Slackware 14.2 / current : ghostscript (SSA:2018-256-01)

New ghostscript packages are available for Slackware 14.2 and -current to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2018-256-01. The text itself is copyright C Slackware Linux, Inc...

Amazon Linux 2 : ncurses (ALAS-2018-1053)

A NULL pointer dereference was found in the way the ncparseentry function parses terminfo data for compilation. An attacker able to provide specially crafted terminfo data could use this flaw to crash the application parsing it.CVE-2018-10754 C Tenable Network Security, Inc. The descriptive text...

RHEL 7 : libvirt (RHSA-2018:1997)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1997 advisory. The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In...

Amazon Linux 2 : xdg-user-dirs (ALAS-2018-1030)

It was found that the system umask policy is not being honored when creating XDG user directories /Desktop etc on first login. This could lead to user's files being inadvertently exposed to other local users.CVE-2017-15131 C Tenable Network Security, Inc. The descriptive text and package checks i...

MacOS 10.13 root Authentication Bypass (Security Update 2017-001)

The remote host is running a version of MacOS 10.13 or 10.13.1 that is missing a security update. It is, therefore, affected by a root authentication bypass vulnerability. A local attacker or a remote attacker with credentials for a standard user account has the ability to blank out the root...

Oracle Linux 6 : openssh (ELSA-2017-2563)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-2563 advisory. 5.3p1-123 - Fix for CVE-2016-6210: User enumeration via covert timing channel 1357442 Tenable has extracted the preceding description block directly from the...

Microsoft Office 2010 Service Pack 2 Remote Code Execution Vulnerability (KB3203468)

This host is missing an important security update according to Microsoft KB3203468 SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Fedora 23 : kernel-4.4.7-300.fc23 (2016-8e858f96b8)

The 4.4.7 update contains a number of important fixes across the kernel tree Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Apple iOS < 8.3 Multiple Vulnerabilities

Binary data 8803.prm...

SuSE 11.3 Security Update : KVM (SAT Patch Number 10672)

KVM was updated to fix a buffer overflow in the floppy drive emulation, which could be used to carry out denial of service attacks or potential code execution against the host. This vulnerability is also known as VENOM. CVE-2015-3456 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Apple iOS < 8.1.4 Multiple Vulnerabilities

Binary data 8673.prm...

Fedora 22 : compat-libuv010-0.10.34-1.fc22 (2015-2563)

It was found that libuv does not call setgoups before calling setuid/setgid. This may potentially allow an attacker to gain elevated privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Oracle OpenSSO SAML Multiple Vulnerabilities (January 2015 CPU)

The remote Oracle OpenSSO component in the Oracle Fusion Middleware install is missing a vendor-supplied security update. It is, therefore, affected by multiple unspecified vulnerabilities in the SAML subcomponent. Note that these vulnerabilities are unspecified by Oracle but appear to be...

Amazon Linux AMI : php-ZendFramework (ALAS-2014-460)

The 1 ZendLdap class in Zend before 1.12.9 and 2 Zend\Ldap component in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to bypass authentication via a password starting with a null byte, which triggers an unauthenticated bind. CVE-2014-8088 The 1.12.9, 2.2.8, and 2.3.3 releas...

Fedora 21 : xorg-x11-server-1.16.2.901-1.fc21 (2014-16623)

upstream security release. 1.16.2.901 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Fedora 21 : java-1.8.0-openjdk-1.8.0.25-0.b18.fc21 (2014-12935)

Updated to security u25. Security bugs are same as for http://blog.fuseyism.com/index.php/2014/10/15/security-icedtea-2-5-3-f or-openjdk-7-released/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted t...

Microsoft Office Word Remote Code Execution Vulnerability (3000434) - Mac OS X

This host is missing an important security update according to Microsoft Bulletin MS14-061. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Amazon Linux AMI : nss-softokn (ALAS-2014-423)

A flaw was found in the way NSS parsed ASN.1 Abstract Syntax Notation One input from certain RSA signatures. A remote attacker could use this flaw to forge RSA certificates by providing a specially crafted signature to an application using NSS. C Tenable Network Security, Inc. The descriptive tex...

Fedora 19 : wordpress-3.9.2-3.fc19 (2014-9270)

Upstream announcement: http://wordpress.org/news/2014/08/wordpress-3-9-2/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 20 : bugzilla-4.2.10-1.fc20 (2014-8920)

This version of bugzilla includes a security fix for CVE-2014-1546. With previous versions, an attacker can get access to some bug information using the victim's credentials using a specially crafted HTML page. Note that Tenable Network Security has extracted the preceding description block...