Citrix Endpoint Management (aka XenMobile Server) 10.14.0 Rolling Patch 3

Package name: xms10.14.0.10303.bin For: XenMobile Server 10.14.0 Deployment type: On-premises only Replaces: xms10.14.0.10206.bin and xms10.14.0.10118.bin Date: December 2021 Languages supported: English US Important notes about this update As a best practice, Citrix recommends that you install...

CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2021:5238)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:5238 advisory. - QEMU: net: e1000: infinite loop while processing transmit descriptors CVE-2021-20257 - QEMU: off-by-one error in modesensepage in hw/scsi/scsi-disk.c...

CentOS 8 : postgresql:13 (CESA-2021:5236)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:5236 advisory. - postgresql: server processes unencrypted bytes from man-in-the-middle CVE-2021-23214 - postgresql: memory disclosure in certain queries CVE-2021-3677...

CentOS 7 : samba (RHSA-2021:5192)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:5192 advisory. - A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the...

Citrix Endpoint Management (aka XenMobile Server) 10.12.0 Rolling Patch 11

Package name: xms10.12.0.11103.bin For: XenMobile Server 10.12.0 Deployment type: On-premises only Replaces: xms10.12.0.11004.bin, xms10.12.0.10917.bin, xms10.12.0.10818.bin, xms10.12.0.10714.bin, xms10.12.0.10613.bin, xms10.12.0.10539.bin, xms10.12.0.10417.bin, xms10.12.0.10324.bin,...

CentOS 8 : postgresql:12 (CESA-2021:5235)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:5235 advisory. - postgresql: server processes unencrypted bytes from man-in-the-middle CVE-2021-23214 - postgresql: memory disclosure in certain queries CVE-2021-3677...

Updated privoxy packages fix security vulnerabilities

Updated privoxy packages fix security vulnerabilities: A security issue has been found in Privoxy before version 3.0.33. geturlspecparam did not free memory of compiled pattern spec before bailing CVE-2021-44540. A security issue has been found in Privoxy before version 3.0.33...

Apache Log4j End of Life (EOL) Detection - Windows

The Apache Log4j version on the remote host has reached the End of Life EOL and should not be used anymore. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Oracle Linux 7 : samba (ELSA-2021-5192)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-5192 advisory. - resolves: 2019661 - Fix CVE-2016-2124 - resolves: 2019673 - Fix CVE-2020-25717 Tenable has extracted the preceding description block directly from th...

RHEL 7 : samba (RHSA-2021:5192)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:5192 advisory. Samba is an open-source implementation of the Server Message Block SMB protocol and the related Common Internet File System CIFS protocol,...

CLSA-2021-1639681846 Fix CVE(s): CVE-2020-7071, CVE-2020-7068, CVE-2021-21705, CVE-2021-21704, CVE-2021-21703, CVE-2021-21702

SECURITY UPDATE: Process crash and information disclosure - debian/patches/CVE-2020-7068.patch: fix access-after-free for actualalias pointer - CVE-2020-7068 SECURITY UPDATE: logic error due to invalid input validation - debian/patches/CVE-2020-7071.patch: add validation fo url-user field -...

After Log4j, December’s Patch Tuesday has snuck up on us

For anyone about to sit back after checking their environment for the Log4j vulnerabilities and applying patches where needed, here are some more things that need patching. Microsoft In 2021’s final Patch Tuesday, Microsoft included a total of 67 fixes for security vulnerabilities. The total set ...

Apache Log4j Remote Code Execution Vulnerability

Certain versions of Apache Log4j2 are vulnerable to a remote code execution vulnerability. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. Microsoft is not aware of any impact to th...

Microsoft Security Update Validation Report December 2021

Microsoft’s December 2021 security updates have passed Citrix testing the updates are listed below. The testing is not all-inclusive; all tests are executed against English only environments and issues may still be found upon implementation. Follow best practices for testing and installing softwa...

Oracle Linux 8 : go-toolset:ol8 (ELSA-2021-5160)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-5160 advisory. golang 1.16.12-1 - Rebase to Go 1.16.12 - Resolves: rhbz2031125 go-toolset 1.16.12-1 - Rebase to Go 1.16.12 - Resolves: rhbz2031125 Tenable has extract...

CVE-2021-43890

We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker...

CVE-2021-43890

We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker...

Spoofing

We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker...

Citrix Endpoint Management (aka XenMobile Server) 10.14.0 Rolling Patch 2

Package name: xms10.14.0.10206.bin For: XenMobile Server 10.14.0 Deployment type: On-premises only Replaces: xms10.14.0.10118.bin Date: December 2021 Languages supported: English US Important notes about this update As a best practice, Citrix recommends that you install this and other updates to...

Apache Log4j End of Life (EOL) Detection - Linux

The Apache Log4j version on the remote host has reached the End of Life EOL and should not be used anymore. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...