Ubuntu 12.04 LTS : linux vulnerabilities (USN-2259-1)

Salva Peiro discovered an information leak in the Linux kernel's media- device driver. A local attacker could exploit this flaw to obtain sensitive information from kernel memory. CVE-2014-1739 A bounds check error was discovered in the socket filter subsystem of the Linux kernel. A local user...

Fedora 20 : python-simplejson-3.5.3-1.fc20 (2014-7715)

Fixes a potential security issue https://github.com/simplejson/simplejson/issues/98 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Ubuntu 14.04 LTS : GnuPG vulnerability (USN-2258-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2258-1 advisory. Jean-Ren Reinhard, Olivier Levillain and Florian Maury discovered that GnuPG incorrectly handled certain OpenPGP messages. If a user or automated system were...

Ubuntu 14.04 LTS : Swift vulnerability (USN-2256-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2256-1 advisory. John Dickinson discovered that Swift did not properly quote the WWW-Authenticate header value. If a user were tricked into navigating to a malicious Swift URL, an...

Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2254-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2254-1 advisory. Christian Hoffmann discovered that the PHP FastCGI Process Manager FPM set incorrect permissions on the UNIX socket. A local attacker could use this issu...

Oracle Linux 5 / 6 : unbreakable enterprise kernel (ELSA-2014-3042)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3042 advisory. - SELinux: Fix kernel BUG on empty security contexts. Stephen Smalley Orabug: 19028380 CVE-2014-1874 - floppy: don't write kernel-only members to...

Oracle Linux 6 : unbreakable enterprise kernel (ELSA-2014-3041)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3041 advisory. - floppy: don't write kernel-only members to FDRAWCMD ioctl output Matthew Daley Orabug: 19028443 CVE-2014-1738 Tenable has extracted the preceding...

Fedora 19 : python-jinja2-2.6-7.fc19 (2014-7399)

Add patch to fix CVE-2014-1402. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-2252-1)

A bounds check error was discovered in the socket filter subsystem of the Linux kernel. A local user could exploit this flaw to cause a denial of service system crash via crafted BPF instructions. CVE-2014-3144 A remainder calculation error was discovered in the socket filter subsystem of the Lin...

Ubuntu 10.04 LTS : linux vulnerabilities (USN-2251-1)

A bounds check error was discovered in the socket filter subsystem of the Linux kernel. A local user could exploit this flaw to cause a denial of service system crash via crafted BPF instructions. CVE-2014-3144 A remainder calculation error was discovered in the socket filter subsystem of the Lin...

Fedora 20 : mod_wsgi-3.5-1.fc20 (2014-6944)

http://modwsgi.readthedocs.org/en/develop/release-notes/version-3.5.ht ml Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Cisco ACE30 and ACE4710 OpenSSL 'ChangeCipherSpec' MiTM Vulnerability

The remote device is running a software version known to be affected by an OpenSSL related vulnerability. The flaw could allow a MiTM attacker to decrypt or forge SSL messages by telling the service to begin encrypted communications before key material has been exchanged, which causes predictable...

openSUSE Security Update : jakarta-commons-fileupload (openSUSE-SU-2013:1571-1)

A remote attacker could supply a serialized instance of the DiskFileItem class, which would be deserialized on a server and write arbitrary content to any location on the server that is permitted by the user running the application server process. bnc846174/CVE-2013-2186 %NASLMINLEVEL 70300 C...

Ubuntu 14.04 LTS : json-c vulnerabilities (USN-2245-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2245-1 advisory. Florian Weimer discovered that json-c incorrectly handled buffer lengths. An attacker could use this issue with a specially-crafted large JSON document t...

Ubuntu 12.04 LTS / 13.10 : libav vulnerability (USN-2244-1)

It was discovered that Libav incorrectly handled certain malformed media files. If a user were tricked into opening a crafted media file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Not...

Oracle Linux 5 / 6 / 7 : firefox (ELSA-2014-0741)

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0741 advisory. 24.6.0-1.0.1.el65 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one 24.6.0-1 - Update to 24.6.0 ESR 24.5.0-2 -...

Ubuntu 14.04 LTS : libxml2 regression (USN-2214-2)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2214-2 advisory. USN-2214-1 fixed vulnerabilities in libxml2. The upstream fix introduced a regression when using xmllint with the --postvalid option. This update fixes the proble...

Fedora 19 : mingw-curl-7.37.0-1.fc19 (2014-6921)

Update to 7.37.0 - Fixes CVE-2014-0138 and CVE-2014-0139 RHBZ 1080880 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 20 : check-mk-1.2.4p2-2.fc20 (2014-6810)

Install the mk-job binary on /usr/bin. - Make sure the proper permissions are given to /var/lib/checkmkagent/job to prevent any hard or symlink to be created by a normal user and pointing to any file on the filesystem exposing it on the check-mk-agent output being run as root. Note that Tenable...

Fedora 19 : mingw-gnutls-3.1.25-1.fc19 (2014-6963)

Version 3.1.25 released 2014-05-30 - libgnutls: Eliminated memory corruption issue in Server Hello parsing. Issue reported by Joonas Kuorilehto of Codenomicon. - libgnutls: Increased the maximum certificate size buffer in the PKCS 11 subsystem. - libgnutls: Check the return code of getpwuidr...