Oracle Linux 7 : ruby (ELSA-2014-1912)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1912 advisory. - Fix REXML billion laughs attack via parameter entity expansion CVE-2014-8080. Resolves: rhbz1163998 - REXML incomplete fix for CVE-2014-8080...

Ubuntu 14.04 LTS : ClamAV vulnerabilities (USN-2423-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2423-1 advisory. Kurt Seifried discovered that ClamAV incorrectly handled certain JavaScript files. An attacker could possibly use this issue to cause ClamAV to crash,...

Ubuntu 14.04 LTS : Squid vulnerabilities (USN-2422-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2422-1 advisory. Sebastian Krahmer discovered that the Squid pinger incorrectly handled certain malformed ICMP packets. A remote attacker could possibly use this issue to...

Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-2416-1)

Don Bailey discovered a flaw in the LZO decompress algorithm used by the Linux kernel. An attacker could exploit this flaw to cause a denial of service memory corruption or OOPS. CVE-2014-4608 Andy Lutomirski discovered that the Linux kernel was not checking the CAPSYSADMIN when remounting...

Fedora 20 : libvirt-1.1.3.8-1.fc20 (2014-15228)

Rebased to version 1.1.3.8 - CVE-2014-3633: out-of-bounds read in blockiotune bz 1160823 - CVE-2014-3657: Potential deadlock in domainconf bz 1160824 - CVE-2014-7823: information leak with migratable flag bz 1160822 Note that Tenable Network Security has extracted the preceding description block...

Fedora 20 : facter-1.7.6-1.fc20 (2014-12699)

Update to 1.7.6 for bz1107891 and CVE-2014-3248 See http://puppetlabs.com/security/cve/CVE-2014-3248 for more information upstream. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically...

Fedora 21 : kernel-3.17.3-300.fc21 (2014-15159)

Latest upstream stable release, Linux v3.17.3. A wide variety of fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible witho...

Fedora 19 : kernel-3.14.23-100.fc19 (2014-14068)

The 3.14.23 stable update contains a number of important fixes across the tree. Various security fixes for KVM and SCTP Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

Fedora 19 : konversation-1.5.1-1.fc19 (2014-13702)

Konversation 1.5.1 is a maintenance release containing only bug fixes. The included changes address several minor behavioral defects and a low-risk DoS security defect in the Blowfish ECB support. See also: https://konversation.kde.org/ Note that Tenable Network Security has extracted the precedi...

Ubuntu 14.04 LTS : libvirt vulnerabilities (USN-2404-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2404-1 advisory. Pavel Hrdina discovered that libvirt incorrectly handled locking when processing the virConnectListAllDomains command. An attacker could use this issue t...

Ubuntu 14.04 LTS : OpenStack Nova vulnerabilities (USN-2407-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2407-1 advisory. Garth Mollett discovered that OpenStack Nova did not properly clean up an instance when using rescue mode with the VMWare driver. A remove authenticated...

Ubuntu 14.04 LTS : OpenStack Cinder vulnerabilities (USN-2405-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2405-1 advisory. Duncan Thomas discovered that OpenStack Cinder did not properly track the file format when using the GlusterFS of Smbfs drivers. A remote authenticated...

Fedora 20 : Pound-2.6-8.fc20 (2014-13777)

Backport various security fixes. Note they usually are extra options that need to be enabled manually so that we won't break functionality : - CVE-2011-3389: Make it possible to deny use of 'BEAST' vulnerable ciphers - CVE-2012-4929: Disable compression to be safe from 'CRIME' - CVE-2005-2090:...

Fedora 19 : php-ZendFramework2-2.2.8-2.fc19 (2014-14043)

Security Fixes - ZF2014-05: Due to an issue that existed in PHP's LDAP extension, it is possible to perform an unauthenticated simple bind against a LDAP server by using a null byte for the password, regardless of whether or not the user normally requires a password. We have provided a patch in...

Fedora 21 : curl-7.37.0-9.fc21 (2014-14338)

fix handling of CURLOPTCOPYPOSTFIELDS in curleasyduphandle CVE-2014-3707 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 21 : golang-1.3.3-1.fc21 (2014-14130)

update to go1.3.3 bz1146882 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Ubuntu 14.04 LTS : curl vulnerability (USN-2399-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2399-1 advisory. Symeon Paraschoudis discovered that curl incorrectly handled memory when being used with CURLOPTCOPYPOSTFIELDS and curleasyduphandle. This may result in sensitive...

Fedora 21 : freeipa-4.1.1-1.fc21 / slapi-nis-0.54.1-1.fc21 (2014-14427)

freeipa : - Update to upstream 4.1.1 - see http://www.freeipa.org/page/Releases/4.1.1 - fix CVE-2014-7828 slapi-nis : - support FreeIPA overrides in LDAP BIND callback - ignore FreeIPA override searchs outside configured schema compat subtrees Note that Tenable Network Security has extracted the...

Fedora 21 : qemu-2.1.2-6.fc21 (2014-13993)

CVE-2014-7815 vnc: insufficient bitsperpixel from the client sanitization bz 1157647, bz 1157641 - CVE-2014-3689 vmwarevga: insufficient parameter validation in rectangle functions bz 1153038, bz 1153035 Fix dep on numactl-devel to be build time not install time Note that Tenable Network Security...

RHEL 6 : rhev-hypervisor6 (RHSA-2012:1200)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2012:1200 advisory. The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization...