Apache Log4j < 2.15.0 Remote Code Execution (Windows)

The version of Apache Log4j on the remote host is 2.x 2.15.0. It is, therefore, affected by a remote code execution vulnerability in the JNDI parser due to improper log validation. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. Log4j...

Oracle Linux 8 : container-tools:ol8 (ELSA-2021-4154)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4154 advisory. - An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds e.g...

Amazon Linux 2 : cyrus-imapd (ALAS-2021-1725)

The version of cyrus-imapd installed on the remote host is prior to 2.4.22-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1725 advisory. A flaw was found in cyrus-imapd. A bad string hashing algorithm used in internal hash tables allows user inputs to be stored i...

SonicWall Secure Mobile Access Multiple Vulnerabilities (SNWLID-2021-0026)

According to its self-reported version, the remote SonicWall Secure Mobile Access is affected by multiple vulnerabilities, including: - An unauthenticated stack-based buffer overflow due to the SonicWall SMA SSLVPN Apache httpd server GET method of modcgi module environment variables use a single...

Debian DLA-2839-1 : gerbv - LTS security update

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2839 advisory. - An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev commit b5f1eacd, and the forked version of Gerbv comm...

Ubuntu 18.04 LTS : Long Range ZIP vulnerabilities (USN-5171-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5171-1 advisory. It was discovered that Long Range ZIP incorrectly handled certain specially crafted lrz files. A remote attacker could possibly use this issue to cause a...

Ubuntu 18.04 LTS / 20.04 LTS : BusyBox vulnerabilities (USN-5179-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5179-1 advisory. It was discovered that BusyBox incorrectly handled certain malformed gzip archives. If a user or automated system were tricked into processin...

Mozilla Firefox ESR < 91.4.0

The version of Firefox ESR installed on the remote Windows host is prior to 91.4.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-53 advisory. - Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian...

openSUSE 15 : Recommended update for php7 (openSUSE-SU-2021:3943-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3943-1 advisory. - In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daem...

SUSE SLED12: apache2-mod_php74 / php74 / php74-bcmath / php74-bz2 / etc (SUSE-SU-2021:3927-1)

The remote SUSE Linux SLED12 / SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3927-1 advisory. - CVE-2021-21707: Fixed special character breaks path in xml parsing bsc1193041. Tenable has extracted the preceding description block directly...

SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2021:3943-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3943-1 advisory. - CVE-2021-21703: Fixed local privilege escalation via PHP-FPM bsc1192050. - CVE-2021-21707: Fixed special character breaks path in xml parsing...

openSUSE 15 Security Update : wireshark (openSUSE-SU-2021:3938-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3938-1 advisory. - NULL pointer exception in the IPPUSB dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service via packet injection or crafted captu...

Ubuntu 20.04 LTS : MariaDB vulnerability (USN-5170-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5170-1 advisory. A security issue was discovered in MariaDB and this update includes new upstream MariaDB versions to fix the issue. MariaDB has been updated to 10.3.32 in Ubuntu...

SUSE SLES15 Security Update : openssh (SUSE-SU-2021:3947-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3947-1 advisory. - CVE-2021-41617: Fixed privilege escalation when AuthorizedKeysCommand/AuthorizedPrincipalsCommand are configured bsc1190975. Tenable has...

SUSE SLED15 / SLES15 Security Update : glib-networking (SUSE-SU-2021:3944-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:3944-1 advisory. Update to version 2.62.4: - CVE-2020-13645: Fixed a connection failure when the server identity is unset bsc1172460. Tenable has extracted the...

openSUSE 15 Security Update : singularity (openSUSE-SU-2021:1525-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:1525-1 advisory. - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution...

RHEL 7 : mailman (RHSA-2021:4913)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4913 advisory. Mailman is a program used to help manage e-mail discussion lists. Security Fixes: mailman: CSRF token bypass allows to perform CSRF attacks...

SUSE SLED15: libjavascriptcoregtk-4_0-18 / libwebkit2gtk-4_0-37 / etc (SUSE-SU-2021:3874-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3874-1 advisory. - CVE-2021-30846: Fixed memory corruption issue that could lead to arbitrary code execution when processing maliciously crafted web...

NVIDIA Windows GPU Display Driver (October 2021)

A display driver installed on the remote Windows host is affected by multiple vulnerabilities: - NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for private IOCTLs, where an attacker with local unprivileged system access may cause a NUL...

openSUSE 15 Security Update : webkit2gtk3 (openSUSE-SU-2021:3874-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3874-1 advisory. - A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, Safari 15, tvOS 1...