Oracle Linux 6 / 7 : thunderbird (ELSA-2017-2534)

The remote Oracle Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2017-2534 advisory. 52.3.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 52.3.0-1 - Update to 52.3.0 52.2.1-1 - Update ...

Fedora 26 : kernel (2017-4336d64e21)

The 4.12.8 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Fedora 25 : kernel (2017-73f71456d7)

The 4.12.8 stable kernel update contains a number of important fixes across the tree. ---- The 4.12.5 kernel rebase contains new features and many bug fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

SUSE SLES11 Security Update : freeradius-server (SUSE-SU-2017:2244-1)

This update for freeradius-server fixes the following issues: Security issues fixed : - CVE-2017-10981: DHCP - Fix memory leak in frdhcpdecode. bnc1049086 - CVE-2017-10982: Fix buffer over-read in frdhcpdecodeoptions. bsc1049086 - CVE-2017-10983: Fix read overflow when decoding option 63...

SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2017:2243-1)

This update for freeradius fixes the following issues: Security issues fixed : - CVE-2017-10988: Decode 'signed' attributes correctly. bnc1049086 - CVE-2017-10987: Check for option overflowing the packet. bnc1049086 - CVE-2017-10985: Fix infinite loop and memory exhaustion with 'concat' attribute...

Juniper Junos snmpd SNMP Packet Handling RCE (JSA10793)

According to its self-reported version number and configuration, the remote Juniper Junos device is affected by a remote code execution vulnerability in the snmpd daemon due to improper handling of SNMP packets. An unauthenticated, remote attacker can exploit this, via a specially crafted SNMP...

Juniper Junos rpd MPLS Ping Packet Handling DoS (JSA10795)

According to its self-reported version number and configuration, the remote Juniper Junos device is affected by a denial of service vulnerability in the rpd daemon due to improper handling of MPLS ping packets. An unauthenticated, remote attacker can exploit this, via a specially crafted MPLS pin...

Ubuntu 14.04 LTS / 16.04 LTS : TeX Live vulnerability (USN-3401-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3401-1 advisory. It was discovered that TeX Live incorrectly handled certain system commands. If a user were tricked into processing a specially crafted TeX file, a...

Ubuntu 14.04 LTS / 16.04 LTS : strongSwan vulnerability (USN-3397-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3397-1 advisory. It was discovered that strongSwan incorrectly handled verifying specific RSA signatures. A remote attacker could use this issue to cause strongSwan to...

Debian DLA-1063-1 : extplorer security update

CVE-2017-12756 Fix command inject in transfer from another server in extplorer 2.1.9 and prior allows attacker to inject command via the userfile0 parameter. For Debian 7 'Wheezy', these problems have been fixed in version 2.1.0b6+dfsg.3-4+deb7u5. We recommend that you upgrade your extplorer...

Fedora 26 : bodhi (2017-48f0384090)

Update to 2.9.1, which addresses CVE-2017-1002152. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2017-3607)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3607 advisory. - l2tp: fix racy SOCKZAPPED flag check in l2tpip,6bind Guillaume Nault Orabug: 26586050 CVE-2016-10200 - xfs: fix two memory leaks in xfsattrlist.c...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3605)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3605 advisory. - dentry name snapshots Al Viro Orabug: 26630936 CVE-2017-7533 - KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings David...

SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2017:2202-1)

This update for freeradius-server fixes the following issues : - update to 3.0.15 bsc1049086 - Bind the lifetime of program name and python path to the module - CVE-2017-10978: FR-GV-201: Check input / output length in makesecret bsc1049086 - CVE-2017-10983: FR-GV-206: Fix read overflow when...

SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:2175-1)

This java-180-openjdk update to version jdk8u141 icedtea 3.5.0 fixes the following issues: Security issues fixed : - CVE-2017-10053: Improved image post-processing steps bsc1049305 - CVE-2017-10067: Additional jar validation steps bsc1049306 - CVE-2017-10074: Image conversion improvements...

Oracle Linux 6 : httpd (ELSA-2017-2478)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2478 advisory. - Resolves: 1463194 - CVE-2017-3167 httpd: apgetbasicauthpw authentication bypass - Resolves: 1463197 - CVE-2017-3169 httpd: modssl NULL pointer...

Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) regression (USN-3392-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3392-2 advisory. USN-3392-1 fixed a regression in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kerne...

Ubuntu 16.04 LTS : Linux kernel regression (USN-3392-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3392-1 advisory. USN-3378-1 fixed vulnerabilities in the Linux kernel. Unfortunately, a regression was introduced that prevented conntrack from working correctly in some situation...

Debian DLA-1058-1 : krb5 security update

In MIT Kerberos 5 aka krb5 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests. For Debian 7 'Wheezy', these problems have been fixed in version 1.10.1+dfsg-5+deb7u8. We recommend that you upgrade your krb5 packages. NOTE:...

Ubuntu 14.04 LTS / 16.04 LTS : GD vulnerability (USN-3389-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3389-1 advisory. A vulnerability was discovered in GD Graphics Library aka libgd, as used in PHP that does not zero colorMap arrays before use. A specially crafted GIF...