Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3575)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3575 advisory. kernel-uek 3.8.13-118.18.3 - dccp/tcp: do not inherit mclist from parent Eric Dumazet Orabug: 26108571 CVE-2017-8890 Tenable has extracted the preceding...

Microsoft Windows SMBv1 Multiple Vulnerabilities

The remote Windows host has Microsoft Server Message Block 1.0 SMBv1 enabled. It is, therefore, affected by multiple vulnerabilities : - Multiple information disclosure vulnerabilities exist in Microsoft Server Message Block 1.0 SMBv1 due to improper handling of SMBv1 packets. An unauthenticated,...

Ubuntu 14.04 LTS / 16.04 LTS : Firefox update (USN-3299-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3299-1 advisory. Some security information preloaded in Firefox was due to expire before the next scheduled release. This update bumps the expiration times. Tenable ha...

Ubuntu 14.04 LTS / 16.04 LTS : MiniUPnP vulnerability (USN-3298-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3298-1 advisory. It was discovered that MiniUPnP incorrectly handled memory. A remote attacker could use this issue to cause a denial of service or possibly execute...

Ubuntu 14.04 LTS / 16.04 LTS : jbig2dec vulnerabilities (USN-3297-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3297-1 advisory. Bingchang Liu discovered that jbig2dec incorrectly handled memory when decoding malformed image files. If a user or automated system were...

Debian DLA-951-1 : samba security update (SambaCry)

steelo discovered a remote code execution vulnerability in Samba, a SMB/CIFS file, print, and login server for Unix. A malicious client with access to a writable share, can take advantage of this flaw by uploading a shared library and then cause the server to load and execute it. For Debian 7...

SUSE SLES12 Security Update : samba (SUSE-SU-2017:1396-1) (SambaCry)

This update for samba fixes the following issue : - An unprivileged user with access to the samba server could cause smbd to load a specially crafted shared library, which then had the ability to execute arbitrary code on the server as 'root'. CVE-2017-7494, bso12780, bsc1038231 Note that Tenable...

SUSE SLED12 / SLES12 Security Update : pam (SUSE-SU-2017:1398-1)

This update for pam fixes the following issues : - CVE-2015-3238: pamunix in conjunction with SELinux allowed for DoS attacks bsc934920. - log a hint to syslog if /etc/nologin is present, but empty bsc1015565. - If /etc/nologin is present, but empty, log a hint to syslog. bsc1015565 - Added suppo...

SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2017:1387-1)

This update for java-171-ibm fixes the following issues: Version update to 7.1-4.5 bsc1038505 - CVE-2016-9840: zlib: Out-of-bounds pointer arithmetic in inftrees.c - CVE-2016-9841: zlib: Out-of-bounds pointer arithmetic in inffast.c - CVE-2016-9842: zlib: Undefined left shift of negative number -...

Oracle Linux 7 : kdelibs (ELSA-2017-1264)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-1264 advisory. 6:4.14.8-6 - KAuth: verify that whoever is calling us is actually who he says he is CVE-2017-8422 Resolves: CVE-2017-8422 Tenable has extracted the preceding...

SUSE SLED12 / SLES12 Security Update : libsndfile (SUSE-SU-2017:1367-1)

This update for libsndfile fixes the following issues : - CVE-2017-8361: Global buffer overflow in flacbuffercopy. bsc1036946 - CVE-2017-8362: Invalid memory read in flacbuffercopy. bsc1036943 - CVE-2017-8363: Heap-based buffer overflow in flacbuffercopy. bsc1036945 - CVE-2017-7585, CVE-2017-7741...

Debian DLA-949-1 : miniupnpc security update

It was discovered that there was a integer signedness error in the miniupnpc UPnP client that could allow remote attackers to cause a denial of service attack. For Debian 7 'Wheezy', this issue has been fixed in miniupnpc version 1.5-2+deb7u2. We recommend that you upgrade your miniupnpc packages...

Oracle Linux 7 : samba (ELSA-2017-1265)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-1265 advisory. 4.4.4-13 - resolves: 1437816 - Fix krb5 memory cache in libads sasl code - resolves: 1437741 - Fix CVE-2016-2125, CVE-2016-2126 and CVE-2017-2619 Tenab...

Ubuntu 12.04 LTS : FreeType vulnerabilities (USN-3282-2)

It was discovered that FreeType did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash, resulting in a denial of service, or possibly execute arbitrary code. Note that Tenable Network...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3291-2)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3291-2 advisory. USN-3291-1 fixed vulnerabilities in the generic Linux kernel. This update provides the corresponding updates for the Linux kernel built for specific...

Ubuntu 14.04 LTS / 16.04 LTS : QEMU vulnerabilities (USN-3289-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3289-1 advisory. Li Qiang discovered that QEMU incorrectly handled VirtFS directory sharing. A privileged attacker inside the guest could use this issue to...

Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerability (USN-3292-2)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3292-2 advisory. USN-3292-1 fixed a vulnerability in the Linux kernel for Ubuntu 16.10. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel...

Fedora 25 : lxterminal / menu-cache / pcmanfm (2017-6950ea5d05)

A potential security flaw is found on LXDE products, which create socket under /tmp with some predictable names, which may leads to DOS. The security flow on lxterminal is now assigned as CVE-2016-10369. Some other components also had similar issues. These new rpms should fix these issues. At lea...

Ubuntu 14.04 LTS : Linux kernel vulnerability (USN-3290-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3290-1 advisory. Marco Grassi discovered that the TCP implementation in the Linux kernel mishandles socket buffer skb truncation. A local attacker could use this to cause a denial...

Ubuntu 17.04 : linux, linux-raspi2 vulnerabilities (USN-3293-1)

Dmitry Vyukov discovered that KVM implementation in the Linux kernel improperly emulated the VMXON instruction. A local attacker in a guest OS could use this to cause a denial of service memory consumption in the host OS. CVE-2017-2596 Dmitry Vyukov discovered that the generic SCSI sg subsystem i...