Ubuntu 16.04 LTS / 18.04 LTS : nginx vulnerabilities (USN-4099-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4099-1 advisory. Jonathan Looney discovered that nginx incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to consu...

Fedora 30 : 3:mariadb / mariadb-connector-c / mariadb-connector-odbc (2019-60befaed69)

MariaDB 10.3.17 Release notes : https://mariadb.com/kb/en/mariadb-10317-release-notes/ MariaDB Connector/C 3.1.3 Release notes : https://mariadb.com/kb/en/mariadb-connector-c-313-release-notes/ MariaDB Connector/ODBC 3.1.2 Release notes :...

Exim < 4.92.1 Input-Validation RCE

According to its banner, the version of Exim running on the remote host is prior to 4.92.1. It is, therefore, potentially affected an input-validation flaw in the '$sort ' expansion. A remote attacker could potentially execute arbitrary code. Note that the default configuration does not include...

Ubuntu 19.04 : docker-credential-helpers vulnerability (USN-4103-1)

Jasiel Spelman discovered that a double free existed in docker-credential- helpers. A local attacker could use this to cause a denial of service crash or possibly execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu...

Fedora 30 : hostapd (2019-97e9040197)

Update to version 2.9 from upstream Security fix for CVE-2019-13377 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 29 : postgresql (2019-5fbbf73269)

New upstream release 10.10 Per release notes: https://www.postgresql.org/docs/11/release-10-10.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much a...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel (AWS) vulnerability (USN-4096-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4096-1 advisory. Andrei Vlad Lutas and Dan Lutas discovered that some x86 processors incorrectly handle SWAPGS instructions during speculative execution. A local...

Fedora 29 : igraph (2019-5d52865475)

Patch for CVE-2018-20349 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Securit...

Fedora 29 : 7:squid (2019-cb50bcc189)

Resolves: 1737030 - Depend on httpd-filesystem ---- Security fix for CVE-2019-12525 CVE-2019-12527 CVE-2019-12529 CVE-2019-12854 . - update to version 4.8 ---- Security fix for CVE-2019-13345. Note that Tenable Network Security has extracted the preceding description block directly from the Fedor...

Fedora 29 : jhead (2019-441c2fb0d1)

added patches to fix CVE-2019-1010301 and CVE-2019-1010302 from Debian Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducin...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4095-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4095-1 advisory. Eli Biham and Lior Neumann discovered that the Bluetooth implementation in the Linux kernel did not properly validate elliptic curve parameters during...

Fedora 30 : 6:kdelibs / kde-settings (2019-a746ac9c89)

This update fixes CVE-2019-14744 kconfig arbitrary shell code execution in the compatibility library kdelibs 4 used by legacy applications not yet ported to KDE Frameworks 5. The included kde-settings update removes obsolete settings that conflict with the security fix and are no longer needed se...

Debian DLA-1883-1 : tomcat8 security update (httpoxy)

Several minor issues have been fixed in tomcat8, a Java Servlet and JSP engine. CVE-2016-5388 Apache Tomcat, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variabl...

SUSE SLED12 / SLES12 Security Update : mariadb-100 (SUSE-SU-2019:2118-1)

This update for mariadb-100 to version 10.0.38 fixes the following issues : CVE-2019-2537: Fixed a denial of service vulnerability which can lead to MySQL compromise bsc1136037. CVE-2019-2529: Fixed a denial of service vulnerability by an privileged attacker via a protocol compromise bsc1136037...

Ubuntu 16.04 LTS / 18.04 LTS : PHP vulnerabilities (USN-4097-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4097-1 advisory. It was discovered that PHP incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or...

Fedora 30 : igraph (2019-060e7b383c)

Patch for CVE-2018-20349 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Securit...

Fedora 30 : jhead (2019-17b95fecd3)

added patches to fix CVE-2019-1010301 and CVE-2019-1010302 from Debian Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducin...

Debian DLA-1880-1 : ghostscript security update

Netanel reported that the .buildfont1 procedure in Ghostscript, the GPL PostScript/PDF interpreter, does not properly restrict privileged calls, which could result in bypass of file system restrictions of the dSAFER sandbox. For Debian 8 'Jessie', this problem has been fixed in version...

SUSE SLED15 / SLES15 Security Update : containerd, docker, docker-runc, golang-github-docker-libnetwork (SUSE-SU-2019:2117-1)

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues : Docker : CVE-2019-14271: Fixed a code injection if the nsswitch facility dynamically loaded a library inside a chroot bsc1143409. CVE-2019-13509: Fixed an information leak in the debug lo...

Debian DSA-4498-1 : python-django - security update

Several vulnerabilities were discovered in python-django, a web development framework. They could lead to remote denial-of-service or SQL injection, C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4498. The...