Fedora 30 : upx (2020-20cf0743f5)

3.96, multiple security fixes. ---- Patch for CVE-2019-20021 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing addition...

Debian DLA-2091-1 : libjackson-json-java security update

Several vulnerabilities were fixed in libjackson-json-java. CVE-2017-7525 Jackson Deserializer security vulnerability. CVE-2017-15095 Block more JDK types from polymorphic deserialization. CVE-2019-10172 XML external entity vulnerabilities. For Debian 8 'Jessie', these problems have been fixed in...

SUSE SLED15 / SLES15 Security Update : wicked (SUSE-SU-2020:0263-1)

This update for wicked fixes the following issues : CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options bsc1160903. CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 bsc1160905. Not...

Fedora 31 : 1:java-latest-openjdk (2020-2ed6716c30)

This is January 2020 OpenJDK security update for java-latest-openjdk packages. The sources are updated to the 13.0.2+8 tag. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean...

SUSE SLED15 / SLES15 Security Update : wicked (SUSE-SU-2020:0264-1)

This update for wicked fixes the following issues : CVE-2019-18902: Fixed a use-after-free when receiving invalid DHCP6 client options bsc1160903. CVE-2020-7216: Fixed a potential denial of service via a memory leak when processing packets with missing message type option in DHCP4 bsc1160905. Not...

Ubuntu 19.10 : OpenStack Keystone vulnerability (USN-4262-1)

Daniel Preussker discovered that OpenStack Keystone incorrectly handled the list credentials API. A user with a role on the project could use this issue to view any other user's credentials. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu...

Fedora 30 : ansible (2020-2bed89517f)

Update to bugfix release 2.9.3. See https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELO G-v2.9.rst Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and...

Fedora 31 : ansible (2020-caf7f7d0d9)

Update to bugfix release 2.9.3. See https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELO G-v2.9.rst Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and...

Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2020-011)

According to the version of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - Kernel: KVM: OOB memory access via mmio ring buffer. This issue is not critical for Virtuozzo 6.0, as it do...

Ubuntu 18.04 LTS : Linux kernel (HWE) vulnerability (USN-4253-2)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4253-2 advisory. USN-4253-1 fixed vulnerabilities in the Linux kernel for Ubuntu 19.10. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel...

Ubuntu 18.04 LTS : WebKitGTK+ vulnerabilities (USN-4261-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4261-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, ...

RHEL 8 : openjpeg2 (RHSA-2020:0274)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0274 advisory. OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. Security Fixes: openjpeg: Heap-based buffer overflow in...

Ubuntu 16.04 LTS : Apache Solr vulnerability (USN-4259-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4259-1 advisory. Michael Stepankin and Olga Barinova discovered that Apache Solr was vulnerable to an XXE attack. An attacker could use this vulnerability to remotely execute code...

Debian DLA-2082-1 : unzip security update

An issue has been found in unzip, a de-archiver for .zip files. While processing a password protected archive, a heap-based buffer overflow could happen, that allows an attacker to perform a denial of service or to possibly achieve code execution. For Debian 8 'Jessie', this problem has been fixe...

Ubuntu 16.04 LTS / 18.04 LTS : Cyrus SASL vulnerability (USN-4256-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4256-1 advisory. It was discovered that Cyrus SASL incorrectly handled certain LDAP packets. An attacker could possibly use this issue to execute arbitrary code or cau...

Debian DLA-2083-1 : hiredis security update

It was discovered that there were a large number of NULL pointer dereferences due to unchecked return values from malloc and friends in hiredis, a minimalistic C client library. For Debian 8 'Jessie', these issue have been fixed in hiredis version 0.11.0-4+deb8u1. We recommend that you upgrade yo...

Debian DSA-4610-1 : webkit2gtk - security update

The following vulnerabilities have been discovered in the webkit2gtk web engine : - CVE-2019-8835 An anonymous researcher discovered that maliciously crafted web content may lead to arbitrary code execution. - CVE-2019-8844 William Bowling discovered that maliciously crafted web content may lead ...

Juniper JSA10970

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the JSA10970 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version numbe...

Ubuntu 16.04 LTS / 18.04 LTS : MySQL vulnerabilities (USN-4250-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4250-1 advisory. Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been...

Ubuntu 16.04 LTS : Tomcat vulnerabilities (USN-4251-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4251-1 advisory. It was discovered that Tomcat incorrectly handled the RMI registry when configured with the JMX Remote Lifecycle Listener. A local attacker could possibl...