Tenable Nessus < 8.11.1 Session Expiration (TNS-2020-06)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 8.11.1. Nessus 8.11.0 and earlier were found to be maintaining sessions longer than the permitted period in certain scenarios. The lack of proper session expiration allows attackers with...

SUSE SLES12 Security Update : xorg-x11-server (SUSE-SU-2020:2242-1)

This update for xorg-x11-server fixes the following issues : CVE-2020-14347: Leak of uninitialized heap memory from the X server to clients on pixmap allocation bsc1174633, ZDI-CAN-11426. CVE-2020-14346: XIChangeHierarchy Integer Underflow Privilege Escalation Vulnerability bsc1174638,...

Debian DLA-2342-1 : libjackson-json-java security update

Several vulnerabilities were fixed in libjackson-json-java, a Java JSON processor. CVE-2017-7525 Jackson Deserializer security vulnerability. CVE-2017-15095 Block more JDK types from polymorphic deserialization. CVE-2019-10172 XML external entity vulnerabilities. For Debian 9 stretch, these...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Net-SNMP vulnerabilities (USN-4471-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4471-1 advisory. Tobias Neitzel discovered that Net-SNMP incorrectly handled certain symlinks. An attacker could possibly use this issue to access...

Fedora 31 : nss (2020-426fd04fd0)

Updates the nss package to upstream NSS 3.55. For details about new functionality and a list of bugs fixed in this release please see the upstream release notes - https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS3.55releasenotes Note that Tenable Network Security has extracted the...

Debian DLA-2336-1 : firejail security update

Tim Starling discovered two vulnerabilities in firejail, a sandbox program to restrict the running environment of untrusted applications. CVE-2020-17367 It was reported that firejail does not respect the end-of-options separator '--', allowing an attacker with control over the command line option...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Bind vulnerabilities (USN-4468-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4468-1 advisory. Emanuel Almeida discovered that Bind incorrectly handled certain TCP payloads. A remote attacker could possibly use this issue to...

Tenable Nessus < 8.11.1 Session Expiration Vulnerability (TNS-2020-06)

Tenable Nessus is prone to a lack of proper session expiration. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tenable:nessus";...

Debian DLA-2339-1 : software-properties security update

Jason A. Donenfeld found an ansi escape sequence injection into software-properties, a manager for apt repository sources. An attacker could manipulate the screen of a user prompted to install an additional repository PPA. For Debian 9 stretch, this problem has been fixed in version...

Fedora 31 : python35 (2020-c539babb0a)

Security fix for CVE-2019-20907, CVE-2020-14422. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C...

SUSE SLED15 / SLES15 Security Update : python3 (SUSE-SU-2020:2277-1)

This update for python3 fixes the following issues : bsc1174091, CVE-2019-20907: avoiding possible infinite loop in specifically crafted tarball. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

Photon OS 3.0: Linux PHSA-2020-3.0-0127

An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0127. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid139699;...

Photon OS 3.0: Curl PHSA-2020-3.0-0129

An update of the curl package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-3.0-0129. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid139729;...

Fedora 31 : ansible (2020-1e6eeadbb4)

Update to 2.9.12 upstream bugfix and security update Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issue...

Fedora 31 : rubygem-kramdown (2020-5c70d97eca)

A security flaw was found on ruby kramdown which may lead to unintended code execution. THis vulnerability is now assigned as CVE-2020-14001 . This new rpm should fix this issue. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update syste...

SUSE SLED15 / SLES15 Security Update : libvirt (SUSE-SU-2020:2269-1)

This update for libvirt fixes the following issues : CVE-2020-14339: Don't leak /dev/mapper/control into QEMU. Use ioctl's to obtain the dependency tree of disks and drop use of libdevmapper. bsc1161883, bsc1174458 Note that Tenable Network Security has extracted the preceding description block...

Fedora 31 : kernel (2020-2cd6393548)

The 5.7.15 stable kernel release contains a number of important fixes across the tree. ---- The 5.7.14 stable kernel update contains a number of important fixes across the tree. ---- The 5.7.12 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network...

Ubuntu 20.04 LTS : GNOME Shell vulnerability (USN-4464-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4464-1 advisory. It was discovered that GNOME Shell incorrectly handled the login screen password dialog. Sensitive information could possibly be exposed during user logout. Tenab...

Google Chrome < 84.0.4147.135 Vulnerability

The version of Google Chrome installed on the remote macOS host is prior to 84.0.4147.135. It is, therefore, affected by a vulnerability as referenced in the 202008stable-channel-update-for-desktop18 advisory. - Heap buffer overflow in SwiftShader in Google Chrome prior to 84.0.4147.135 allowed a...

SUSE SLED15 / SLES15 Security Update : postgresql12 (SUSE-SU-2020:2265-1)

This update for postgresql12 fixes the following issues : update to 12.4 : - CVE-2020-14349, bsc1175193: Set a secure searchpath in logical replication walsenders and apply workers - CVE-2020-14350, bsc1175194: Make contrib modules' installation scripts more secure. -...