update ZF2015-07: The filesystem storage adapter of Zend\Cache was creating directories with a liberal umask that could lead to local arbitrary code execution and/or local privilege escalation. This release contains a patch that ensures the directories are created...

Ubuntu 14.04 LTS : Simple Streams regression (USN-2746-2)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2746-2 advisory. USN-2746-1 fixed a vulnerability in Simple Streams. The update caused a regression preventing MAAS from downloading PXE images. This update fixes the problem. We...

VMware vCenter 6.0 LDAP Certificate Validation MitM Spoofing (VMSA-2015-0006)

The VMware vCenter Server installed on the remote host is version 6.0 prior to 6.0u1. It is, therefore, affected by a man-in-the-middle spoofing vulnerability due to improper validation of X.509 certificates from TLS LDAP servers. A remote, man-in-the-middle attacker can exploit this to intercept...

Fedora 23 : nrpe-2.15-7.fc23 (2015-15398)

Use %configure macro as it deals with config.sub/guess and various flags properly ---- nrpe-2.15-6.el7 - Fix spec file for missing /usr/share/libtool/config/config.guess nrpe-2.15-6.el6 - Fix spec file for missing /usr/share/libtool/config/config.guess nrpe-2.15-6.fc23 - Fix spec file for missing...

Fedora 23 : php-doctrine-doctrine-bundle-1.5.2-1.fc23 (2015-15205)

1.5.2 2015-08-31 Security: Fix Security Misconfiguration Vulnerability, allowing potential local arbitrary code execution CVE-2015-5723 http://www.doctrine-project.org/2015/08/31/securitymisconfi gurationvulnerabilityinvariousdoctrineprojects.html 1.5.1 2015-08-12 Bugfix: Fixed the JS expanding a...

Debian DLA-312-1 : libtorrent-rasterbar security update

The lazybdecode function in BitTorrent DHT bootstrap server bootstrap-dht allows remote attackers to execute arbitrary code via a crafted packet, related to 'improper indexing.' Note while this CVE was reported against BitTorrent DHT Bootstrapt server, the same vulnerable code is available in...

Ubuntu 14.04 LTS : ICU vulnerabilities (USN-2740-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2740-1 advisory. Atte Kettunen discovered that ICU incorrectly handled certain converter names. If an application using ICU processed crafted data, a remote attacker coul...

Fedora 22 : moodle-2.8.7-1.fc22 (2015-14988)

moodle-2.8.7-1.fc22 - Latest upstream release. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Oracle Linux 7 : qemu-kvm (ELSA-2015-1793)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1793 advisory. - kvm-rtl8139-check-IP-Header-Length-field-CVE-2015-5165.patch bz1248764 - kvm-rtl8139-check-IP-Total-Length-field-CVE-2015-5165.patch bz1248764 -...

Fedora 21 : moodle-2.7.9-1.fc21 (2015-14996)

moodle-2.7.9-1.fc21 - 2.7.9. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Fedora 21 : php-doctrine-cache-1.4.2-1.fc21 (2015-15198)

CVE-2015-5723 http://www.doctrine-project.org/2015/08/31/securitymisconfigurat ionvulnerabilityinvariousdoctrineprojects.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean a...

SUSE SLED11 Security Update : openssh (SUSE-SU-2015:1547-2) (Logjam)

openssh was updated to fix several security issues and bugs. These security issues were fixed : - CVE-2015-5352: The x11openhelper function in channels.c in ssh in OpenSSH when ForwardX11Trusted mode is not used, lacked a check of the refusal deadline for X connections, which made it easier for...

SUSE SLED12 / SLES12 Security Update : openssh (SUSE-SU-2015:1544-1) (Logjam)

openssh was updated to fix several security issues. These security issues were fixed : - CVE-2015-5352: The x11openhelper function in channels.c in ssh in OpenSSH when ForwardX11Trusted mode is not used, lacked a check of the refusal deadline for X connections, which made it easier for remote...

SUSE SLED12 / SLES12 Security Update : gnutls (SUSE-SU-2015:1518-1)

gnutls was updated to fix several security vulnerabilities. - fix double free in certificate DN decoding GNUTLS-SA-2015-3bsc941794,CVE-2015-6251 - fix invalid read in octet string in bundled libtasn1 bsc929414,CVE-2015-3622 - fix ServerKeyExchange signature issue GNUTLS-SA-2015-2bsc929690 Note th...

Debian DLA-306-1 : libvdpau security update

Florian Weimer of Red Hat Product Security discovered that libvdpau, the VDPAU wrapper library, did not properly validate environment variables, allowing local attackers to gain additional privileges. For Debian 6 'Squeeze', these problems have been fixed in libvdpau version 0.4.1-2+deb6u1. See D...

Lenovo Mouse Suite < 6.73 Local Privilege Elevation

The version of Lenovo Mouse Suite installed on the remote Windows host is prior to 6.73. It is, therefore, affected by a privilege elevation vulnerability that can allow a local attacker to gain administrative privileges on the system. Note that Nessus has not tested for this issue but has instea...

Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerability (USN-2737-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2737-1 advisory. It was discovered that an integer overflow error existed in the SCSI generic sg driver in the Linux kernel. A local attacker with write permission to a SCSI gener...

SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2015:1504-1)

Mozilla Firefox was updated to 38.2.1 ESR, fixing two severe security bugs. bsc943608 - MFSA 2015-94/CVE-2015-4497 bsc943557: Use-after-free when resizing canvas element during restyling - MFSA 2015-95/CVE-2015-4498 bsc943558: Add-on notification bypass through data URLs Note that Tenable Network...

SUSE SLED12 / SLES12 Security Update : libgcrypt (SUSE-SU-2015:1511-1)

This update fixes the following issues : Security : - Fixed data-dependent timing variations in modular exponentiation related to CVE-2015-0837, Last-Level Cache Side-Channel Attacks are Practical bsc920057 Bugfixes : - don't drop privileges when locking secure memory bsc938343 Note that Tenable...