SUSE SLES11 Security Update : kvm (SUSE-SU-2018:2615-1) (Spectre)

This update for kvm fixes the following security issues : CVE-2018-12617: qmpguestfileread had an integer overflow that could have been exploited by sending a crafted QMP command including guest-file-read with a large count value to the agent via the listening socket causing DoS bsc1098735...

Fedora 27 : xen (2018-915602df63) (Foreshadow)

L1 Terminal Fault speculative side channel patch bundle XSA-273, CVE-2018-3620, CVE-2018-3646 drop patches also in the bundle, which also includes Use of v2 grant tables may cause crash on ARM XSA-268 1616081 x86: Incorrect MSRDEBUGCTL handling lets guests enable BTS XSA-269 1616077 oxenstored do...

Fedora 27 : 3:mariadb (2018-d1c4a4ca50)

MariaDB 10.2.17 Release notes : https://mariadb.com/kb/en/library/mariadb-10217-release-notes/ CVEs fixed : CVE-2018-3060 CVE-2018-3064 CVE-2018-3063 CVE-2018-3058 CVE-2018-3066 CVE-2018-3081 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

Debian DLA-1490-1 : php5 security update

Two vulnerabilities have been discovered in php5, a server-side, HTML-embedded scripting language. One CVE-2018-14851 results in a potential denial of service out-of-bounds read and application crash via a crafted JPEG file. The other CVE-2018-14883 is an Integer Overflow that leads to a heap-bas...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : poppler vulnerability (USN-3757-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3757-1 advisory. Hosein Askari discovered that poppler incorrectly handled certain PDF files. An attacker could possible use this issue to cause a denial o...

SUSE SLES11 Security Update : ImageMagick (SUSE-SU-2018:2553-1)

This update for ImageMagick fixes the following issues: Security issue fixed : - Hide PS, XPS and PDF coders into /vulnerable bsc1105592 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automaticall...

Debian DLA-1481-1 : linux-4.9 security update (Foreshadow)

Multiple researchers have discovered a vulnerability in the way the Intel processor designs have implemented speculative execution of instructions in combination with handling of page-faults. This flaw could allow an attacker controlling an unprivileged process to read memory from arbitrary...

Debian DLA-1476-1 : dropbear security update

A vulnerability in dropbear, a lightweight SSH2 server and client, making it possible to guess valid usernames has been found : CVE-2018-15599 : The recvmsguserauthrequest function in svr-auth.c in is prone to a user enumeration vulnerability, similar to CVE-2018-15473 in OpenSSH. For Debian 8...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Spice vulnerability (USN-3751-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3751-1 advisory. It was discovered that Spice incorrectly handled certain messages. An attacker could possibly use this issue to cause a denial of service...

Nessus Launched Plugin List

This plugin displays the list of launched plugins in a semicolon delimited list. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid112154; scriptversion"1.4"; scriptcvsdate"Date: 2018/09/24 10:11:01"; scriptnameenglish:"Nessus Launched Plugin List";...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : GD vulnerabilities (USN-3755-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3755-1 advisory. It was discovered that GD incorrectly handled certain images. An attacker could possibly use this issue to execute arbitrary code...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Intel Microcode vulnerabilities (USN-3756-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3756-1 advisory. It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is...

Fedora 27 : kernel / kernel-headers (2018-79d7c3d2df)

The 4.17.17 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

SUSE SLED12 Security Update : libreoffice (SUSE-SU-2018:2485-1)

This update for libreoffice to 6.0.5.2 fixes the following issues: Security issues fixed : - CVE-2018-10583: An information disclosure vulnerability occurs during automatic processing and initiating an SMB connection embedded in a malicious file, as demonstrated by...

SUSE SLES11 Security Update : openssl (SUSE-SU-2018:2486-1)

This update for openssl fixes the following security issue : - CVE-2018-0737: The RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could have...

Ubuntu 18.04 LTS : Pango vulnerability (USN-3750-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3750-1 advisory. Jeffrey M. discovered that Pango incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. Tenable has extracted...

Debian DLA-1472-1 : libcgroup security update

The cgrulesengd daemon in libcgroup creates log files with world readable and writable permissions due to a reset of the file mode creation mask umask0. For Debian 8 'Jessie', this problem has been fixed in version 0.41-6+deb8u1. We recommend that you upgrade your libcgroup packages. NOTE: Tenabl...

SUSE SLES12 Security Update : xen (SUSE-SU-2018:2410-1) (Foreshadow)

This update for xen fixes the following security issues : - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest O...

Ubuntu 14.04 LTS : Linux kernel regressions (USN-3741-3)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3741-3 advisory. USN-3741-1 introduced mitigations in the Linux kernel for Ubuntu 14.04 LTS to address L1 Terminal Fault L1TF vulnerabilities CVE-2018-3620, CVE-2018-3646...

Fedora 27 : libgit2 (2018-ca483ae3e0)

This is a security release fixing out-of-bounds reads when processing smart-protocol 'ng' packets. When parsing an 'ng' packet, we keep track of both the current position as well as the remaining length of the packet itself. But instead of taking care not to exceed the length, we pass the current...