SUSE SLES12 Security Update : kernel (SUSE-SU-2021:0742-1)

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes. The following security bug was fixed : CVE-2021-3348: Fixed a use-after-free read in nbdqueuerq bsc1181504. The update package also includes non-security fixes. See advisory for details. Note that Tenabl...

SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2021:0713-1)

This update for freeradius-server fixes the following issues : move logrotate options into specific parts for each log as 'global' options will persist past and clobber global options in the main logrotate config bsc1180525 Note that Tenable Network Security has extracted the preceding descriptio...

EulerOS Virtualization 3.0.6.6 : nss (EulerOS-SA-2021-1502)

According to the versions of the nss packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3. This flaw allows a remote attacker to send multipl...

EulerOS Virtualization for ARM 64 3.0.6.0 : openssl (EulerOS-SA-2021-1549)

According to the version of the openssl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known...

EulerOS Virtualization 3.0.6.6 : mesa (EulerOS-SA-2021-1499)

According to the version of the mesa packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker...

SUSE SLES12 Security Update : grub2 (SUSE-SU-2021:0682-1)

This update for grub2 fixes the following issues : grub2 now implements the new 'SBAT' method for SHIM based secure boot revocation. bsc1182057 Following security issues are fixed that can violate secure boot constraints : CVE-2020-25632: Fixed a use-after-free in rmmod command bsc1176711...

Photon OS 3.0: Linux PHSA-2021-3.0-0201

An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0201. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid146997;...

SUSE SLES12 Security Update : ImageMagick (SUSE-SU-2021:0600-1)

This update for ImageMagick fixes the following issues : CVE-2021-20243 bsc1182336: Division by zero in GetResizeFilterWeight in MagickCore/resize.c CVE-2021-20244 bsc1182325: Division by zero in ImplodeImage in MagickCore/visual-effects.c CVE-2021-20246 bsc1182337: Division by zero in...

SUSE SLED15 / SLES15 Security Update : avahi (SUSE-SU-2021:0551-1)

This update for avahi fixes the following issues : CVE-2021-26720: drop privileges when invoking avahi-daemon-check-dns.sh bsc1180827 Update avahi-daemon-check-dns.sh from Debian. Our previous version relied on ifconfig, route, and init.d. Add sudo to requires: used to drop privileges. Note that...

Debian DLA-2570-1 : screen security update

encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service invalid write access and application crash or possibly have unspecified other impact via a crafted UTF-8 character sequence. For Debian 9 stretch, this problem has been fixed in version 4.5.0-6+deb9u1. We...

EulerOS 2.0 SP2 : php-pear (EulerOS-SA-2021-1345)

According to the version of the php-pear package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - ArchiveTar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack such as file:// to...

EulerOS 2.0 SP2 : mesa (EulerOS-SA-2021-1328)

According to the version of the mesa packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An exploitable shared memory permissions vulnerability exists in the functionality of X11 Mesa 3D Graphics Library 19.1.2. An attacker can access the...

EulerOS 2.0 SP2 : python-rtslib (EulerOS-SA-2021-1355)

According to the version of the python-rtslib package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile instead of shutil.copy is...

EulerOS 2.0 SP2 : mysql-connector-java (EulerOS-SA-2021-1331)

According to the version of the mysql-connector-java package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Vulnerability in the MySQL Connectors component of Oracle MySQL subcomponent: Connector/J. Supported versions that are affected are...

EulerOS 2.0 SP2 : openssl110f (EulerOS-SA-2021-1339)

According to the version of the openssl110f packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName...

SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2021:0529-1)

This update for python3 fixes the following issues : CVE-2021-3177: Fixed buffer overflow in PyCArgrepr in ctypes/callproc.c, which may lead to remote code execution bsc1181126. Provide the newest setuptools wheel bsc1176262, CVE-2019-20916 in their correct form bsc1180686. Note that Tenable...

EulerOS 2.0 SP2 : squid (EulerOS-SA-2021-1363)

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack c...

Debian DLA-2560-1 : qemu security update

Several vulnerabilities were discovered in QEMU, a fast processor emulator notably used in KVM and Xen HVM virtualization. An attacker could trigger a denial of service DoS, information leak, and possibly execute arbitrary code with the privileges of the QEMU process on the host. CVE-2020-15469 A...

Foxit PhantomPDF < 4.1.3 PDF Spoofing (macOS)

The version of Foxit PhantomPDF for Mac installed on the remote macOS host is prior to 4.1.3. It is, therefore, affected by a PDF spoofing vulnerability. An Evil Annotation Attack may deliver incorrect validation results when validating certain certified PDF files whose visible content was...

SUSE SLES12 Security Update : python (SUSE-SU-2021:0432-1)

This update for python fixes the following issues : buffer overflow in PyCArgrepr in ctypes/callproc.c, which may lead to remote code execution bsc1181126, CVE-2021-3177. Provide the newest setuptools wheel bsc1176262, CVE-2019-20916 in their correct form bsc1180686. Note that Tenable Network...