HP LoadRunner < 12.50 Scenario File Local Code Execution

The version of HP LoadRunner installed on the remote host is prior to 12.50. It is, therefore, affected by a local code execution vulnerability due to an overflow condition that is triggered when handling scenario files .lrs. A local attacker can exploit this, via a specially crafted scenario fil...

SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nss (SUSE-SU-2015:1476-1)

Mozilla Firefox was updated to version 38.2.1 ESR to fix several critical and non critical security vulnerabilities. - Firefox was updated to 38.2.1 ESR bsc943608 - MFSA 2015-94/CVE-2015-4497 bsc943557 Use-after-free when resizing canvas element during restyling - MFSA 2015-95/CVE-2015-4498...

Ubuntu 15.04 : gnutls28 vulnerabilities (USN-2727-1)

It was discovered that GnuTLS incorrectly handled parsing CRL distribution points. A remote attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. CVE-2015-3308 Kurt Roeckx discovered that GnuTLS incorrectly handled a long DistinguishedName DN entry in a...

Oracle Linux 6 / 7 : jakarta-taglibs-standard (ELSA-2015-1695)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1695 advisory. - Resolves: CVE-2015-0254 - Apply correction for previous CVE-2015-0254 patch prevent XXE in - Resolves: CVE-2015-0254 Tenable has extracted the preceding...

Fedora 23 : mediawiki-1.25.2-2.fc23 (2015-13920)

T94116 SECURITY: Compare API watchlist token in constant time T97391 SECURITY: Escape error message strings in thumb.php T106893 SECURITY: Don't leak autoblocked IP addresses on Special:DeletedContributions T102562 Fix InstantCommons parameters to handle the new HTTPS-only policy of Wikimedia...

Oracle Linux 5 / 6 / 7 : firefox (ELSA-2015-1693)

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2015-1693 advisory. 38.2.1-1.0.1 - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat files 38.2.1-...

Fedora 22 : php-ZendFramework2-2.4.7-1.fc22 / php-guzzle-Guzzle-3.9.3-5.fc22 (2015-13529)

Zend Framework Upstream ChangeLogs: Version 2.4.7 Version 2.4.6 Version 2.4.5 Version 2.4.4 Version 2.4.3 Version 2.4.2 Version 2.4.1 Version 2.4.0 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

Debian DLA-301-1 : python-django security update

denial of service possibility in logout view by filling session store Previously, a session could be created when anonymously accessing the django.contrib.auth.views.logout view provided it wasn't decorated with django.contrib.auth.decorators.loginrequired as done in the admin. This could allow a...

SUSE SLED12 / SLES12 Security Update : p7zip (SUSE-SU-2015:1433-1)

This update fixes the following security issue : - CVE-2015-1038: directory traversal vulnerability bnc912878 This could for the overwriting of arbitrary files through uncompressing a crafted archive, with the privileges of the user running 7z Note that Tenable Network Security has extracted the...

Tenable SecurityCenter Multiple Apache Vulnerabilities (TNS-2015-11)

The Tenable SecurityCenter application installed on the remote host contains a bundled version of Apache HTTP Server prior to 2.4.16. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the chunked transfer coding implementation in httpfilters.c. due to a failure to...

SUSE SLED11 / SLES11 Security Update : glibc (SUSE-SU-2015:1424-1)

This update for glibc provides fixes for security and non-security issues. These security issues have been fixed : - CVE-2015-1781: Buffer length after padding in resolv/nssdns/dns-host.c. bsc927080 - CVE-2013-2207: ptchown did not properly check permissions for tty files, which allowed local use...

SUSE SLED11 / SLES11 Security Update : tiff (SUSE-SU-2015:1420-1)

tiff was updated to fix six security issues found by fuzzing initiatives. These security issues were fixed : - CVE-2014-8127: Out-of-bounds write bnc914890. - CVE-2014-8128: Out-of-bounds write bnc914890. - CVE-2014-8129: Out-of-bounds write bnc914890. - CVE-2014-8130: Out-of-bounds write...

Tenable SecurityCenter Alternative Certificate Validation Bypass Vulnerability (TNS-2015-08)

The SecurityCenter application installed on the remote host is affected by a certificate validation bypass vulnerability in the bundled OpenSSL library. The library is version 1.0.1n or later and prior to 1.0.1p. It is, therefore, affected by a flaw in the X509verifycert function that is triggere...

Fedora 21 : xfsprogs-3.2.2-2.fc21 (2015-12406)

Gabriel Vlasiu reported that xfsmetadump, part of the xfsprogs suite of tools for the XFS filesystem, did not properly obfuscate data. xfsmetadump properly obfuscates active metadata, but the rest of the space within that fs block comes through in the clear. This could lead to exposure of stale...

Fedora 21 : rubygems-2.2.5-100.fc21 (2015-13157)

Update to RubyGems 2.2.5. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenabl...

Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerability (USN-2717-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2717-1 advisory. Marcelo Ricardo Leitner discovered a race condition in the Linux kernel's SCTP address configuration lists when using Address Configuration Change ASCONF options ...

Ubuntu 14.04 LTS : Linux kernel vulnerability (USN-2716-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2716-1 advisory. Marcelo Ricardo Leitner discovered a race condition in the Linux kernel's SCTP address configuration lists when using Address Configuration Change ASCONF options ...

Oracle Linux 6 / 7 : net-snmp (ELSA-2015-1636)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1636 advisory. 1:5.5-54.0.1.el67.1 - Add Oracle ACFS to hrStorage John Haxby orabug 18510373 1:5.5-54.el67.1 - Fixed parsing of invalid variables in incoming packets 12484...

Fedora 23 : nagios-plugins-2.0.3-1.fc23 (2015-12853)

Update to 2.0.3 release to fix various CVE issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Oracle Linux 6 : sqlite (ELSA-2015-1634)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1634 advisory. 3.6.20-1.2 - Add patch for compiler warnings highlighted by rpmdiff. Related: rhbz1244727 3.6.20-1.el67.1 - fix for CVE-2015-3416 Resolves: 1244727 Tenable has...