Sun Java JRE / Web Start Java Plug-in Untrusted Applet Privilege Escalation (Unix)

The remote host is using an unmanaged version of Sun Java Runtime Environment that has vulnerabilities in its Java Runtime Plug-in, a web browser add-on used to display Java applets. The JRE Plug-in security can be bypassed by tricking a user into viewing a maliciously crafted web page...

Ubuntu 12.04 LTS / 12.10 : keystone vulnerabilities (USN-1730-1)

Nathanael Burton discovered that Keystone did not properly verify disabled users. An authenticated but disabled user would continue to have access rights that were removed. CVE-2013-0282 Jonathan Murray discovered that Keystone would allow XML entity processing. A remote unauthenticated attacker...

Fedora 17 : rubygem-activemodel-3.0.11-3.fc17 (2013-2391)

Fix for CVE-2013-0276. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Fedora 17 : rubygem-activerecord-3.0.11-6.fc17 (2013-2351)

Fix for CVE-2013-0277. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Fedora 17 : dnsmasq-2.65-4.fc17 (2013-1320)

From dnsmasq's CHANGELOG : Add code to make behaviour for TCP DNS requests that same as for UDP requests, when a request arrives for an allowed address, but via a banned interface. This change is only active on Linux, since the relevant API is missing AFAIK on other platforms. - dnsmasq now answe...

Fedora 18 : kernel-3.7.8-202.fc18 (2013-2635)

CVE-2013-0290 net: infinite loop in skbrecvdatagram Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Ubuntu 10.04 LTS / 11.10 : jquery vulnerability (USN-1722-1)

It was discovered that jQuery incorrectly handled selecting elements using location.hash, resulting in a possible cross-site scripting XSS issue. With cross-site scripting vulnerabilities, if a user were tricked into viewing a specially crafted page, a remote attacker could exploit this to modify...

Fedora 18 : dnsmasq-2.65-4.fc18 (2013-1357)

From dnsmasq's CHANGELOG : Add code to make behaviour for TCP DNS requests that same as for UDP requests, when a request arrives for an allowed address, but via a banned interface. This change is only active on Linux, since the relevant API is missing AFAIK on other platforms. - dnsmasq now answe...

Ubuntu 10.04 LTS : linux-lts-backport-oneiric vulnerabilities (USN-1719-1)

It was discovered that hypervkvpd, which is distributed in the Linux kernel, was not correctly validating the origin on Netlink messages. An untrusted local user can cause a denial of service of Linux guests in Hyper-V virtualization environments. CVE-2012-2669 Dmitry Monakhov reported a race...

Ubuntu 11.10 : linux vulnerabilities (USN-1720-1)

It was discovered that hypervkvpd, which is distributed in the Linux kernel, was not correctly validating the origin on Netlink messages. An untrusted local user can cause a denial of service of Linux guests in Hyper-V virtualization environments. CVE-2012-2669 Dmitry Monakhov reported a race...

Netstat Connection Information

The remote host has listening ports or established connections that Nessus was able to extract from the results of the 'netstat' command. Note: The output for this plugin can be very long, and is not shown by default. To display it, enable verbose reporting in scan settings. C Tenable Network...

MS13-016: Vulnerabilities in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778344)

The Windows kernel on the remote host has several race condition vulnerabilities. A local attacker could exploit any of these vulnerabilities to elevate privileges. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid64577; scriptversion"1.11"; scriptcvsdate"Date:...

Fedora 18 : java-1.7.0-openjdk-1.7.0.9-2.3.5.3.fc18 (2013-2205)

The update contains the following security fixes : - S6563318, CVE-2013-0424: RMI data sanitization - S6664509, CVE-2013-0425: Add logging context - S6664528, CVE-2013-0426: Find log level matching its name or value given at construction time - S6776941: CVE-2013-0427: Improve thread pool shutdow...

Fedora 18 : freetype-2.4.10-3.fc18 (2013-1492)

This update fixes CVE-2012-5669. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

Fedora 16 : jakarta-commons-httpclient-3.1-12.fc16 (2013-1289)

This update fixes a security vulnerability that caused jakarta-commons-httpclient not to verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allowed man-in-the-middle attackers to spoof SSL servers via...

Fedora 17 : axis-1.4-19.fc17 (2013-1194)

This update fixes a security vulnerability that caused axis not to verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allowed man-in-the-middle attackers to spoof SSL servers via andaarbitrary valid...

Fedora 17 : seamonkey-2.15.1-1.fc17 (2013-1382)

Update to 2.15.1 Update to 2.15 Fixes CVE-2013-0743, CVE-2013-0744-0760, CVE-2013-0762, CVE-2013-0764, CVE-2013-0766-0770 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and...

Fedora 18 : jakarta-commons-httpclient-3.1-12.fc18 (2013-1203)

This update fixes a security vulnerability that caused jakarta-commons-httpclient not to verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allowed man-in-the-middle attackers to spoof SSL servers via...

Fedora 18 : ettercap-0.7.5.1-1.fc18 (2013-0899)

Fix for CVE-2013-0722 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Fedora 17 : asterisk-10.12.0-1.fc17 (2013-0994)

The Asterisk Development Team has announced the release of Asterisk 10.12.0. This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk The release of Asterisk 10.12.0 resolves several issues reported by the community and would have not been possible...