OracleVM 3.3 / 3.4 : foomatic (OVMSA-2016-0040)

The remote OracleVM system is missing necessary patches to address critical security updates : - Also consider back tick and semicolon as illegal shell escape characters. - CVE-2015-8327, CVE-2015-8560 - Prevent foomatic-rip overrun bug 1214534. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

OracleVM 3.3 / 3.4 : krb5 (OVMSA-2016-0039)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2015-8629, CVE-2015-8631 - Also fix a spec trigger issue that prevents building - Resolves: 1306973 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were...

OracleVM 3.3 / 3.4 : openssh (OVMSA-2016-0038)

The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2015-5600: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices 1245969 - CVE-2016-3115: missing sanitisation of input for X11 forwarding 1317816 - SSH2MSGDISCONNECT for user initiate...

OracleVM 3.2 : kernel-uek (OVMSA-2016-0037)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2016-0037 for details. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory...

OracleVM 3.3 / 3.4 : bind (OVMSA-2016-0036)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2016-1285, CVE-2016-1286 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory OVMSA-2016-0036...

OracleVM 3.3 / 3.4 : libssh2 (OVMSA-2016-0035)

The remote OracleVM system is missing necessary patches to address critical security updates : - use secrects of the appropriate length in Diffie-Hellman CVE-2016-0787 - fix basic functionality of libssh2 in FIPS mode 968575 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks ...

OracleVM 2.2 : openssh (OVMSA-2016-0033)

The remote OracleVM system is missing necessary patches to address critical security updates : - change default value of MaxStartups - CVE-2010-5107 John Haxby %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory...

OracleVM 3.3 / 3.4 : nss-util (OVMSA-2016-0034)

The remote OracleVM system is missing necessary patches to address critical security updates : - Actually apply the fix for CVE-2016-1950 from NSS 3.19.2.3 ... - Rebuild to ensure use of correct NSPR. - Include the fix for CVE-2016-1950 from NSS 3.19.2.3 %NASLMINLEVEL 70300 C Tenable Network...

OracleVM 3.3 : openssl (OVMSA-2016-0031)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2016-0702 - side channel attack on modular exponentiation - fix CVE-2016-0705 - double-free in DSA private key parsing - fix CVE-2016-0797 - heap corruption in BNhex2bn and BNdec2bn - fix...

OracleVM 3.2 : openssh (OVMSA-2016-0030)

The remote OracleVM system is missing necessary patches to address critical security updates : - change default value of MaxStartups - CVE-2010-5107 John Haxby - improve RNG seeding from /dev/random 681291,708056 - make ssh1's ConnectTimeout option apply to both the TCP connection and SSH banner...

OracleVM 3.3 : Unbreakable / etc (OVMSA-2016-0014)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection Andy Lutomirski Orabug: 22742507 CVE-2015-5157 - x86/nmi/64: Reorder nested NMI checks Andy Lutomirski Orabug: 22742507...

OracleVM 3.3 : glibc (OVMSA-2016-0013) (GHOST)

The remote OracleVM system is missing necessary patches to address critical security updates : - Update fix for CVE-2015-7547 1296028. - Create helper threads with enough stack for POSIX AIO and timers 1301625. - Fix CVE-2015-7547: getaddrinfo stack-based buffer overflow 1296028. - Support loadin...

OracleVM 2.2 : xen (OVMSA-2016-0012)

The remote OracleVM system is missing necessary patches to address critical security updates : - XSA-125: Limit XENDOMCTLmemorymapping hypercall to only process up to 64 GFNs or less Jan Beulich 20732412 CVE-2015-2752 - XSA-126: xen: limit guest control of PCI command register Jan Beulich 2073939...

OracleVM 3.3 : sos (OVMSA-2016-0011)

The remote OracleVM system is missing necessary patches to address critical security updates : - Add vendor, vendor URL info for Oracle Linux orabug 17656507 - Direct traceroute to linux.oracle.com John Haxby orabug 11713272 - Check oraclelinux-release instead of redhat-release to get OS version...

OracleVM 3.3 : bind (OVMSA-2016-0009)

The remote OracleVM system is missing necessary patches to address critical security updates : - Fix CVE-2015-8704 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory OVMSA-2016-0009. include'deprecatednasllevel.inc...

OracleVM 3.3 : ntp (OVMSA-2016-0006)

The remote OracleVM system is missing necessary patches to address critical security updates : - don't accept server/peer packets with zero origin timestamp CVE-2015-8138 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security...

OracleVM 3.3 : xen (OVMSA-2016-0007)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/VMX: prevent INVVPID failure due to non-canonical guest address While INVLPG and on SVM INVLPGA don't fault on non-canonical addresses, INVVPID fails in the 'individual address' case when passed...

OracleVM 3.2 : xen (OVMSA-2016-0008)

The remote OracleVM system is missing necessary patches to address critical security updates : - VT-d: fix TLB flushing in dmapteclearone From: Jan Beulich The TLB flush code was wrong since xen-4.1.3-25.el5.127.20 commit: vtd-Refactor-iotlb-flush-code.patch, both ovm-3.2.9 and ovm-3.2.10 were...

OracleVM 3.3 : kernel-uek (OVMSA-2016-0005)

The remote OracleVM system is missing necessary patches to address critical security updates : - KEYS: Fix keyring ref leak in joinsessionkeyring Yevgeny Pats Orabug: 22563965 CVE-2016-0728 - KEYS: Don't permit requestkey to construct a new keyring David Howells Orabug: 22373442 CVE-2015-7872 -...

OracleVM 3.3 : gnutls (OVMSA-2016-0004)

The remote OracleVM system is missing necessary patches to address critical security updates : - Prevent downgrade attack to RSA-MD5 in TLS 1.2 server key exchange 1289885 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security...