Ubuntu 14.04 LTS : Linux kernel vulnerability (USN-3250-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3250-1 advisory. It was discovered that the xfrm framework for transforming packets in the Linux kernel did not properly validate data received from user space. A local attacker...

Ubuntu 14.04 LTS / 16.04 LTS : Oxide vulnerabilities (USN-3236-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3236-1 advisory. Multiple vulnerabilities were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could...

Debian DLA-878-1 : libytnef security update

CVE-2017-6298 NULL pointer Deref / calloc return value not checked CVE-2017-6299 Infinite Loop / DoS in the TNEFFillMapi function in lib/ytnef.c CVE-2017-6300 Buffer Overflow in version field in lib/tnef-types.h CVE-2017-6301 Out of Bounds Reads CVE-2017-6302 Integer Overflow CVE-2017-6303 Invali...

Oracle Linux 6 : libguestfs (ELSA-2017-0564)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-0564 advisory. 1:1.20.11-20 - inspection: fix detection of /usr in separate partition resolves: rhbz1388407 1:1.20.11-19 - libguestfs-java: bump the java Require to = 1.7.0,...

Oracle Linux 6 : bash (ELSA-2017-0725)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0725 advisory. - CVE-2016-9401 - Fix crash when '-' is passed as second sign to popd Resolves: 1396383 - CVE-2016-7543 - Fix for arbitrary code execution via...

Ubuntu 14.04 LTS / 16.04 LTS : GStreamer Base Plugins vulnerabilities (USN-3244-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3244-1 advisory. Hanno Bck discovered that GStreamer Base Plugins did not correctly handle certain malformed media files. If a user were tricked into opening ...

Debian DLA-874-1 : jbig2dec security update

Multiple security issues have been found in the JBIG2 decoder library, which may lead to lead to denial of service or the execution of arbitrary code if a malformed image file usually embedded in a PDF document is opened. For Debian 7 'Wheezy', these problems have been fixed in version...

Fedora 25 : kernel (2017-90aaa5bd24)

The 4.10.5 stable kernel update contains a number of important fixes across the tree. ---- The 4.10.4 stable kernel update contains a number of important fixes across the tree. It also reverts CONFIGCFG80211CRDASUPPORT to match the previous 4.9 kernels. ---- The 4.10.3 kernel rebase contains a...

Tenable Nessus Privilege Escalation Vulnerability

Tenable Nessus is prone to a local privilege escalation vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Ubuntu 14.04 LTS / 16.04 LTS : GStreamer Good Plugins vulnerabilities (USN-3245-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3245-1 advisory. Hanno Bck discovered that GStreamer Good Plugins did not correctly handle certain malformed media files. If a user were tricked into opening ...

Virtuozzo 6 : parallels-server-bm-release / pfcache / ploop / etc (VZA-2017-003)

According to the version of the parallels-server-bm-release / pfcache / ploop / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerability : - A vulnerability within vzpkg could allow a malicious user to perform a basic symlink attack resultin...

Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2017-009)

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - Possible crash in memcpyfromiovecend triggered from inside container. - Improved isolation for neighbor...

Virtuozzo 7 : readykernel-patch (VZA-2017-007)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - A double free vulnerability was found in netlinkdump, which could cause a denial of service or possibly other...

Ubuntu 14.04 LTS / 16.04 LTS : Samba vulnerability (USN-3242-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3242-1 advisory. Jann Horn discovered that Samba incorrectly handled symlinks. An authenticated remote attacker could use this issue to access files on the server...

Ubuntu 14.04 LTS : Git vulnerability (USN-3243-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3243-1 advisory. It was discovered that Git incorrectly sanitized branch names in the PS1 variable when configured to display the repository status in the shell prompt. If a user...

Ubuntu 14.04 LTS : audiofile vulnerabilities (USN-3241-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3241-1 advisory. Agostino Sarubbo discovered that audiofile incorrectly handled certain malformed audio files. If a user or automated system were tricked into processing ...

HPE LoadRunner < 12.53 Patch 4 libxdrutil.dll mxdr_string() RCE

The version of HP LoadRunner installed on the remote Windows host is prior to 12.53 patch 4. It is, therefore, affected by a remote code execution vulnerability due to a heap-based buffer overflow condition in the mxdrstring function in libxdrutil.dll. An unauthenticated, remote attacker can...

Tenable Log Correlation Engine (LCE) < 4.8.1 Multiple Vulnerabilities

The version of Tenable Log Correlation Engine LCE installed on the remote host is prior to 4.8.1. It is, therefore, affected by the following vulnerabilities : - Multiple cross-site scripting XSS vulnerabilities exist in the Handlebars library in the lib/handlebars/utils.js script due to a failur...

Ubuntu 14.04 LTS / 16.04 LTS : GNU C Library Regression (USN-3239-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3239-2 advisory. USN-3239-1 fixed vulnerabilities in the GNU C Library. Unfortunately, the fix for CVE-2015-5180 introduced an internal ABI change within the resolver...

Fedora 25 : knot-resolver (2017-df53d02da7)

new upstream release + security: Knot Resolver 1.2.0 and higher could return AD flag for insecure answer if the daemon received answer with invalid RRSIG several times in a row. + fix: layer/iterate: some improvements in cname chain unrolling + fix: layer/validate: fix duplicate records in...