Fedora 27 : couchdb / erlang-jiffy (2017-a20d92573b)

CouchDB ver. 1.7.1 - Fixed CVE-2017-12635 - Fixed CVE-2017-12636 - Switched to eunit for testing - Erlang 20 compatible Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and...

Fedora 27 : python-sanic (2017-c15b709e32)

Update to 0.6.0 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Fedora 27 : xen (2017-4bfcd57172)

xen: various flaws 1518214 x86: infinite loop due to missing PoD error checking XSA-246 Missing p2m error checking in PoD code XSA-247 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

Fedora 27 : kernel (2018-21a7ad920c)

The 4.14.13 stable kernel update contains a number of important fixes across the tree. This is also the first update to contain some spectre mitigations. Some patches for variant 1 as well as the initial retpoline build for variant 2. These variant 2 mitigations will improve with further patches,...

Fedora 27 : wordpress (2017-f293e717e2)

Update to wordpress 4.8.3. See: https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/ for details Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format...

SUSE SLES11 Security Update : microcode_ctl (SUSE-SU-2018:0068-1) (Spectre)

Update to Intel microcode version 20180108 bsc1075262 CVE-2017-5715 - The pre-released microcode fixing some important security issues is now officially published and included in the added tarball. Among other updates it contains : - IVT C0 06-3e-04:ed 428-42a - SKL-U/Y D0 06-4e-03:c0 ba-c2 -...

Ubuntu 16.04 LTS : WebKitGTK+ vulnerabilities (USN-3530-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3530-1 advisory. It was discovered that speculative execution performed by modern CPUs could leak information through a timing side-channel attack, and that this could be...

Fedora 26 : firefox (2018-fb582aabcc)

Update to 57.0.4 - Security fixes to address the Meltdown and Spectre timing attacks - https://blog.mozilla.org/security/2018/01/03/mitigations -landing-new-class-timing-attack/ - Require new nss 3.34 fixed 1531031 - Disabled ARM on all Fedoras due to 1523912 Note that Tenable Network Security...

Ubuntu 16.04 LTS : SSSD vulnerability (USN-3526-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3526-1 advisory. It was discovered that SSSD incorrectly handled certain inputs when querying its local cache. An attacker could use this to inject arbitrary code and expose...

SUSE SLED12 / SLES12 Security Update : ImageMagick (SUSE-SU-2018:0055-1)

This update for ImageMagick fixes several issues. These security issues were fixed : - CVE-2017-1000476: A CPU exhaustion vulnerability was found in the function ReadDDSInfo in coders/dds.c, which allowed attackers to cause a denial of service bsc1074610. - CVE-2017-9409: The ReadMPCImage functio...

SUSE SLES11 Security Update : wireshark (SUSE-SU-2018:0054-1)

This update for wireshark to version 2.2.11 fixes several issues. These security issues were fixed : - CVE-2017-13767: The MSDP dissector could have gone into an infinite loop. This was addressed by adding length validation bsc1056248 - CVE-2017-13766: The Profinet I/O dissector could have crash...

Ubuntu 14.04 LTS / 16.04 LTS : NVIDIA graphics drivers vulnerability (USN-3521-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3521-1 advisory. Jann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel...

Oracle Linux 7 : libvirt (ELSA-2018-0029)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-0029 advisory. - qemu: Properly store microcode version in QEMU caps cache CVE-2017-5715 - util: add virFileReadHeaderQuiet wrapper around virFileReadHeaderFD CVE-2017-5715 -...

Virtuozzo 7 : crit / criu / criu-devel / ksm-vz / libcompel / etc (VZA-2018-003)

According to the versions of the crit / criu / criu-devel / ksm-vz / libcompel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies ...

Oracle Linux 6 : libvirt (ELSA-2018-0030)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-0030 advisory. - util: Implement virFileReadHeaderFD CVE-2017-5715 - util: add virFileReadHeaderQuiet wrapper around virFileReadHeaderFD CVE-2017-5715 - util: introduce...

Apple iTunes < 12.7.2 WebKit Multiple Vulnerabilities (credentialed check)

The version of Apple iTunes installed on the remote Windows host is prior to 12.7.2. It is, therefore, affected by multiple vulnerabilities in webkit as referenced in the HT208326 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-report...

Ubuntu 14.04 LTS / 16.04 LTS : Firefox vulnerabilities (USN-3516-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3516-1 advisory. It was discovered that speculative execution performed by modern CPUs could leak information through a timing side-channel attack, and that...

Oracle Linux 7 : microcode_ctl (ELSA-2018-0012)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2018-0012 advisory. 2.1-22.2 - Update Intel CPU microde for 06-3f-02, 06-4f-01, and 06-55-04 - Resolves: 1527358 2.1-22.1 - Update to upstream 2.1-13. Intel CPU microcode update to...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4001)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4001 advisory. - USB: serial: console: fix use-after-free after failed setup Johan Hovold Orabug: 27206830 CVE-2017-16525 - uwb: properly check kthreadrun return...

SUSE SLED12 / SLES12 Security Update : ucode-intel (SUSE-SU-2018:0006-1) (Spectre)

This update for ucode-intel fixes the following issues: The CPU microcode for Haswell-X, Skylake-X and Broadwell-X chipsets was updated to report both branch prediction control via CPUID flag and ability to control branch prediction via an MSR register. This update is part of a mitigation for a...