openSUSE Security Update : sudo (openSUSE-2021-602)

This update for sudo fixes the following issues : - L3: Tenable Scan reports sudo is vulnerable to CVE-2021-3156 bsc1183936 This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

EulerOS 2.0 SP8 : python-pygments (EulerOS-SA-2021-1887)

According to the versions of the python-pygments packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a...

EulerOS 2.0 SP5 : PyYAML (EulerOS-SA-2021-1912)

According to the version of the PyYAML package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes...

EulerOS 2.0 SP8 : git (EulerOS-SA-2021-1870)

According to the version of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as...

EulerOS 2.0 SP8 : libtiff (EulerOS-SA-2021-1880)

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A specially crafted TIFF file...

SUSE SLES12 Security Update : python3 (SUSE-SU-2021:1621-1)

This update for python3 fixes the following issues : Security issues fixed : CVE-2020-27619: where Lib/test/multibytecodecsupport calls eval on content retrieved via HTTP. bsc1178009 Other fixes : Make sure to close the 'importfailed.map' file after the exception has been raised in order to avoid...

Debian DLA-2663-1 : libimage-exiftool-perl security update

A vulnerability was discovered in libimage-exiftool-perl, a library and program to read and write meta information in multimedia files, which may result in execution of arbitrary code if a malformed DjVu file is processed. For Debian 9 stretch, this problem has been fixed in version 10.40-1+deb9u...

SUSE SLED15 / SLES15 Security Update : dtc (SUSE-SU-2021:1598-1)

This update for dtc fixes the following issues : make all packaged binaries PIE-executables bsc1184122. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as...

SUSE SLES12 Security Update : xen (SUSE-SU-2021:1580-1)

This update for xen fixes the following issues : A recent systemd update caused a regression in 'xenstored.service' systemd now fails to track units that use systemd-notify. bsc1183790 Add a fix to delay between the call to 'systemd-notify' and the final exit of the wrapper script. bsc1185021,...

SUSE SLED15 / SLES15 Security Update : openvpn (SUSE-SU-2021:1577-1)

This update for openvpn fixes the following issues : CVE-2020-15078: Fixed authentication bypass with deferred authentication bsc1185279. CVE-2020-11810: Fixed race condition between allocating peer-id and initializing data channel key bsc1169925. CVE-2018-7544: Fixed cross-protocol scripting iss...

Ubuntu 18.04 LTS / 20.04 LTS : MariaDB vulnerabilities (USN-4944-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4944-1 advisory. This update fixed multiple vulnerabilities in MariaDB. Ubuntu 18.04 LTS has been updated to MariaDB 10.1.48. Ubuntu 20.04 LTS has been updated to...

Debian DLA-2654-1 : composer security update

It was discovered that composer, a dependency manager for PHP, did not properly sanitize Mercurial URLs, which could lead to arbitrary code execution. For Debian 9 stretch, this problem has been fixed in version 1.2.2-1+deb9u1. We recommend that you upgrade your composer packages. For the detaile...

[R1] Nessus Network Monitor 5.13.1 Fixes Multiple Third-party Vulnerabilities

Nessus Network Monitor leverages third-party software to help provide underlying functionality. One of the third-party components OpenSSL was found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with good practice, Tenable...

Debian DLA-2651-1 : python-django security update

It was discovered that there was potential directory-traversal vulnerability in Django, a popular Python-based web development framework. The MultiPartParser, UploadedFile and FieldFile classes allowed directory-traversal via uploaded files with suitably crafted file names. In order to mitigate...

Debian DLA-2650-1 : exim4 security update

The Qualys Research Labs reported several vulnerabilities in Exim, a mail transport agent, which could result in local privilege escalation and remote code execution. Details can be found in the Qualys advisory at https://www.qualys.com/2021/05/04/21nails/21nails.txt For Debian 9 stretch, these...

SUSE SLED15 / SLES15 Security Update : bind (SUSE-SU-2021:1471-1)

This update for bind fixes the following issues : CVE-2021-25214: Fixed a broken inbound incremental zone update IXFR which could have caused named to terminate unexpectedly bsc1185345. CVE-2021-25215: Fixed an assertion check which could have failed while answering queries for DNAME records that...

SUSE SLED15 / SLES15 Security Update : ceph (SUSE-SU-2021:1474-1)

This update for ceph fixes the following issues : ceph was updated to 15.2.11-83-g8a15f484c2 : - CVE-2021-20288: Fixed unauthorized globalid reuse bsc1183074. - disk gets replaced with no rocksdb/wal bsc1184231. - BlueStore handles huge4GB writes from RocksDB to BlueFS poorly, potentially causing...

Tenable Nessus 8.x.x < 8.14.0 Privilege Escalation (TNS-2021-07)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 8.14.0. It is, therefore, affected by a privilege escalation vulnerability. An authenticated attacker can exploit this, via file upload, to gain administrator privileges to the system. No...

Photon OS 3.0: Linux PHSA-2021-3.0-0229

An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0229. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descripti...

SUSE SLED15 / SLES15 Security Update : p7zip (SUSE-SU-2021:1491-1)

This update for p7zip fixes the following issues : CVE-2021-3465: Fixed a NULL pointer dereference in NCompress:CCopyCoder:Code bsc1184699 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...