EUVD-2019-13457

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2019-3837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was found that the netdma code in tcprecvmsg in the 2.6.32 kernel as shipped in RHEL6 is thread- unsafe. So an unprivileged multi-threaded userspace...

RHEL 6 : xchat (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - xchat: untrusted python modules search path CVE-2009-0315 - xchat/hexchat: does not verify the server...

RHEL 6 : ntp (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - ntp: Using port 123 for modes where a fixed port number is not required facilitates off-path attacks...

RHEL 6 : lua (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - lua: stack overflow in luaresume of ldo.c allows a DoS via a crafted script file CVE-2021-43519 Note that Nessus ha...

RHEL 6 : ocaml (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - ocaml: Integer overflow in byterun/bigarray.c:camlbadeserialize allows remote attackers to cause a denial of servic...

RHEL 6 : oddjob (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - oddjob: race condition in oddjobselinuxmkdir function in mkhomedir.c can lead to symlink attack CVE-2020-10737 Note...

RHEL 6 : ntfs-3g (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - ntfs-3g: heap-based buffer overflow leads to local root privilege escalation CVE-2019-9755 Note that Nessus has not...

RHEL 6 : nautilus (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - nautilus: Insufficient validation of trust of .desktop files with execute permission CVE-2017-14604 - GNO...

RHEL 6 : alpaca (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - ALPACA: Application Layer Protocol Confusion - Analyzing and Mitigating Cracks in TLS Authentication CVE-2021-3618...

RHEL 6 : libnl (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - libnl: Integer overflow in nlmsgreserve CVE-2017-0553 Note that Nessus has not tested for this issue but has instea...

RHEL 6 : apache_tomcat (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - Apache Tomcat: WebSocket DoS with incomplete closing handshake CVE-2024-23672 Note that Nessus has not tested for...

RHEL 6 : coreutils (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - coreutils: Non-privileged session can escape to the parent session in chroot CVE-2016-2781 - In GNU...

RHEL 6 : s_mime (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - S/MIME: CBC gadget attacks allows to exfiltrate plaintext out of encrypted emails CVE-2017-17689 Note that Nessus h...

e2fsprogs security and bug fix update

1.45.6-19 - fix issues with metabg when resizing file system 1849718 1.42.9-18 - fix out-of-bounds write on corrupted fs 1797731 - fix out-of-bounds write on corrupted fs 1768710 - fix e2fsprogs creating corrupted meta image 1711880 - fix typo in ext4 man page 1720130 - provide easy metod for...

e2fsprogs security, bug fix, and enhancement update

1.45.4-3 - Fix clang warning introduced in previous release 1783777 1.45.4-2 - Fix ABI breakage introduced in previous release 1783777 1.45.4-1 - Rebase to the release 1.45.4 1783777 - provide rhel6/7 compatible fstype in mke2fs.conf 1780279 - fix crafted ext4 partition leads to out-of-bounds wri...

firefox security update

68.7.0-2.0.1.el81 - Rebuild to pickup Oracle default bookmarks Orabug: 30069264 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file - Remove upstream references Orabug: 30530527 68.7.0-2 - Update to 68.7.0 build3 68.6.1-1 - Update to 68.6.1 ESR Wed Mar 04 2020 Jan Hora...

CVE-2019-3837

It was found that the netdma code in tcprecvmsg in the RHEL6 kernel is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg for the same network socket in parallel executed on ioatdma-enabled hardware with netdma enabled can leak the memory, crash the host leadin...

CentOS 6 : zsh (RHSA-2020:0892)

The remote CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0892 advisory. - In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so th...

xglance-bin 11.00 - Privilege Escalation

Exploit Title: xglance-bin 11.00 - Privilege Escalation Exploit Author: Robert Jaroszuk and Marco Ortisi RedTimmy Security Date: 2020-02-01 Tested on: RHEL 5.x/6.x/7.x/8.x CVE: CVE-2014-2630 Disclamer: This exploit is for educational purpose only More details on...