Ubuntu 14.04 LTS : Linux kernel vulnerability (USN-3149-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3149-1 advisory. Philip Pettersson discovered a race condition in the afpacket implementation in the Linux kernel. A local unprivileged attacker could use this to cause a denial o...

Ubuntu 16.04 LTS : Linux kernel (Qualcomm Snapdragon) vulnerability (USN-3151-3)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3151-3 advisory. Philip Pettersson discovered a race condition in the afpacket implementation in the Linux kernel. A local unprivileged attacker could use this to cause a denial o...

Oracle Linux 5 / 6 / 7 : thunderbird (ELSA-2016-2850)

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2016-2850 advisory. 45.5.1-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 45.5.1-1 - Update to 45.5.1 Tenable has extracted t...

Fedora 25 : xen (2016-999e1a6927)

xen : various security flaws 1397383 x86 null segments not always treated as unusable XSA-191, CVE-2016-9386 x86 task switch to VM86 mode mis-handled XSA-192, CVE-2016-9382 x86 segment base write emulation lacking canonical address checks XSA-193, CVE-2016-9385 guest 32-bit ELF symbol table load...

Debian DLA-733-1 : openafs security update

It was discovered that there was an information leak vulnerability in openafs, a distributed filesystem. Due to incomplete initialization or clearing of reused memory, OpenAFS directory objects are likely to contain 'dead' directory entry information. For Debian 7 'Wheezy', this issue has been...

Fedora 23 : xen (2016-68b71978a1)

xen : various security flaws 1397383 x86 null segments not always treated as unusable XSA-191, CVE-2016-9386 x86 task switch to VM86 mode mis-handled XSA-192, CVE-2016-9382 x86 segment base write emulation lacking canonical address checks XSA-193, CVE-2016-9385 x86 64-bit bit test instruction...

Debian DLA-731-2 : imagemagick regression update

The update for imagemagick issued as DLA-731-1 caused regressions when decoding properties of certain images. Updated packages are now available to address this problem. For reference, the original advisory text follows. Several issues have been discovered in ImageMagick, a popular set of program...

Mozilla Thunderbird < 45.5.1 nsSMILTimeContainer.cpp SVG Animation RCE (macOS)

The version of Mozilla Thunderbird installed on the remote macOS or Mac OS X host is prior to 45.5.1. It is, therefore, affected by a use-after-free error in dom/smil/nsSMILTimeContainer.cpp when handling SVG animations. An unauthenticated, remote attacker can exploit this issue, via a specially...

Mozilla Firefox < 50.0.2 nsSMILTimeContainer.cpp SVG Animation RCE (macOS)

The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 50.0.2. It is, therefore, affected by a use-after-free error in dom/smil/nsSMILTimeContainer.cpp when handling SVG animations. An unauthenticated, remote attacker can exploit this issue, via a specially...

Ubuntu 14.04 LTS / 16.04 LTS : ImageMagick vulnerabilities (USN-3142-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3142-1 advisory. It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3146-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3146-1 advisory. It was discovered that the getuserasmex implementation in the Linux kernel for x86/x8664 contained extended asm statements that were incompatible with th...

Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3146-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3146-2 advisory. USN-3146-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enableme...

Ubuntu 14.04 LTS / 16.04 LTS : c-ares vulnerability (USN-3143-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3143-1 advisory. Gzob Qq discovered that c-ares incorrectly handled certain hostnames. A remote attacker could use this issue to cause applications using c-ares to...

SUSE SLES11 Security Update : vim (SUSE-SU-2016:2938-1)

This update for vim fixes the following security issues : - Fixed CVE-2016-1248, an arbitrary command execution vulnerability bsc1010685 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automaticall...

Debian DLA-724-1 : mcabber security update

It was discovered that there was a 'roster push attack' 0 in mcabber, a console-based Jabber XMPP client. For Debian 7 'Wheezy', this issue has been fixed in mcabber version 0.10.1-3+deb7u1. We recommend that you upgrade your mcabber packages. 0...

Ubuntu 14.04 LTS / 16.04 LTS : GStreamer Good Plugins vulnerability (USN-3135-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3135-2 advisory. USN-3135-1 fixed a vulnerability in GStreamer Good Plugins. The original security fix was incomplete. This update fixes the problem. Tenable has...

Debian DLA-722-1 : irssi security update

An information disclosure vulnerability was found in irssi. CVE-2016-7553 Other users on the same machine as the user running irssi with buf.pl loaded may be able to retrieve the whole window contents after /UPGRADE. Furthermore, this dump of the windows contents is never removed afterwards. For...

SUSE SLED12 / SLES12 Security Update : sudo (SUSE-SU-2016:2893-1)

This update for sudo fixes the following issues : - fix two security vulnerabilities that allowed users to bypass sudo's NOEXEC functionality : - noexec bypass via system and popen CVE-2016-7032, bsc1007766 - noexec bypass via wordexp CVE-2016-7076, bsc1007501 Note that Tenable Network Security h...

Fedora 24 : perl-DBD-MySQL (2016-54fd3bf412)

Security fix for CVE-2016-1249 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

SUSE SLED12 / SLES12 Security Update : tar (SUSE-SU-2016:2896-1)

This update for tar fixes the following issues : - Fix the POINTYFEATHER vulnerability - GNU tar archiver can be tricked into extracting files and directories in the given destination, regardless of the path names specified on the command line bsc1007188 CVE-2016-6321 - Fix Amanda integration iss...