Fedora 18 : glibc-2.16-34.fc18 (2013-15072)

glibc security update : CVE-2013-2207 glibc ptchown: Improper pseudotty ownership and permissions changes when granting access to the slave pseudoterminal The fix may break chroots if their devpts was not mounted correctly. Fix is to mount the devpts correctly with gid=5. Note that Tenable Networ...

Amazon Linux AMI : kernel (ALAS-2012-83)

It was found that the datalen parameter of the sockallocsendpskb function in the Linux kernel's networking implementation was not validated before use. A local user with access to a TUN/TAP virtual interface could use this flaw to crash the system or, potentially, escalate their privileges. Note...

Fedora 18 : php-pear-Auth-OpenID-2.2.2-7.fc18 (2013-15253)

Fix for CVE-2013-4701 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Debian DSA-2747-1 : cacti - several vulnerabilities

Two vulnerabilities were discovered in Cacti, a web interface for graphing of monitoring systems : - CVE-2013-5588 install/index.php and cacti/host.php suffered from Cross-Site Scripting vulnerabilities. - CVE-2013-5589 cacti/host.php contained a SQL injection vulnerability, allowing an attacker ...

Fedora 19 : ssmtp-2.64-9.fc19 (2013-15049)

Use a corrected patch to validate server certificates Removes world read access from the configuration file thus prohibiting reading of password stored inside it. Removes world read access from the configuration file thus prohibiting reading of password stored inside it. Note that Tenable Network...

Fedora 18 : ansible-1.2.3-2.fc18 (2013-15181)

Fixes CVE-2013-4260 and CVE-2013-4259 See https://groups.google.com/forum/!topic/ansible-project/UVDYW0HGcNg for more information. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically...

Websense Email Security Installed

Websense Email Security, an email security application, is installed on the remote Windows host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid69516; scriptversion"1.7"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/02/06";...

Fedora 19 : roundcubemail-0.9.3-2.fc19 (2013-15221)

Two XSS flaws were fixed in roundcube 0.9.3 1 : - Fix XSS vulnerability when saving HTML signatures 2,3 - Fix XSS vulnerability when editing a message 'as new' or draft 2,4 1 http://trac.roundcube.net/wiki/ChangelogRELEASE0.9.3 2 http://trac.roundcube.net/ticket/1489251 3...

Oracle Linux 6 : kernel (ELSA-2013-1173)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1173 advisory. - x86 perf/x86: Fix offcorersp valid mask for SNB/IVB Nikola Pajkovsky 971314 971315 CVE-2013-2146 - bluetooth L2CAP - Fix info leak via getsockname...

Fedora 19 : python3-3.3.2-6.fc19 (2013-15254)

Fix for CVE-2013-4238 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Oracle Linux 5 : kernel (ELSA-2013-1166)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1166 advisory. - net afkey: fix info leaks in notify messages Jiri Benc 980999 981000 CVE-2013-2234 - net afkey: initialize satype in keynotifypolicyflush Jiri Benc...

Fedora 19 : php-symfony2-HttpFoundation-2.2.5-1.fc19 (2013-14608)

Updated to 2.2.5 CVE-2013-4752 Request::getHost poisioning Release blog posts : - http://symfony.com/blog/symfony-2-2-4-released - http://symfony.com/blog/security-releases-symfony-2-0- 24-2-1-12-2-2-5-and-2-3-3-released Full change log:...

CiscoWorks Common Services Installed

CiscoWorks Common Services, the foundation of application infrastructure for CiscoWorks network management solutions, is installed on the remote Windows host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid69468; scriptversion"1.9";...

Ubuntu 12.04 LTS / 12.10 / 13.04 : puppet vulnerabilities (USN-1928-1)

It was discovered that Puppet incorrectly handled the resourcetype service. A local attacker on the master could use this issue to execute arbitrary Ruby files. CVE-2013-4761 It was discovered that Puppet incorrectly handled permissions on the modules it installed. Modules could be installed with...

Fedora 19 : python-keystoneclient-0.2.3-7.fc19 (2013-14302)

Selective backports from stable/grizzly : - Ec2Signer: Initial support for v4 signature verification. - Allow signature verification for older boto versions. - Default signingdir to secure temp dir. - Fix memcache encryption middleware. CVE-2013-2166, CVE-2013-2167 - Check token expiry...

RSA Authentication Agent Installed

RSA Authentication Agent, an authentication application, is installed on the remote Windows host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid69427; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/10/10"; scriptnameenglish:"RS...

Ubuntu 12.10 / 13.04 : libimobiledevice vulnerability (USN-1927-1)

Paul Collins discovered that libimobiledevice incorrectly handled temporary files. A local attacker could possibly use this issue to overwrite arbitrary files and access device keys. In the default Ubuntu installation, this issue should be mitigated by the Yama link restrictions. Note that Tenabl...

Fedora 19 : v8-3.14.5.10-2.fc19 (2013-14176)

This update fixes an issue with Google V8, as used in Google Chrome before 28.0.1500.95, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage 'type confusion.' Please note that this issue's impact on Node.js is somewhat...

Fedora 18 : v8-3.14.5.10-2.fc18 (2013-14205)

This update fixes an issue with Google V8, as used in Google Chrome before 28.0.1500.95, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage 'type confusion.' Please note that this issue's impact on Node.js is somewhat...

Oracle Linux 5 / 6 : httpd (ELSA-2013-1156)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1156 advisory. 2.2.15-29.0.1.el64 - replace index.html with Oracle's index page oracleindex.html update vstring in specfile 2.2.15-29 - moddav: add security fix for...