OracleVM 3.3 : ntp (OVMSA-2016-0006)

The remote OracleVM system is missing necessary patches to address critical security updates : - don't accept server/peer packets with zero origin timestamp CVE-2015-8138 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security...

OracleVM 3.3 : libpng (OVMSA-2015-0153)

The remote OracleVM system is missing necessary patches to address critical security updates : - Security fix for CVE-2015-7981, CVE-2015-8126 - Resolves: 1283572 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory...

Oracle WebCenter Sites Multiple Vulnerabilities (October 2015 CPU)

The version Oracle WebCenter Sites installed on the remote host is missing security patches from the October 2015 Critical Patch Update CPU. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the bundled SpringSource Spring Framework that allows a remote attacker to execu...

OracleVM 3.3 : kernel-uek (OVMSA-2015-0113)

The remote OracleVM system is missing necessary patches to address critical security updates : - md: use kzalloc when bitmap is disabled Benjamin Randazzo Orabug: 21563041 CVE-2015-5697 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from...

OracleVM 3.3 : kernel-uek (OVMSA-2015-0109)

The remote OracleVM system is missing necessary patches to address critical security updates in kernel-uek. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory OVMSA-2015-0109. include'deprecatednasllevel.inc';...

OracleVM 3.3 : curl (OVMSA-2015-0107)

The remote OracleVM system is missing necessary patches to address critical security updates : - require credentials to match for NTLM re-use CVE-2015-3143 - close Negotiate connections when done CVE-2015-3148 - reject CRLFs in URLs passed to proxy CVE-2014-8150 - use only full matches for hosts...

OracleVM 3.3 : xen (OVMSA-2015-0095)

The remote OracleVM system is missing necessary patches to address critical security updates : - ide: Clear DRQ after handling all expected accesses This is additional hardening against an endtransferfunc that fails to clear the DRQ status bit. The bit must be unset as soon as the PIO transfer ha...

OracleVM 3.3 : xen (OVMSA-2015-0067)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/traps: loop in the correct direction in compatiret This is XSA-136. CVE-2015-4164 - pcnet: force the buffer access to be in bounds during tx 4096 is the maximum length per TMD and it is also...

OracleVM 3.2 : xen (OVMSA-2015-0063)

The remote OracleVM system is missing necessary patches to address critical security updates : - xen/pt: unknown PCI config space fields should be read-only ... by default. Add a per-device 'permissive' mode similar to pciback's to allow restoring previous behavior and hence break security again,...

OracleVM 3.2 : xen (OVMSA-2015-0058) (Venom)

The remote OracleVM system is missing necessary patches to address critical security updates : - force the fifo access to be in bounds of the allocated buffer This is CVE-2015-3456. bug 21078935 CVE-2015-3456 - xen: limit guest control of PCI command register Otherwise the guest can abuse that...

Oracle WebCenter Sites Multiple Vulnerabilities (April 2015 CPU)

The Oracle WebCenter Sites installed on the remote host is missing patches from the April 2015 CPU. It is, therefore, affected by multiple vulnerabilities : - A flaw exists within 'MultipartStream.java' in Apache Commons FileUpload when parsing malformed Content-Type headers. A remote attacker,...

Mac OS X Multiple Vulnerabilities (Security Update 2015-004) (FREAK)

The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-004. It is, therefore, affected multiple vulnerabilities in the following components : - Apache - ATS - Certificate Trust Policy - CoreAnimation - FontParser - Graphics Driver - ImageIO -...

OracleVM 3.3 : xen (OVMSA-2015-0031)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86emul: fully ignore segment override for register-only operations For ModRM encoded instructions with register operands we must not overwrite ea.mem.seg if a - bogus in that case - segment override...

OracleVM 2.2 : xen (OVMSA-2015-0027)

The remote OracleVM system is missing necessary patches to address critical security updates : - XSA-122: pre-fill structures for certain HYPERVISORxenversion sub-ops Jan Beulich 20588670 CVE-2015-2045 - XSA-121: return all ones on wrong-sized reads of system device I/O ports Jan Beulich 20588358...

OracleVM 3.3 : jasper (OVMSA-2015-0006)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2014-8157 - dec-numtiles off-by-one check in jpcdecprocesssot 1183671 - CVE-2014-8158 - unrestricted stack memory use in jpcqmfb.c 1183679 - CVE-2014-8137 - double-free in in jasiccattrvaldestroy...

Oracle Solaris Third-Party Patch Update : samba (cve_2013_4475_access_control)

The remote Solaris system is missing necessary patches to address security updates : - Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfsstreamsdepot or vfsstreamsxattr is enabled, allows remote attackers to bypass intended file restrictions by leveragi...

OracleVM 3.2 : ntp (OVMSA-2015-0001)

The remote OracleVM system is missing necessary patches to address critical security updates : - Remove default ntp servers in ntp.conf bug 14342986 - don't generate weak control key for resolver CVE-2014-9293 - don't generate weak MD5 keys in ntp-keygen CVE-2014-9294 - fix buffer overflows via...

OracleVM 3.3 : jasper (OVMSA-2014-0087)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2014-8137 - double-free in in jasiccattrvaldestroy 1173566 - CVE-2014-8138 - heap overflow in jp2decode 1173566 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plug...

OracleVM 3.0 : xen (OVMSA-2012-0035)

The remote OracleVM system is missing necessary patches to address critical security updates : - Xen Security Advisory CVE-2012-3433 / XSA-11 HVM guest destroy p2m teardown host DoS vulnerability An HVM guest is able to manipulate its physical address space such that tearing down the guest takes ...

OracleVM 3.2 : xen (OVMSA-2013-0036)

The remote OracleVM system is missing necessary patches to address critical security updates : - VT-d: don't permit SVTNOVERIFY entries for known device types Only in cases where we don't know what to do we should leave the IRTE blank suppressing all validation, but we should always log a warning...