UPnP API Listing

According to its UPnP data, the remote device supports a SOAP API over UPnP. Nessus was able to retrieve and parse the UPnP Service Control Protocol Document XML. TRUSTED...

Ubuntu 16.04 LTS : Tracker vulnerability (USN-3101-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3101-1 advisory. It was discovered that Tracker incorrectly handled certain malformed GIF images. If a user or automated system were tricked into downloading a specially-crafted G...

SUSE SLED12 / SLES12 Security Update : X Window System client libraries (SUSE-SU-2016:2505-1)

This update for the X Window System client libraries fixes a class of privilege escalation issues. A malicious X Server could send specially crafted data to X clients, which allowed for triggering crashes, or privilege escalation if this relationship was untrusted or crossed user or permission...

Fedora 24 : libdwarf (2016-328754be1c)

Update to 20160929 upstream release Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Fedora 24 : libXfixes (2016-ff5a2f4839)

Security fix for CVE-2016-7944 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

SUSE SLED12 Security Update : libreoffice (SUSE-SU-2016:2472-1)

LibreOffice was updated to version 5.1.5.2, bringing enhancements and bug fixes. - CVE-2016-4324: Parsing the Rich Text Format character style index was insufficiently checked for validity. Documents could be constructed which dereference an iterator to the first entry of an empty STL container...

Debian DLA-648-1 : c-ares security update

Gzob Qq discovered that the query-building functions in c-ares, an asynchronous DNS request library would not correctly process crafted query names, resulting in a heap buffer overflow and potentially leading to arbitrary code execution. For Debian 7 'Wheezy', these problems have been fixed in...

Fedora 23 : curl (2016-80f4f71eff)

reject negative string lengths in curleasyunescape CVE-2016-7167 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Oracle Linux 6 : kernel (ELSA-2016-2006)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2006 advisory. - net tcp: make challenge acks less predictable Florian Westphal 1355606 1355607 CVE-2016-5696 - usbhid hiddev: validate numvalues for HIDIOCGUSAGES,...

Debian DLA-644-1 : libav security update

Multiple vulnerabilities have been found in libav : CVE-2015-1872 The ffmjpegdecodesof function in libavcodec/mjpegdec.c in Libav before 0.8.18 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service out-of-bounds...

Ubuntu 14.04 LTS / 16.04 LTS : PHP vulnerabilities (USN-3095-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3095-1 advisory. Taoguang Chen discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue...

Debian DLA-641-1 : ruby-activesupport-3.2 security update

Active Support in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters. For Debian 7 'Wheezy', these problems...

Oracle Linux 6 / 7 : python-twisted-web (ELSA-2016-1978)

The remote Oracle Linux 6 / 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2016-1978 advisory. 8.2.0-5 - Rebase HTTPoxy patch and bump release for rebuild Resolves: rhbz1358789 8.2.0-4 - Fix HTTPoxy CVE-2016-1000111 Resolves: rhbz1358789 Tenable has...

SUSE SLES11 Security Update : postgresql94 (SUSE-SU-2016:2418-1)

This update for postgresql94 to version 9.4.9 fixes the several issues. These security issues were fixed : - CVE-2016-5423: CASE/WHEN with inlining can cause untrusted pointer dereference bsc993454. - CVE-2016-5424: Fix client programs' handling of special characters in database and role names...

Ubuntu 16.04 LTS : Systemd vulnerability (USN-3094-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3094-1 advisory. Andrew Ayer discovered that Systemd improperly handled zero-length notification messages. A local unprivileged attacker could use this to cause a denial of servic...

Oracle Linux 5 : bind97 (ELSA-2016-1945)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-1945 advisory. - Fix CVE-2016-2776 - Fix CVE-2016-1285 and CVE-2016-1286 - Fix CVE-2015-8704 - Fix CVE-2015-8000 - Fix CVE-2015-5722 - Fix CVE-2015-5477 Tenable has extracted...

Ubuntu 14.04 LTS : Pillow vulnerabilities (USN-3090-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3090-1 advisory. It was discovered that a flaw in processing a compressed text chunk in a PNG image could cause the image to have a large size when decompressed,...

Ubuntu 14.04 LTS / 16.04 LTS : Bind vulnerability (USN-3088-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3088-1 advisory. It was discovered that Bind incorrectly handled building responses to certain specially crafted requests. A remote attacker could possibly use this...

SUSE SLED12 / SLES12 Security Update : bind (SUSE-SU-2016:2399-1)

The nameserver bind was updated to fix a remote denial of service vulnerability, where a crafted packet could cause the nameserver to abort. CVE-2016-2776, bsc1000362 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable...

Oracle Linux 5 : kvm (ELSA-2016-1943)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1943 advisory. - Resolves: bz1359723 CVE-2016-5403 kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS rhel-5.11.z -...