Ubuntu 17.10 : linux vulnerability (USN-3548-1)

Jay Vosburgh discovered a logic error in the x86-64 syscall entry implementation in the Linux kernel, introduced as part of the mitigations for the Spectre vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Note that Tenable Network...

WordPress < 3.1.3 Multiple Vulnerabilities

According to its self-reported version number, the WordPress application running on the remote web server is prior to 3.1.3. It is, therefore, affected by multiple unspecified vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's...

SUSE SLED12 / SLES12 Security Update : libexif (SUSE-SU-2018:0193-1)

This update for libexif fixes several issues. These security issues were fixed : - CVE-2016-6328: Fixed integer overflow in parsing MNOTE entry data of the input file bsc1055857 - CVE-2017-7544: Fixed out-of-bounds heap read vulnerability in exifdatasavedataentry function in libexif/exif-data.c...

Fedora 27 : glibc (2018-7714b514e2)

This update addresses two security vulnerabilities : - CVE-2017-16997: Check for empty tokens before dynamic string token expansion in the dynamic linker, so that pre-existing privileged programs with $ORIGIN rpaths/runpaths do not cause the dynamic linker to search the current directory,...

SUSE SLES11 Security Update : ncurses (SUSE-SU-2018:0178-1)

This update for ncurses fixes the following issues: Security issue fixed : - CVE-2017-13733: Fix illegal address access in the fmtentry function bsc1056127. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

macOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-001) (Meltdown)

The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components : - Audio - curl - IOHIDFamily - Kernel - LinkPresentation - QuartzCore - Sandbox - Security - WebKit - Wi-Fi ...

SUSE SLES11 Security Update : rsync (SUSE-SU-2018:0172-1)

This update for rsync fixes one issues. This security issue was fixed : - CVE-2018-5764: The parsearguments function in options.c did not prevent multiple --protect-args uses, which allowed remote attackers to bypass an argument-sanitization protection mechanism bsc1076503 Note that Tenable Netwo...

SUSE SLES11 Security Update : kernel (SUSE-SU-2018:0171-1) (Meltdown) (Spectre)

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. This update is only provided as a fix update for IBM Z platform. - CVE-2017-5753 / 'Spectre Attack': IBM Z fixes were included but not enabled in the previous update. This update enables those fixes...

Ubuntu 17.10 : linux vulnerabilities (USN-3541-1) (Meltdown) (Spectre)

Jann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, including kernel memory. This update provide...

Debian DLA-1249-2 : smarty3 regression update

It was previously discovered that there was a code-injection vulnerability in smarty3, a PHP template engine. A via specially crafted filename in comments could result in arbitrary code execution. However, the fix in 3.1.10-2+deb7u2 was incorrect. For Debian 7 'Wheezy', this regression has been...

Debian DLA-1252-1 : couchdb security update

CVE-2017-12635 Prevent non-admin users to give themselves admin privileges. CVE-2017-12636 Blacklist some configuration options to prevent execution of arbitrary shell commands as the CouchDB user For Debian 7 'Wheezy', these problems have been fixed in version 1.2.0-5+deb7u1. We recommend that y...

Fedora 26 : webkitgtk4 (2018-690989736a) (Spectre)

This update includes improvements to mitigate the effects of Spectre CVE-2017-5753 and CVE-2017-5715 : - Disable SharedArrayBuffers from Web API. - Reduce the precision of high resolution time to 1ms. Additional fixes : - Fix API documentation generation with newer gtk-doc. Note that Tenable...

SUSE SLES11 Security Update : rsync (SUSE-SU-2018:0117-1)

This update for rsync fixes the following issues: Security issues fixed : - CVE-2017-17434: The daemon in rsync did not check for fnamecmp filenames in the daemonfilterlist data structure in the recvfiles function in receiver.c and also did not apply the sanitizepaths protection mechanism to...

SUSE SLED12 / SLES12 Security Update : ncurses (SUSE-SU-2018:0120-1)

This update for ncurses fixes the following issues: Security issues fixed : - CVE-2017-13728: Fix infinite loop in the nextchar function in compscan.c bsc1056136. - CVE-2017-13730: Fix illegal address access in the function ncreadentrysource bsc1056131. - CVE-2017-13733: Fix illegal address acces...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0113-1) (Meltdown) (Spectre)

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes. This update is only provided as a fix update for IBM Z platform. - CVE-2017-5753 / 'Spectre Attack': IBM Z fixes were included but not enabled in the previous update. This update enables those fixes. -...

Solaris 10 (x86) : 149176-13 (deprecated)

SunOS 5.10x86: qlc patch. Date this patch was last updated by Sun : Jan/16/18 This plugin has been deprecated and either replaced with individual 149176 patch-revision plugins, or deemed non-security related. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2018/03/12. Deprecated and...

Solaris 10 (sparc) : 149175-13 (deprecated)

SunOS 5.10: qlc patch. Date this patch was last updated by Sun : Jan/16/18 This plugin has been deprecated and either replaced with individual 149175 patch-revision plugins, or deemed non-security related. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2018/03/12. Deprecated and either...

Fedora 27 : ca-certificates (2017-fba4c155be)

This is a cumulative update to the Mozilla CA certificates trust list version 2.20, which has been published as part of Mozilla NSS 3.34.1. It also includes the changes that were previously released as version 2.18 as part of NSS 3.34. For additional details, please refer to the release notes of...

Fedora 27 : webkitgtk4 (2017-3433c9245d)

This update addresses the following vulnerabilities : - CVE-2017-13798, CVE-2017-13788, CVE-2017-13803 Additional fixes : - Improve calculation of font metrics to prevent scrollbars from being shown unnecessarily in some cases. - Fix handling of null capabilities in WebDriver implementation. Note...

Fedora 27 : python-copr (2017-1fbb5ccbd6)

Change default COPR URL route from http://copr.fedoraproject.org to https://copr.fedorainfracloud.org Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much...