Ubuntu 12.10 : cinder vulnerability (USN-2208-1)

JuanFra Rodriguez Cardoso discovered that OpenStack Cinder did not enforce SSL connections when Nova was configured to use QPid and qpidprotocol is set to 'ssl'. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information. Ubunt...

Fedora 19 : varnish-3.0.5-1.fc19 (2013-24023)

New upstream release 3.0.5. List of changes available at https://www.varnish-cache.org/releases/varnish-cache-3.0.5 - Changed default mask for varnish log dir to 700, closing 915413 - Added a patch for CVE-2013-4484 from upstream, closing 1025128 Note that Tenable Network Security has extracted t...

Ubuntu 14.04 LTS : Linux kernel vulnerability (USN-2204-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2204-1 advisory. A flaw was discovered in the Linux kernel's pseudo tty pty device. An unprivileged user could exploit this flaw to cause a denial of service system crash or...

Ubuntu 12.10 : linux vulnerability (USN-2202-1)

A flaw was discovered in the Linux kernel's pseudo tty pty device. An unprivileged user could exploit this flaw to cause a denial of service system crash or potentially gain administrator privileges. Note that Tenable Network Security has extracted the preceding description block directly from th...

Fedora 20 : zabbix-2.0.11-3.fc20 (2014-5540)

The logrotate configuration had no su statement in 2.0.11-2. Furthermore, the log file should have been created as zabbixsrv:zabbix for the proxy and server, what they are now. http://www.zabbix.com/rn2.0.11.php Also solves 3 security issues : - ZBX-7703 fixed being able to switch users without...

Ubuntu 14.04 LTS : JBIG-KIT vulnerability (USN-2190-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2190-1 advisory. Florian Weimer discovered that JBIG-KIT incorrectly handled certain malformed images. If a user or automated system were tricked into processing a specially craft...

Fedora 20 : python-django-1.6.3-1.fc20 (2014-5503)

update to 1.6.3 fixing CVE-2014-0473 and CVE-2014-0474 update to 1.6.2 rhbz1027766 Please note, it is required to update python-django and python3-django as well in one transaction. yum update or dnf update will do that for you. Note that Tenable Network Security has extracted the preceding...

Oracle Linux 5 / 6 : thunderbird (ELSA-2014-0449)

The remote Oracle Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2014-0449 advisory. 24.5.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 24.5.0-1 - Update to 24.5.0 Tenable has...

Ubuntu 14.04 LTS : elfutils vulnerability (USN-2188-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2188-1 advisory. Florian Weimer discovered that the elfutils libdw library incorrectly handled malformed compressed debug sections in ELF files. If a user or automated system were...

Ubuntu 13.10 : indicator-datetime vulnerability (USN-2186-1)

It was discovered that the Date and Time Indicator incorrectly allowed Evolution to be opened at the greeter screen. An attacker could use this issue to possibly gain unexpected access to applications such as a web browser with privileges of the greeter user. Note that Tenable Network Security ha...

Fedora 19 : bugzilla-4.2.9-1.fc19 (2014-5414)

Previous versions of bugzilla had the following security issues : - The login form had no CSRF protection, meaning that an attacker could force the victim to log in using the attacker's credentials. - Dangerous control characters can be inserted into Bugzilla, notably into bug comments, which can...

Ubuntu 14.04 LTS : dpkg vulnerability (USN-2183-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2183-1 advisory. Jakub Wilk discovered that dpkg incorrectly certain paths and symlinks when unpacking source packages. If a user or an automated system were tricked into unpackin...

Fedora 20 : community-mysql-5.5.37-1.fc20 (2014-5369)

Update to MySQL 5.5.37, for various fixes described at http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-37.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and form...

Fedora 19 : syncevolution-1.4.1-1.fc19 (2014-5236)

Update to 1.4.1 stable release CVE-2014-1639 syncevolution: insecure temporary file usage in installcheck-local.sh It was found 1 that the installcheck-local.sh script of the syncevolution package creates temporary files in an insecure way. A local attacker could use these flaws to perform a...

Cisco IOS IKE Module DoS

The Cisco Internet Key Exchange IKE module has a denial of service vulnerability. According to its self-reported IOS version, the remote device may be affected by this vulnerability. The IKE module does not handle specially crafted main mode packets and can allow established IKE security...

Ubuntu 13.10 : linux vulnerabilities (USN-2179-1)

A flaw was discovered in the Kernel Virtual Machine KVM subsystem of the Linux kernel. A guest OS user could exploit this flaw to execute arbitrary code on the host OS. CVE-2014-0049 Al Viro discovered an error in how CIFS in the Linux kernel handles uncached write operations. An unprivileged loc...

Ubuntu 12.04 LTS : linux-lts-saucy vulnerabilities (USN-2177-1)

A flaw was discovered in the Kernel Virtual Machine KVM subsystem of the Linux kernel. A guest OS user could exploit this flaw to execute arbitrary code on the host OS. CVE-2014-0049 Al Viro discovered an error in how CIFS in the Linux kernel handles uncached write operations. An unprivileged loc...

Fedora 20 : syncevolution-1.4.1-1.fc20 (2014-5186)

Update to 1.4.1 stable release CVE-2014-1639 syncevolution: insecure temporary file usage in installcheck-local.sh It was found 1 that the installcheck-local.sh script of the syncevolution package creates temporary files in an insecure way. A local attacker could use these flaws to perform a...

Ubuntu 14.04 LTS : MySQL vulnerabilities (USN-2170-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2170-1 advisory. Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues. MySQL has been updated to...

Oracle Linux 6 : qemu-kvm (ELSA-2014-0420)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0420 advisory. - kvm-qcow2-Check-backingfileoffset-CVE-2014-0144.patch bz1079452 bz1079453 - kvm-qcow2-Check-refcount-table-size-CVE-2014-0144.patch bz1079452 bz10794...