Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-3051-1)

It was discovered that the keyring implementation in the Linux kernel did not ensure a data structure was initialized before referencing it after an error condition occurred. A local attacker could use this to cause a denial of service system crash. CVE-2016-4470 Kangjie Lu discovered an...

Fedora 24 : openssh (2016-4a3debc3a6)

Security fix for CVE-2016-6515 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

Oracle Linux 6 : qemu-kvm (ELSA-2016-1585)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-1585 advisory. - Resolves: bz1359724 EMBARGOED CVE-2016-5403 qemu-kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS rhel-6.8.z - Resolves:...

Oracle VirtualBox Unsupported Version Detection (Windows)

According to its self-reported version number, the installation of Oracle VirtualBox on the remote Windows host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilitie...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3591)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-3591 advisory. kernel-uek 3.8.13-118.9.2 - KEYS: potential uninitialized variable Dan Carpenter Orabug: 24393864 CVE-2016-4470 Tenable has extracted the preceding...

Fedora 24 : xen (2016-01cc766201) (Bunker Buster)

x86: Privilege escalation in PV guests XSA-182, CVE-2016-6258 x86: Missing SMAP whitelisting in 32-bit exception / event delivery XSA-183, CVE-2016-6259 virtio: unbounded memory allocation issue XSA-184, CVE-2016-5403 Qemu: scsi: esp: OOB write access in espdodma CVE-2016-6351 Note that Tenable...

Fedora 24 : python-autobahn (2016-acda4281c9)

Security fix for Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Debian DLA-583-1 : lighttpd security update

Dominic Scheirlinck and Scott Geary of Vend reported an insecure behaviour in the lighttpd web server. Lighttpd assigned Proxy header values from client requests to internal HTTPPROXY environment variables. This could be used to carry out Man in the Middle Attacks MIDM or create connections to...

Debian DLA-581-1 : libreoffice security update

Aleksandar Nikolic discovered that missing input sanitising in the RTF parser in Libreoffice may result in the execution of arbitrary code if a malformed documented is opened. For Debian 7 'Wheezy', these problems have been fixed in version 1:3.5.4+dfsg2-0+deb7u7. We recommend that you upgrade yo...

Oracle Linux 7 : libtiff (ELSA-2016-1546)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1546 advisory. - Add patches for CVEs: CVE-2015-7554, CVE-2015-8683, CVE-2015-8665, CVE-2015-8781, CVE-2015-8782, CVE-2015-8783, CVE-2015-8784 - Update patches for...

Oracle Linux 7 : kernel (ELSA-2016-1539)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1539 advisory. - security keys: potential uninitialized variable David Howells 1345935 1341352 CVE-2016-4470 - infiniband security: Restrict use of the write interfac...

Debian DLA-570-1 : kde4libs security update

It was possible to trick kde4libs's KArchiveDirectory::copyTo function to extract files to arbitrary system locations from a specially prepared tar file outside of the extraction folder. For Debian 7 'Wheezy', these problems have been fixed in version 4:4.8.4-4+deb7u2. We recommend that you upgra...

Debian DLA-569-1 : xmlrpc-epi security update

Integer signedness error in the simplestringaddn function in simplestring.c in xmlrpc-epi through 0.54.2 allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via a long first argument to the PHP xmlrpcencoderequest function. For...

Debian DLA-566-1 : cakephp security update

CakePHP, an open source web application framework for PHP, was vulnerable to SSRF Server Side Request Forgery attacks. Remote attacker can utilize it for at least DoS Denial of Service attacks, if the target application accepts XML as an input. It is caused by insecure design of Cake's Xml class...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2016-3588)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-3588 advisory. kernel-uek 3.8.13-118.9.1 - mlx4: Increase SYNCTPT command timeout Mukesh Kacker Orabug: 22895790 - neigh: do not modify unlinked entries Julian Anastasov...

Ubuntu 16.04 LTS : OpenJDK 8 vulnerabilities (USN-3043-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3043-1 advisory. Multiple vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity, and availability. An attacker could exploi...

Debian DLA-562-1 : gosa security update

GOsa² is a combination of system-administrator and end-user web interface, designed to handle LDAP based setups. A code injection vulnerability in the Samba plugin code of GOsa has been discovered. During Samba password changes it has been possible to inject malicious Perl code. If you upgrade...

Debian DLA-560-2 : cacti regression update

Three security issues have been found in cacti : CVE-2016-2313 authlogin.php allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database. CVE-2016-3172 A SQL injection vulnerability in tree.php allows remote...

Tenable SecurityCenter < 5.4.0 Multiple Vulnerabilities (TNS-2016-12)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is prior to 5.4.0. It is, therefore, affected by multiple vulnerabilities : - An arbitrary code execution vulnerability exists in the bundled version of libcurl due to using an insecure pat...

Fedora 24 : ca-certificates (2016-7527145931)

This is an update to the Mozilla CA certificates list version 2.8, which has been published as part of Mozilla NSS 3.25. As in previous versions of the ca-certificates package, the CA list has been modified to keep several legacy CAs still trusted for compatibility reasons. Please refer to...