EulerOS Virtualization for ARM 64 3.0.2.0 : freetype (EulerOS-SA-2020-1224)

According to the versions of the freetype package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The FreeType engine is a free and portable font rendering engine, developed to provide advanced font support for a...

EulerOS Virtualization for ARM 64 3.0.2.0 : nss-softokn (EulerOS-SA-2020-1252)

According to the versions of the nss-softokn packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted...

Fedora 31 : mbedtls (2020-0ab860bb95)

Update to 2.16.5 Release notes: https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.5-and-2.7.14-r eleased Security Advisory: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security -advisory-2020-02 Note that Tenable Network Security has extracted the preceding description...

Fedora 31 : monit (2020-9c19202d55)

Update to 5.26.0 includes security fix for CVE-2019-11454 and CVE-2019-11455 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

EulerOS Virtualization for ARM 64 3.0.2.0 : libgcrypt (EulerOS-SA-2020-1189)

According to the versions of the libgcrypt package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and...

Fedora 31 : ppp (2020-4304397fe0)

This is an update fixing CVE-2020-8597. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable...

SUSE SLED15 / SLES15 Security Update : librsvg (SUSE-SU-2020:0629-1)

This update for librsvg to version 2.42.8 fixes the following issues : librsvg was updated to version 2.42.8 fixing the following issues : CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service bsc1162501. NOTE: Librsvg now has limits on the numbe...

SUSE SLED12 / SLES12 Security Update : ipmitool (SUSE-SU-2020:0630-1)

This update for ipmitool fixes the following issues : CVE-2020-5208: Fixed multiple remote code executtion vulnerabilities bsc1163026. picmg discover messages are now DEBUG and not INFO messages bsc1085469. Note that Tenable Network Security has extracted the preceding description block directly...

Microsoft Windows SMBv3 Compression RCE (ADV200005)(CVE-2020-0796)(Deprecated)

This plugin has been deprecated due to an out-of-band patch being release by the vendor. The suggested mitigation provided in ADV200005 is no longer required. Plugin 134428 should be used instead to verify the patch is properly applied. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on...

Ubuntu 18.04 LTS : runC vulnerabilities (USN-4297-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4297-1 advisory. It was discovered that runC incorrectly checked mount targets. An attacker with a malicious container image could possibly mount over the /proc directory...

SUSE SLES12 Security Update : librsvg (SUSE-SU-2020:0604-1)

This update for librsvg to version 2.40.21 fixes the following issues : librsvg was updated to version 2.40.21 fixing the following issues : CVE-2019-20446: Fixed an issue where a crafted SVG file with nested patterns can cause denial of service bsc1162501. NOTE: Librsvg now has limits on the...

Fedora 31 : libtiff (2020-2e9bd06377)

Security fix for CVE-2019-17546. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Fedora 31 : opensmtpd (2020-283dc7f094)

Release 6.6.4p1 2020-02-24 --- - An out of bounds read in smtpd allows an attacker to inject arbitrary commands into the envelope file which are then executed as root. Separately, missing privilege revocation in smtpctl allows arbitrary commands to be run with the smtpq group. Release 6.6.3p1...

SUSE SLES12 Security Update : compat-openssl098 (SUSE-SU-2020:0576-1)

This update for compat-openssl098 fixes the following issues : Add missing commits for fixes of the 'The 9 Lives of Bleichenbacher's CAT' attack bsc1117951 Fixed missing BNcopy bsc1160163 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

SUSE SLED15 / SLES15 Security Update : cloud-init (SUSE-SU-2020:0585-1)

This update for cloud-init fixes the following security issues : CVE-2020-8631: Replaced the theoretically predictable deterministic RNG with the system RNG bsc1162937. CVE-2020-8632: Increased the default random password length from 9 to 20 bsc1162936. Note that Tenable Network Security has...

Fedora 30 : opensmtpd (2020-31216ab928)

Release 6.6.4p1 2020-02-24 --- - An out of bounds read in smtpd allows an attacker to inject arbitrary commands into the envelope file which are then executed as root. Separately, missing privilege revocation in smtpctl allows arbitrary commands to be run with the smtpq group. Release 6.6.3p1...

Debian DLA-2117-1 : zsh security update

A privilege escalation vulnerability was discovered in zsh, a shell with lots of features, whereby a user could regain a formerly elevated privelege level even when such an action should not be permitted. For Debian 8 'Jessie', this problem has been fixed in version 5.0.7-5+deb8u1. We recommend...

RHEL 7 : qemu-kvm-ma (RHSA-2020:0669)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0669 advisory. Kernel-based Virtual Machine KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-ma packages provide the...

Fedora 30 : libtiff (2020-6f1209bb45)

Security fix for CVE-2019-17546. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Debian DLA-2133-1 : tomcat7 security update

Several security vulnerabilities have been discovered in the Tomcat servlet and JSP engine. CVE-2019-17569 The refactoring in 7.0.98 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request...