Ubuntu 16.04 LTS : Linux kernel (Intel Euclid) vulnerability (USN-3633-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3633-1 advisory. Jann Horn discovered that the Berkeley Packet Filter BPF implementation in the Linux kernel improperly performed sign extension in some situations. A local attack...

Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3631-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3631-2 advisory. USN-3631-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enableme...

Ubuntu 14.04 LTS / 16.04 LTS : MySQL vulnerabilities (USN-3629-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3629-1 advisory. Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0991-1)

This update for the Linux Kernel 3.12.74-606485 fixes one issue. The following security issue was fixed : - CVE-2018-7566: The Linux kernel had a buffer overflow via an SNDRVSEQIOCTLSETCLIENTPOOL ioctl write operation to /dev/snd/seq by a local user bsc1083488. Note that Tenable Network Security...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1003-1)

This update for the Linux Kernel 4.4.114-9267 fixes several issues. The following security issues were fixed : - CVE-2017-13166: Prevent elevation of privilege vulnerability in the v4l2 video driver bsc1085447. - CVE-2018-1068: A flaw in the implementation of 32-bit syscall interface for bridging...

Ubuntu 14.04 LTS / 16.04 LTS : OpenSSL vulnerability (USN-3628-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3628-1 advisory. Alejandro Cabrera Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia discovered that OpenSSL incorrectly handled RSA key...

Juniper Junos Connectionless Network Protocol (CLNP) Packet Handling Unspecified Remote Code Execution / DoS (JSA10844)

According to its self-reported version number, the remote Juniper Junos device is affected by an unspecified flaw that is triggered when handling Connectionless Network Protocol CLNP packets. This allows a remote attacker to crash a device or execute arbitrary code. Note: This issue is only...

Debian DLA-1356-1 : libreoffice security update

Fuzzing by the OSS-Fuzz project found two memory safety issues in LibreOffice, which could result in an application crash or possibly other unspecified impact. For Debian 7 'Wheezy', these problems have been fixed in version 1:3.5.4+dfsg2-0+deb7u11. We recommend that you upgrade your libreoffice...

Cisco IOS SNMP Community string write privileges.

According to its configuration, the Cisco IOS on the remote device has a SNMP community string with write access. This could allow remote configuration of the device, including copying and overwriting the running-config. TRUSTED...

Debian DLA-1352-1 : jruby security update

An unsafe object deserialization vulnerability was found in jruby, a 100% pure-Java implementation of Ruby. An attacker can use this flaw to run arbitrary code when gem owner is run on a specially crafted YAML file. For Debian 7 'Wheezy', these problems have been fixed in version 1.5.6-5+deb7u2. ...

Debian DLA-1348-1 : patch security update

It was discovered that there was an input validation vulnerability in the patch1 utility where an ed1 script embedded in a regular input file could result in arbitrary code execution. This was reported by Rachel Kroll 0 et al. For Debian 7 'Wheezy', this issue has been fixed in patch version...

Solaris 10 (x86) : 152079-91

JavaSE 6x86: update 191 patch equivalent. Date this patch was last updated by Sun : Apr/16/18 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid109079; scriptversion"1.5";...

Belkin N750 Router 1.10.22 Command Injection

The remote Belkin router is affected by a remote command injection vulnerability due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted URL, to execute arbitrary commands on the device. Note that Nessus has detected this...

Tenable Appliance vulnerable to cross-site scripting

Overview Tenable Appliance provided by Tenable, Inc. contains a stored cross-site scripting vulnerability CWE-79. Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

JVN#71255137: Tenable Appliance vulnerable to cross-site scripting

Tenable Appliance provided by Tenable, Inc. contains a stored cross-site scripting vulnerability CWE-79. Impact Arbitrary JavaScript may be executed on the user's web browser. Solution Update the Software Update to the latest version according to the information provided by the developer. Product...

Fedora 26 : 1:nodejs (2018-e672eaf4df)

https://nodejs.org/en/blog/release/v8.11.0/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Adobe Flash Player <= 29.0.0.113 (APSB18-08)

The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 29.0.0.113. It is therefore affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Debian DLA-1341-1 : sdl-image1.2 security update

Lilith of Cisco Talos discovered several buffer overflow vulnerabilities in the SDL Image library which can be leveraged by attackers to execute arbitrary code via specially crafted image files. For Debian 7 'Wheezy', these problems have been fixed in version 1.2.12-2+deb7u2. We recommend that yo...

Ubuntu 14.04 LTS / 16.04 LTS : Wayland vulnerability (USN-3622-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3622-1 advisory. It was discovered that the Wayland Xcursor support incorrectly handled certain files. An attacker could use these issues to cause Wayland to crash,...

Oracle Linux 6 : thunderbird (ELSA-2018-0647)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2018-0647 advisory. 52.7.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 52.7.0-1 - Update to 52.7.0 Tenable has extracted...