Ubuntu 6.06 LTS : firefox vulnerabilities (USN-645-2)

USN-645-1 fixed vulnerabilities in Firefox and xulrunner for Ubuntu 7.04, 7.10 and 8.04 LTS. This provides the corresponding update for Ubuntu 6.06 LTS. Justin Schuh, Tom Cross and Peter Williams discovered errors in the Firefox URL parsing routines. If a user were tricked into opening a crafted...

Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : firefox vulnerability (USN-1758-1)

It was discovered that Firefox contained a memory safety issue. If a user were tricked into opening a specially crafted page with the HTML editor, a remote attacker could exploit this to execute arbitrary code with the privileges of the user invoking the program. Note that Tenable Network Securit...

Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : python-django vulnerabilities (USN-1757-1)

James Kettle discovered that Django did not properly filter the Host HTTP header when processing certain requests. An attacker could exploit this to generate and display arbitrary URLs to users. Although this issue had been previously addressed in USN-1632-1, this update adds additional hardening...

Foswiki Detection

The remote host is running Foswiki, an open source wiki system written in Perl. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid65058; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01"; scriptnameenglish:"Foswiki Detection";...

Jenkins Detection

The remote web server hosts Jenkins, a job scheduling / management system and a drop-in replacement for Hudson. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid65054; scriptversion"1.20"; scriptsetattributeattribute:"pluginmodificationdate", value:"2024/10/03";...

Fedora 18 : kernel-3.8.1-201.fc18 (2013-3223)

Rebase to 3.8.1 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable Network...

Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : gnutls13, gnutls26 vulnerability (USN-1752-1)

Nadhem Alfardan and Kenny Paterson discovered that the TLS protocol as used in GnuTLS was vulnerable to a timing side-channel attack known as the 'Lucky Thirteen' issue. A remote attacker could use this issue to perform plaintext-recovery attacks via analysis of timing data. Note that Tenable...

Fedora 17 : cups-1.5.4-18.fc17 (2012-19606)

This update addresses two security issues : - CVE-2012-5519 privilege escalation for users for the CUPS SystemGroup group or via polkit is fixed by moving certain configuration keywords into a separate file, cups-files.conf, which cannot be modified by cupsd. - CVE-2012-6094 configuration issue...

Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : pidgin vulnerabilities (USN-1746-1)

Chris Wysopal discovered that Pidgin incorrectly handled file transfers in the MXit protocol handler. A remote attacker could use this issue to create or overwrite arbitrary files. This issue only affected Ubuntu 11.10, Ubuntu 12.04 LTS and Ubuntu 12.10. CVE-2013-0271 It was discovered that Pidgi...

Fedora 17 : freeipa-2.2.2-1.fc17 (2013-2434)

Update to upstream 2.2.1 GA. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Sun Java JRE / Web Start Java Plug-in Untrusted Applet Privilege Escalation (Unix)

The remote host is using an unmanaged version of Sun Java Runtime Environment that has vulnerabilities in its Java Runtime Plug-in, a web browser add-on used to display Java applets. The JRE Plug-in security can be bypassed by tricking a user into viewing a maliciously crafted web page...

Ubuntu 12.04 LTS / 12.10 : keystone vulnerabilities (USN-1730-1)

Nathanael Burton discovered that Keystone did not properly verify disabled users. An authenticated but disabled user would continue to have access rights that were removed. CVE-2013-0282 Jonathan Murray discovered that Keystone would allow XML entity processing. A remote unauthenticated attacker...

Fedora 17 : rubygem-activemodel-3.0.11-3.fc17 (2013-2391)

Fix for CVE-2013-0276. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Fedora 17 : rubygem-activerecord-3.0.11-6.fc17 (2013-2351)

Fix for CVE-2013-0277. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Fedora 17 : dnsmasq-2.65-4.fc17 (2013-1320)

From dnsmasq's CHANGELOG : Add code to make behaviour for TCP DNS requests that same as for UDP requests, when a request arrives for an allowed address, but via a banned interface. This change is only active on Linux, since the relevant API is missing AFAIK on other platforms. - dnsmasq now answe...

Fedora 18 : kernel-3.7.8-202.fc18 (2013-2635)

CVE-2013-0290 net: infinite loop in skbrecvdatagram Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Ubuntu 10.04 LTS / 11.10 : jquery vulnerability (USN-1722-1)

It was discovered that jQuery incorrectly handled selecting elements using location.hash, resulting in a possible cross-site scripting XSS issue. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify...

Fedora 18 : dnsmasq-2.65-4.fc18 (2013-1357)

From dnsmasq's CHANGELOG : Add code to make behaviour for TCP DNS requests that same as for UDP requests, when a request arrives for an allowed address, but via a banned interface. This change is only active on Linux, since the relevant API is missing AFAIK on other platforms. - dnsmasq now answe...

Ubuntu 11.10 : linux vulnerabilities (USN-1720-1)

It was discovered that hypervkvpd, which is distributed in the Linux kernel, was not correctly validating the origin on Netlink messages. An untrusted local user can cause a denial of service of Linux guests in Hyper-V virtualization environments. CVE-2012-2669 Dmitry Monakhov reported a race...

Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerabilities (USN-1719-1)

It was discovered that hypervkvpd, which is distributed in the Linux kernel, was not correctly validating the origin on Netlink messages. An untrusted local user can cause a denial of service of Linux guests in Hyper-V virtualization environments. CVE-2012-2669 Dmitry Monakhov reported a race...