EulerOS 2.0 SP1 : dhcp (EulerOS-SA-2018-1072)

According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An out-of-bound memory access flaw was found in the way dhclient processed a DHCP response packet. A malicious DHCP server could potentially use...

EulerOS 2.0 SP2 : squid (EulerOS-SA-2018-1075)

According to the versions of the squid packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability i...

Ubuntu 18.04 LTS : MySQL vulnerabilities (USN-3629-3)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3629-3 advisory. USN-3629-1 fixed vulnerabilities in MySQL. This update provides the corresponding updates for Ubuntu 18.04 LTS. Tenable has extracted the preceding...

Fedora 27 : ghostscript (2018-3247413570)

Security fix for CVE-2018-10194. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 703...

macOS : Apple Safari 11.1 APPLE-SA-2018-04-24-3 Multiple Vulnerabilities

The version of Apple Safari installed on the remote macOS or Mac OS X host is 11.1, but is missing the security fix APPLE-SA-2018-04-24-3. It is, therefore, affected by multiple vulnerabilities as described in the HT208741 security advisory. C Tenable Network Security, Inc. include"compat.inc"; i...

Fedora 27 : anki (2018-70fac3f07e)

Update to new upstream release 2.0.50. - fix a security issue in .apkg imports - fix a problem with plugin download - use python send2trash module from system - use correct shebang for python2 - upstream changelog: https://apps.ankiweb.net/docs/changes.html Note that Tenable Network Security has...

Debian DLA-1360-1 : lucene-solr security update

It was discovered that there was an XML external entity expansion XXE vulnerability in lucene-solr, a search engine library for Java. It could be exploited to read arbitrary local files from the Solr server or the internal network. For Debian 7 'Wheezy', this issue has been fixed in lucene-solr...

Debian DLA-1359-1 : ruby1.8 security update

Multiple vulnerabilities were found in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2017-17742 Aaron Patterson reported that WEBrick bundled with Ruby was vulnerable to an HTTP response splitting vulnerability. It wa...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3631-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3631-1 advisory. It was discovered that a buffer overread vulnerability existed in the keyring subsystem of the Linux kernel. A local attacker could possibly use this to...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:1048-1)

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.126 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-1091: In the flushtmregstothread function in arch/powerpc/kernel/ptrace.c, a guest kernel crash can be triggered from unprivileged userspace...

Ubuntu 16.04 LTS : Linux kernel (Intel Euclid) vulnerability (USN-3633-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3633-1 advisory. Jann Horn discovered that the Berkeley Packet Filter BPF implementation in the Linux kernel improperly performed sign extension in some situations. A local attack...

Ubuntu 14.04 LTS / 16.04 LTS : MySQL vulnerabilities (USN-3629-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3629-1 advisory. Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been...

Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3631-2)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3631-2 advisory. USN-3631-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enableme...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0991-1)

This update for the Linux Kernel 3.12.74-606485 fixes one issue. The following security issue was fixed : - CVE-2018-7566: The Linux kernel had a buffer overflow via an SNDRVSEQIOCTLSETCLIENTPOOL ioctl write operation to /dev/snd/seq by a local user bsc1083488. Note that Tenable Network Security...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1003-1)

This update for the Linux Kernel 4.4.114-9267 fixes several issues. The following security issues were fixed : - CVE-2017-13166: Prevent elevation of privilege vulnerability in the v4l2 video driver bsc1085447. - CVE-2018-1068: A flaw in the implementation of 32-bit syscall interface for bridging...

Ubuntu 14.04 LTS / 16.04 LTS : OpenSSL vulnerability (USN-3628-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3628-1 advisory. Alejandro Cabrera Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia discovered that OpenSSL incorrectly handled RSA key...

Juniper Junos Connectionless Network Protocol (CLNP) Packet Handling Unspecified Remote Code Execution / DoS (JSA10844)

According to its self-reported version number, the remote Juniper Junos device is affected by an unspecified flaw that is triggered when handling Connectionless Network Protocol CLNP packets. This allows a remote attacker to crash a device or execute arbitrary code. Note: This issue is only...

Debian DLA-1356-1 : libreoffice security update

Fuzzing by the OSS-Fuzz project found two memory safety issues in LibreOffice, which could result in an application crash or possibly other unspecified impact. For Debian 7 'Wheezy', these problems have been fixed in version 1:3.5.4+dfsg2-0+deb7u11. We recommend that you upgrade your libreoffice...

Cisco IOS SNMP Community string write privileges.

According to its configuration, the Cisco IOS on the remote device has a SNMP community string with write access. This could allow remote configuration of the device, including copying and overwriting the running-config. TRUSTED...

Debian DLA-1352-1 : jruby security update

An unsafe object deserialization vulnerability was found in jruby, a 100% pure-Java implementation of Ruby. An attacker can use this flaw to run arbitrary code when gem owner is run on a specially crafted YAML file. For Debian 7 'Wheezy', these problems have been fixed in version 1.5.6-5+deb7u2. ...