Fedora 27 : ghostscript (2018-f1b1ed38b3)

Security update for CVE-2018-16543 and CVE-2018-16510, which were recently discovered. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

EulerOS Virtualization 2.5.0 : dhcp (EulerOS-SA-2018-1241)

According to the version of the dhcp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - It was found that the DHCP daemon did not properly clean up closed OMAPI connections in certain cases. A remote attacker able to conne...

Debian DLA-1502-1 : mgetty security update

Two input sanitization failures have been found in the faxrunq and faxq binaries in mgetty. An attacker could leverage them to insert commands via shell metacharacters in jobs id and have them executed with the privilege of the faxrunq/faxq user. For Debian 8 'Jessie', this problem has been fixed...

SUSE SLES11 Security Update : php53 (SUSE-SU-2018:2681-1)

This update for php53 fixes the following issues : The following security issues were fixed : CVE-2018-14851: Fixed an out-of-bound read in exifprocessIFDinMAKERNOTE, which could be exploited by an attacker via crafted JPG files, and could result in an application crash. bsc1103659 CVE-2018-14883...

Debian DLA-1499-1 : discount security update

Several heap-based buffer over-reads were found in discount, an implementation of the Markdown markup language in C, that allowed remote attackers to cause a denial of service via specially crafted files. For Debian 8 'Jessie', these problems have been fixed in version 2.1.7-1+deb8u1. We recommen...

Docker for Windows stable < 18.06.0-ce-win70 / edge < 18.06.0-ce-rc3-win68 Remote Privilege Escalation Vulnerability

The version of Docker for Windows installed on the remote Windows host is stable channel 18.06.0-ce-win70 or edge channel 18.06.0-ce-rc3-win68. It is, therefore, affected by a remote privilege escalation vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description...

SUSE SLES11 Security Update : kvm (SUSE-SU-2018:2615-1) (Spectre)

This update for kvm fixes the following security issues : CVE-2018-12617: qmpguestfileread had an integer overflow that could have been exploited by sending a crafted QMP command including guest-file-read with a large count value to the agent via the listening socket causing DoS bsc1098735...

Fedora 27 : xen (2018-915602df63) (Foreshadow)

L1 Terminal Fault speculative side channel patch bundle XSA-273, CVE-2018-3620, CVE-2018-3646 drop patches also in the bundle, which also includes Use of v2 grant tables may cause crash on ARM XSA-268 1616081 x86: Incorrect MSRDEBUGCTL handling lets guests enable BTS XSA-269 1616077 oxenstored do...

Debian DLA-1490-1 : php5 security update

Two vulnerabilities have been discovered in php5, a server-side, HTML-embedded scripting language. One CVE-2018-14851 results in a potential denial of service out-of-bounds read and application crash via a crafted JPEG file. The other CVE-2018-14883 is an Integer Overflow that leads to a heap-bas...

SUSE SLES11 Security Update : ImageMagick (SUSE-SU-2018:2553-1)

This update for ImageMagick fixes the following issues: Security issue fixed : - Hide PS, XPS and PDF coders into /vulnerable bsc1105592 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automaticall...

Debian DLA-1481-1 : linux-4.9 security update (Foreshadow)

Multiple researchers have discovered a vulnerability in the way the Intel processor designs have implemented speculative execution of instructions in combination with handling of page-faults. This flaw could allow an attacker controlling an unprivileged process to read memory from arbitrary...

Debian DLA-1476-1 : dropbear security update

A vulnerability in dropbear, a lightweight SSH2 server and client, making it possible to guess valid usernames has been found : CVE-2018-15599 : The recvmsguserauthrequest function in svr-auth.c in is prone to a user enumeration vulnerability, similar to CVE-2018-15473 in OpenSSH. For Debian 8...

Nessus Launched Plugin List

This plugin displays the list of launched plugins in a semicolon delimited list. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid112154; scriptversion"1.4"; scriptcvsdate"Date: 2018/09/24 10:11:01"; scriptnameenglish:"Nessus Launched Plugin List";...

SUSE SLED12 Security Update : libreoffice (SUSE-SU-2018:2485-1)

This update for libreoffice to 6.0.5.2 fixes the following issues: Security issues fixed : - CVE-2018-10583: An information disclosure vulnerability occurs during automatic processing and initiating an SMB connection embedded in a malicious file, as demonstrated by...

SUSE SLES11 Security Update : openssl (SUSE-SU-2018:2486-1)

This update for openssl fixes the following security issue : - CVE-2018-0737: The RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could have...

Debian DLA-1472-1 : libcgroup security update

The cgrulesengd daemon in libcgroup creates log files with world readable and writable permissions due to a reset of the file mode creation mask umask0. For Debian 8 'Jessie', this problem has been fixed in version 0.41-6+deb8u1. We recommend that you upgrade your libcgroup packages. NOTE: Tenabl...

SUSE SLES12 Security Update : xen (SUSE-SU-2018:2410-1) (Foreshadow)

This update for xen fixes the following security issues : - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest O...

Fedora 27 : libgit2 (2018-ca483ae3e0)

This is a security release fixing out-of-bounds reads when processing smart-protocol 'ng' packets. When parsing an 'ng' packet, we keep track of both the current position as well as the remaining length of the packet itself. But instead of taking care not to exceed the length, we pass the current...

Photon OS 1.0: Libxslt / Linux / Sqlite PHSA-2017-0025 (deprecated)

An update of linux,sqlite-autoconf,libxslt packages for PhotonOS has been released. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2/7/2019 The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2017-0025. The text itself is copyright C...

Photon OS 1.0: Libxml2 / Linux / Openssh PHSA-2017-0001 (deprecated)

An update of openssh,linux,libxml2 packages for PhotonOS has been released. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2/7/2019 The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2017-0001. The text itself is copyright C VMware,...