Debian DLA-2014-1 : vino security update

Several vulnerabilities have been identified in the VNC code of vino, a desktop sharing utility for the GNOME desktop environment. The vulnerabilities referenced below are issues that have originally been reported against Debian source package libvncserver. The vino source package in Debian ships...

Fedora 30 : kernel (2019-8846a1a5a2)

The 5.3.13 update contains a number of important fixes across the tree Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducin...

EulerOS Virtualization for ARM 64 3.0.3.0 : ghostscript (EulerOS-SA-2019-2338)

According to the versions of the ghostscript packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - In Artifex Ghostscript before 9.26, a carefully crafted PDF file can trigger an extremely long running computatio...

SUSE SLED15 / SLES15 Security Update : libidn2 (SUSE-SU-2019:3086-1)

This update for libidn2 to version 2.2.0 fixes the following issues : CVE-2019-12290: Fixed an improper round-trip check when converting A-labels to U-labels bsc1154884. CVE-2019-18224: Fixed a heap-based buffer overflow that was caused by long domain strings bsc1154887. Note that Tenable Network...

EulerOS 2.0 SP8 : libmspack (EulerOS-SA-2019-2285)

According to the version of the libmspack package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - chmdreadheaders in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character such as the '/\0'...

SUSE SLED15 / SLES15 Security Update : freerdp (SUSE-SU-2019:3079-1)

This update for freerdp fixes the following issues : CVE-2019-17177: Fixed multiple memory leaks in libfreerdp/codec/region.c bsc1153163. CVE-2019-17178: Fixed a memory leak in HuffmanTreemakeFromFrequencies bsc1153164. Note that Tenable Network Security has extracted the preceding description...

SUSE SLED15 / SLES15 Security Update : clamav (SUSE-SU-2019:3053-1)

This update for clamav fixes the following issues : Security issue fixed : CVE-2019-12625: Fixed a ZIP bomb issue by adding detection and heuristics for zips with overlapping files bsc1144504. CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors bsc1149458. Non-securit...

Debian DLA-2008-1 : nss security update

A vulnerability has been discovered in nss, the Mozilla Network Security Service library. An out-of-bounds write can occur when passing an output buffer smaller than the block size to NSCEncryptUpdate. For Debian 8 'Jessie', this problem has been fixed in version 2:3.26-1+debu8u7. We recommend th...

SSL/TLS Deprecated Ciphers (deprecated)

The remote host has open SSL/TLS ports which advertise deprecated cipher suites. The ciphers contained in these suites are no longer supported by most major ssl libraries such as OpenSSL, NSS, Mbed TLS, and wolfSSL and, as such, should not be used for secure communication. Nessus 8.9 and later no...

SUSE SLED12 / SLES12 Security Update : libpng16 (SUSE-SU-2019:3060-1)

This update for libpng16 fixes the following issues : Security issues fixed : CVE-2019-7317: Fixed a use-after-free vulnerability, triggered when pngimagefree was called under pngsafeexecute bsc1124211. CVE-2017-12652: Fixed an Input Validation Error related to the length of chunks bsc1141493. No...

SUSE SLED12 / SLES12 Security Update : cpio (SUSE-SU-2019:3064-1)

This update for cpio fixes the following issues : CVE-2019-14866: Fixed an improper validation of the values written in the header of a TAR file through the tooct function which could have led to unexpected TAR generation bsc1155199. Note that Tenable Network Security has extracted the preceding...

Fedora 30 : mingw-libidn2 (2019-20e9736c97)

Libidn 2.3.0 released 2019-11-14 ================================== - Mitre has assigned CVE-2019-12290 which was fixed by the roundtrip feature introduced in 2.2.0 commit 241e8f48 - Update the data tables from Unicode 6.3.0 to Unicode 11.0 - Turn idn2punycodeencode, idn2punycodedecode into compa...

Debian DLA-2001-1 : libofx security update

There is a NULL pointer dereference in the function OFXApplication::startElement in the file lib/ofxsgml.cpp, as demonstrated by ofxdump. For Debian 8 'Jessie', this problem has been fixed in version 1:0.9.10-1+deb8u2. We recommend that you upgrade your libofx packages. NOTE: Tenable Network...

Debian DLA-2003-1 : isc-dhcp security update

An issue has been found in isc-dhcp, a server for automatic IP address assignment. The number of simultaneous open TCP connections to OMAPI port of the server has to be limited to 200 in order to avoid a denial of service. For Debian 8 'Jessie', this problem has been fixed in version...

Fedora 30 : mingw-hunspell (2019-746b0b02f7)

This update fixes CVE-2019-16707. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Networ...

Fedora 30 : mingw-OpenEXR (2019-ce3385517b)

This update backports fixes for CVE-2018-18443 and CVE-2018-18444. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 31 : mingw-hunspell (2019-074bf7d2d3)

This update fixes CVE-2019-16707. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Networ...

Fedora 30 : oniguruma (2019-e4819c6510)

oniguruma security fix bugport, including fix for CVE-2019-16163 and bugs found on PHP. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Fedora 29 : oniguruma (2019-6a931c8eec)

oniguruma security fix bugport, including fix for CVE-2019-16163 and bugs found on PHP. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Debian DLA-1996-1 : libapache2-mod-auth-openidc security update

A security vulnerability was found in libapache2-mod-auth-openidc, the OpenID Connect authentication module for the Apache HTTP server. Insufficient validation of URLs leads to an Open Redirect vulnerability. An attacker may trick a victim into providing credentials for an OpenID provider by...