RHEL 7 : vdsm (RHSA-2019:0458)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0458 advisory. The VDSM service is required by a Virtualization Manager to manage the Linux hosts. VDSM manages and monitors the host's storage, memory and networks...

Virtuozzo 7 : java-1.7.0-openjdk / etc (VZLSA-2019-0464)

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Fedora 29 : kernel / kernel-headers (2019-87e7046631)

The 4.20.14 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Slackware 14.0 / 14.1 / 14.2 / current : ntp (SSA:2019-067-01)

New ntp packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2019-067-01. The text itself is copyright C Slackware Linux,...

RHEL 7 : redhat-virtualization-host (RHSA-2019:0457)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0457 advisory. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host,...

EulerOS 2.0 SP5 : ghostscript (EulerOS-SA-2019-1065)

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ghostscript: access bypass in psi/zdevice2.c 700153 CVE-2018-19475 - ghostscript: access bypass in psi/zicc.c 700169 CVE-2018-19476 -...

EulerOS 2.0 SP5 : rsyslog (EulerOS-SA-2019-1073)

According to the version of the rsyslog packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp...

EulerOS Virtualization 2.5.2 : openssl (EulerOS-SA-2019-1084)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with...

Fedora 28 : drupal7-link (2019-ff4e1a73a5)

https://www.drupal.org/project/link/releases/7.x-1.6 - https://www.drupal.org/sa-contrib-2019-020 - https://www.drupal.org/sa-core-2019-003 - https://www.drupal.org/project/link/releases/7.x-1.5 - https://www.drupal.org/project/link/releases/7.x-1.5-beta3 Note that Tenable Network Security has...

Ubuntu 18.10 : linux, linux-azure, linux-gcp, linux-kvm, linux-raspi2 vulnerabilities (USN-3903-1)

Jason Wang discovered that the vhost net driver in the Linux kernel contained an out of bounds write vulnerability. An attacker in a guest virtual machine could use this to cause a denial of service host system crash or possibly execute arbitrary code in the host kernel. CVE-2018-16880 Jann Horn...

Fedora 28 : ming (2019-4fdf19459d)

Fixes: CVE-2018-6358, CVE-2018-7867, CVE-2018-7868, CVE-2018-7870, CVE-2018-7871, CVE-2018-7872, CVE-2018-7875, CVE-2018-9165. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically...

Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20190305)

Security Fixes : - OpenJDK: memory disclosure in FileChannelImpl Libraries, 8206290 CVE-2019-2422 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid122640; scriptversion"1.4";...

Debian DLA-1705-1 : sox security update

Multiple vulnerabilities have been discovered in SoX Sound eXchange, a sound processing program : CVE-2017-11332 The startread function wav.c is affected by a divide-by-zero vulnerability when processing WAV file with zero channel count. This flaw might be leveraged by remote attackers using a...

Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-3901-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3901-1 advisory. Jann Horn discovered that the userfaultd implementation in the Linux kernel did not properly restrict access to certain ioctls. A local attacker could us...

Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3901-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3901-2 advisory. USN-3901-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux...

BSides SF 2019: Remote-Root Bug in Logitech Harmony Hub Patched and Explained

SAN FRANCISCO – Users of Logitech’s Harmony Hub have been wide open to an attack for years because of four unpatched vulnerabilities that left any IoT device connected at risk to remote takeover. The bugs were patched by Logitech in November, but for the first time the researchers that discovered...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : OpenSSH vulnerability (USN-3885-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3885-2 advisory. USN-3885-1 fixed vulnerabilities in OpenSSH. It was discovered that the fix for CVE-2019-6111 turned out to be incomplete. This update fix...

SUSE SLED15 / SLES15 Security Update : freerdp (SUSE-SU-2019:0539-1)

This update for freerdp to version 2.0.0rc4 fixes the following issues : Security issues fixed : CVE-2018-0886: Fix a remote code execution vulnerability CredSSP bsc1085416, bsc1087240, bsc1104918 CVE-2018-8789: Fix several denial of service vulnerabilities in the in the NTLM Authentication modul...

Fedora 28 : openocd (2019-f0add5eed0)

fix for CVE-2018-5704 RHBZ 1534844 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Netwo...

Debian DLA-1702-1 : advancecomp security update

Several vulnerabilities were discovered in advancecomp, a collection of recompression utilities. CVE-2018-1056 Joonun Jang discovered that the advzip tool was prone to a heap-based buffer overflow. This might allow an attacker to cause a denial of service application crash or other unspecified...