FreeBSD : GIMP - Heap Buffer Overflow Vulnerability (bfda2d80-0858-11e8-ad5c-0021ccb9e74d)

GNOME reports : CVE-2017-17786 Out of bounds read / heap overflow in tga importer / function bgr2rgb.part.1 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors...

Ubuntu 14.04 LTS / 16.04 LTS : Evolution Data Server vulnerability (USN-3724-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3724-1 advisory. Jon Kristensen discovered that Evolution Data Server would automatically downgrade a connection to an IMAP server if the IMAP server did not support...

SUSE SLED12 / SLES12 Security Update : util-linux (SUSE-SU-2018:2071-1)

This update for util-linux fixes the following issues : The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically...

SUSE SLES11 Security Update : kernel (SUSE-SU-2018:2062-1)

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2014-3688: The SCTP implementation allowed remote attackers to cause a denial of service memory consumption by triggering a large number of chunks in an...

Wireshark 2.6.x < 2.6.2 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 2.6.2. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.6.2 advisory. - In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15, the HTTP2 dissector could crash. This was...

Debian DLA-1446-1 : intel-microcode security update (Spectre)

Security researchers identified two software analysis methods that, if used for malicious purposes, have the potential to improperly gather sensitive data from multiple types of computing devices with different vendors processors and operating systems. This update requires an update to the...

AIX OpenSSL Advisory : openssl_advisory27.asc

The version of OpenSSL installed on the remote AIX host is affected by a side channel attack information disclosure vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid111354; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

SUSE SLED12 / SLES12 Security Update : nautilus (SUSE-SU-2018:2058-1)

This update for nautilus fixes the following issues: Security issue fixed : - CVE-2017-14604: Add a metadata::trusted metadata to the file once the user acknowledges the file as trusted, and also remove the 'trusted' content in the desktop file bsc1060031. Note that Tenable Network Security has...

Ubuntu 14.04 LTS : Apache Ant vulnerability (USN-3721-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3721-1 advisory. Danny Grander discovered that Apache Ant incorrectly handled certain compressed files. If a user or automated system were tricked into processing a specially...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : ClamAV vulnerabilities (USN-3722-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3722-1 advisory. It was discovered that ClamAV incorrectly handled parsing certain HWP files. A remote attacker could use this issue to cause Clam...

Debian DLA-1442-2 : mailman regression update

The security update of mailman announced as DLA-1442-1 introduced a regression due to an incomplete fix for CVE-2018-13796 that broke the admin and listinfo overview pages. For Debian 8 'Jessie', this problem has been fixed in version 1:2.1.18-2+deb8u4. We recommend that you upgrade your mailman...

WordPress < 4.9.7 Arbitrary File Deletion Vulnerability

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.9.7. It is, therefore, affected by an arbitrary file deletion vulnerability that can lead to remote code execution. C Tenable Network Security, Inc. include'compat.inc'; if...

Photon OS 1.0 : gcc / nghttp2 (PhotonOS-PHSA-2018-1.0-0150 (deprecated)

An update of 'gcc', 'nghttp2' packages of Photon OS has been released. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2/7/2019 The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-1.0-0150. The text itself is copyright C VMware,...

Photon OS 2.0 : libtasn1 / libtiff / dnsmasq (PhotonOS-PHSA-2018-2.0-0017) (deprecated)

An update of 'libtasn1', 'libtiff', 'dnsmasq' packages of Photon OS has been released. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2/7/2019 The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-2.0-0017. The text itself is...

SUSE SLED12 / SLES12 Security Update : rsyslog (SUSE-SU-2018:2038-1)

This update for rsyslog fixes the following issues: The following security vulnerability was addressed : - CVE-2015-3243: Make sure that log files are not created world-readable bsc935393 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

Ubuntu 18.04 LTS : python-cryptography vulnerability (USN-3720-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3720-1 advisory. It was discovered that python-cryptography incorrectly handled certain inputs. An attacker could possibly use this to get access to sensitive information. Tenable...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Mutt vulnerabilities (USN-3719-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3719-1 advisory. It was discovered that Mutt incorrectly handled certain requests. An attacker could possibly use this to execute arbitrary code...

Fedora 27 : wordpress (2018-8fc2cb8cb0)

Update to 4.9.7 security release. https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-mainte nance-release/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and...

Fedora 27 : singularity (2018-abe4d2383e)

This is a straightforward update from 2.5.1 to the newly-released 2.5.2. Release notes are here : https://github.com/singularityware/singularity/releases/tag/2.5.2 The most important fix is a security issue in the overlay code. Please look for regressions in your Singularity runtime workflows. No...

SUSE SLED12 / SLES12 Security Update : python (SUSE-SU-2018:2040-1)

This update for python fixes the following issues: The following security vulnerabilities were addressed : - Add a check to Lib/wave.py that verifies that at least one channel is provided. Prior to this, attackers could cause a denial of service via a crafted wav format audio file. bsc1083507,...