Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-3051-1)

It was discovered that the keyring implementation in the Linux kernel did not ensure a data structure was initialized before referencing it after an error condition occurred. A local attacker could use this to cause a denial of service system crash. CVE-2016-4470 Kangjie Lu discovered an...

Fedora 24 : openssh (2016-4a3debc3a6)

Security fix for CVE-2016-6515 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

Fedora 24 : xen (2016-01cc766201) (Bunker Buster)

x86: Privilege escalation in PV guests XSA-182, CVE-2016-6258 x86: Missing SMAP whitelisting in 32-bit exception / event delivery XSA-183, CVE-2016-6259 virtio: unbounded memory allocation issue XSA-184, CVE-2016-5403 Qemu: scsi: esp: OOB write access in espdodma CVE-2016-6351 Note that Tenable...

Fedora 24 : python-autobahn (2016-acda4281c9)

Security fix for Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Debian DLA-583-1 : lighttpd security update

Dominic Scheirlinck and Scott Geary of Vend reported an insecure behaviour in the lighttpd web server. Lighttpd assigned Proxy header values from client requests to internal HTTPPROXY environment variables. This could be used to carry out Man in the Middle Attacks MIDM or create connections to...

Debian DLA-581-1 : libreoffice security update

Aleksandar Nikolic discovered that missing input sanitising in the RTF parser in Libreoffice may result in the execution of arbitrary code if a malformed documented is opened. For Debian 7 'Wheezy', these problems have been fixed in version 1:3.5.4+dfsg2-0+deb7u7. We recommend that you upgrade yo...

Debian DLA-570-1 : kde4libs security update

It was possible to trick kde4libs's KArchiveDirectory::copyTo function to extract files to arbitrary system locations from a specially prepared tar file outside of the extraction folder. For Debian 7 'Wheezy', these problems have been fixed in version 4:4.8.4-4+deb7u2. We recommend that you upgra...

Debian DLA-566-1 : cakephp security update

CakePHP, an open source web application framework for PHP, was vulnerable to SSRF Server Side Request Forgery attacks. Remote attacker can utilize it for at least DoS Denial of Service attacks, if the target application accepts XML as an input. It is caused by insecure design of Cake's Xml class...

Debian DLA-569-1 : xmlrpc-epi security update

Integer signedness error in the simplestringaddn function in simplestring.c in xmlrpc-epi through 0.54.2 allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a long first argument to the PHP xmlrpcencoderequest function. For...

Debian DLA-560-2 : cacti regression update

Three security issues have been found in cacti : CVE-2016-2313 authlogin.php allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database. CVE-2016-3172 A SQL injection vulnerability in tree.php allows remote...

Fedora 24 : ca-certificates (2016-7527145931)

This is an update to the Mozilla CA certificates list version 2.8, which has been published as part of Mozilla NSS 3.25. As in previous versions of the ca-certificates package, the CA list has been modified to keep several legacy CAs still trusted for compatibility reasons. Please refer to...

Fedora 24 : gd (2016-615f3bf06e)

LibGD 2.2.3 release Security related fixes: This flaw is caused by loading data from external sources file, custom ctx, etc and are hard to validate before calling libgd APIs : - fix php bug php72339, Integer Overflow in gd2GetHeader CVE-2016-5766 - bug 248, fix Out-Of-Bounds Read in readimagetga...

Fedora 23 : kernel (2016-784d5526d8)

Update to latest upstream stable release, Linux v4.6.4 For those with Skylake CPUs, please note that there may be instability with a recent microcode update. Read https://www.happyassassin.net/2016/07/07/psa-failure-to-boot-after-ker nel-update-on-skylake-systems/ and look for a system firmware...

MUICache Program Execution History

Nessus was able to query the MUIcache registry key to find evidence of program execution. C Tenable Network Security, Inc. include"compat.inc"; if !definedfunc"nasllevel" || nasllevel 5200 exit0, "Not Nessus 5.2+"; if description scriptid92424; scriptversion"1.5"; scriptcvsdate"Date: 2018/05/16...

Microsoft Windows Last Boot Time

Nessus was able to collect and report the remote host's last boot time as an ISO 8601 timestamp. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid92366; scriptversion"1.7"; scriptcvsdate"Date: 2018/07/09 16:48:24"; scriptnameenglish:"Microsoft Windows Last Boot Time";...

Application Compatibility Cache

Nessus was able to generate a report on the application compatibility cache on the remote Windows host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid92415; scriptversion"1.5"; scriptcvsdate"Date: 2018/05/23 16:10:01"; scriptnameenglish:"Application Compatibility...

Microsoft Windows Device Logs

Nessus was able to collect available device logs from the remote Windows host and add them as attachments. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid92363; scriptversion"1.5"; scriptcvsdate"Date: 2018/05/23 16:10:01"; scriptnameenglish:"Microsoft Windows Device...

Debian DLA-552-1 : binutils security update

Some minor security issues have been identified and fixed in binutils in Debian LTS. These are : CVE-2016-2226 Exploitable buffer overflow. CVE-2016-4487 Invalid write due to a use-after-free to array btypevec. CVE-2016-4488 Invalid write due to a use-after-free to array ktypevec. CVE-2016-4489...

Flash Cookie History

Nessus was able to generate a list of URLs that set Flash cookies on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid92419; scriptversion"1.5"; scriptcvsdate"Date: 2018/05/23 16:10:01"; scriptnameenglish:"Flash Cookie History";...

Fedora 23 : sudo (2016-f1e8e27e27)

update to 1.8.17p1 - installs the /var/db/sudo/lectured directory Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...