Oracle Linux 6 : kernel (ELSA-2017-0293)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-0293 advisory. 2.6.32-642.13.2 - net dccp: fix freeing skb too early for IPV6RECVPKTINFO Hannes Frederic Sowa 1424626 1424628 CVE-2017-6074 Tenable has extracted the preceding...

Oracle Linux 7 : kernel (ELSA-2017-0294)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-0294 advisory. - 3.10.0-514.6.2.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3207-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3207-1 advisory. It was discovered that a use-after-free vulnerability existed in the block device layer of the Linux kernel. A local attacker could use this to cause a...

Ubuntu 12.04 LTS : linux, linux-ti-omap4 vulnerabilities (USN-3206-1)

It was discovered that a use-after-free vulnerability existed in the block device layer of the Linux kernel. A local attacker could use this to cause a denial of service system crash or possibly gain administrative privileges. CVE-2016-7910 Dmitry Vyukov discovered a use-after-free vulnerability ...

Ubuntu 14.04 LTS / 16.04 LTS : tcpdump vulnerabilities (USN-3205-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3205-1 advisory. It was discovered that tcpdump incorrectly handled certain packets. A remote attacker could use this issue to cause tcpdump to crash, resulti...

Ubuntu 16.10 : linux, linux-raspi2 vulnerabilities (USN-3209-1)

It was discovered that the generic SCSI block layer in the Linux kernel did not properly restrict write operations in certain situations. A local attacker could use this to cause a denial of service system crash or possibly gain administrative privileges. CVE-2016-10088 Jim Mattson discovered tha...

Ubuntu 14.04 LTS : Tomcat vulnerability (USN-3204-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3204-1 advisory. It was discovered that Tomcat incorrectly handled certain HTTP requests. A remote attacker could possibly use this issue to cause Tomcat to consume resources,...

Debian DLA-828-1 : gst-plugins-good0.10 security update

Two memory handling issues were found in gst-plugins-good0.10 : CVE-2016-10198 An invalid read can be triggered in the aacparse element via a maliciously crafted file. CVE-2017-5840 An out of bounds heap read can be triggered in the qtdemux element via a maliciously crafted file. For Debian 7...

Ubuntu 14.04 LTS / 16.04 LTS : Python Crypto vulnerability (USN-3199-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3199-1 advisory. It was discovered that the ALGnew function in blocktemplace.c in the Python Cryptography Toolkit contained a heap-based buffer overflow vulnerability....

Cris Thomas on Cyberwar Rhetoric

Cris Thomas of Tenable Networks, aka Space Rogue of the L0pht, talks to Mike Mimoso during RSA Conference about the rhetoric and hype surrounding cyberwar, as well as a quick trip down memory lane with the L0pht and its famous 1998 testimony before Congress. Download:...

Ubuntu 14.04 LTS : PHP vulnerabilities (USN-3196-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3196-1 advisory. It was discovered that PHP incorrectly handled certain arguments to the localegetdisplayname function. A remote attacker could use this issue to cause PH...

Tenable Nessus 6.x < 6.9 Multiple Vulnerabilities (TNS-2016-16) (SWEET32)

According to its self-reported version number, the Tenable Nessus application running on the remote host is 6.x prior to 6.9. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in the OpenSSL component in s3srvr.c, sslsess.c, and t1lib.c due to...

Fedora 24 : spice (2017-05793780f0)

Add upstream patches fixing CVE-2016-9577 and CVE-2016-9578 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additiona...

Fedora 25 : 2:vim (2017-595fec72ef)

The newest upstream commit, fixing CVE-2017-5953 vim: Tree length values not validated properly when handling a spell file Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean...

Fedora 25 : xen (2017-cdb53b04e0)

Qemu: net: mcffec: infinite loop while receiving data in mcffecreceive CVE-2016-9776 Qemu: audio: memory leakage in ac97 CVE-2017-5525 Qemu: audio: memory leakage in es1370 device CVE-2017-5526 oob access in cirrus bitblt copy XSA-208, CVE-2017-2615 Note that Tenable Network Security has extracte...

Fedora 25 : 14:tcpdump (2017-7ecbc90157)

Security fix for CVE-2016-7922, CVE-2016-7923, CVE-2016-7924, CVE-2016-7925, CVE-2016-7926, CVE-2016-7927, CVE-2016-7928, CVE-2016-7929, CVE-2016-7930, CVE-2016-7931, CVE-2016-7932, CVE-2016-7933, CVE-2016-7934, CVE-2016-7935, CVE-2016-7936, CVE-2016-7937, CVE-2016-7938, CVE-2016-7939,...

SUSE SLES11 Security Update : gd (SUSE-SU-2017:0459-1)

This update for gd fixes the following security issues : - CVE-2016-9317: The gdImageCreate function in the GD Graphics Library aka libgd allowed remote attackers to cause a denial of service system hang via an oversized image. bsc1022283 - CVE-2016-10167: A denial of service problem in...

Tenable Nessus 6.8.x and 6.9.x < 6.9.1 Stored XSS (TNS-2016-17)

According to its self-reported version number, the Tenable Nessus application running on the remote host is 6.8.x or 6.9.x prior to 6.9.1. It is, therefore, affected by a stored cross-site scripting XSS vulnerability due to improper validation of user-supplied input. An authenticated, remote...

Fedora 25 : w3m (2016-87dc28b1a0)

Rebase to latest upstream gitrev 20161120 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Oracle Linux 5 / 6 / 7 : java-1.7.0-openjdk (ELSA-2017-0269)

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0269 advisory. 1:1.7.0.131-2.6.9.0.0.1 - Add oracle-enterprise.patch - Fix DISTRONAME to 'Oracle Linux' 1:1.7.0.131-2.6.9.0 - Add blacklisted.certs to...