SUSE-SU-2020:0334-1 Security update for xen

This update for xen fixes the following issues: - CVE-2020-7211: potential directory traversal using relative paths via tftp server on Windows host bsc1161181. - CVE-2019-19579: Device quarantine for alternate pci assignment methods bsc1157888. - CVE-2019-19581: findnextbit issues bsc1158003. -...

Google Chrome < 80.0.3987.87 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 80.0.3987.87. It is, therefore, affected by multiple vulnerabilities as referenced in the 202002stable-channel-update-for-desktop advisory. - Insufficient data validation in streams in Google Chrome prior to 80.0.3987.8...

Wireshark 3.2.x < 3.2.1 A Vulnerability

The version of Wireshark installed on the remote Windows host is prior to 3.2.1. It is, therefore, affected by a vulnerability as referenced in the wireshark-3.2.1 advisory. - In Wireshark 3.2.x before 3.2.1, the WASSP dissector could crash. This was addressed in epan/dissectors/packet-wassp.c by...

CVE-2020-7211

A potential directory traversal issue was found in the tftp server of the SLiRP user-mode networking implementation used by QEMU. It could occur on a Windows host, as it allows the use of both forward '/' and backward slash'' tokens as separators in a file path. A user able to access the tftp...

Mozilla Firefox ESR < 68.4.1

The version of Firefox ESR installed on the remote Windows host is prior to 68.4.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2020-03 advisory. - Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are...

Mozilla Firefox < 72.0.1

The version of Firefox installed on the remote Windows host is prior to 72.0.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2020-03 advisory. - Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware ...

VMware Workstation 15.0.x < 15.5.1 Vulnerability (VMSA-2019-0023)

The version of VMware Workstation installed on the remote Windows host is 15.0.x prior to 15.5.1. It is, therefore, affected by a vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. C Tenable Network...

Adobe Acrobat < 2015.006.30508 / 2017.011.30156 / 2019.021.20058 Multiple Vulnerabilities (APSB19-55)

The version of Adobe Acrobat installed on the remote Windows host is a version prior to 2015.006.30508, 2017.011.30156, or 2019.021.20058. It is, therefore, affected by multiple vulnerabilities. - Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier,...

Wireshark 3.0.x < 3.0.7 A Vulnerability

The version of Wireshark installed on the remote Windows host is prior to 3.0.7. It is, therefore, affected by a vulnerability as referenced in the wireshark-3.0.7 advisory. - In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in...

Google Chrome < 79.0.3945.79 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 79.0.3945.79. It is, therefore, affected by multiple vulnerabilities as referenced in the 201912stable-channel-update-for-desktop advisory. - Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a...

VMware Workstation 15.0.x < 15.5.1 Multiple Vulnerabilities (VMSA-2019-0020, VMSA-2019-0021)

The version of VMware Workstation installed on the remote Windows host is 15.0.x prior to 15.5.1. It is, therefore, affected by multiple vulnerabilities: - An unspecified information disclosure vulnerability in vmnetdhcp. CVE-2019-5540 - An unspecified out-of-bounds write vulnerability in the...

Mozilla Thunderbird < 68.2

The version of Thunderbird installed on the remote Windows host is prior to 68.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-35 advisory. - Mozilla developers and community members Bob Clary, Jason Kratzer, Aaron Klotz, Iain Ireland, Tyson Smith, Christia...

Google Chrome < 78.0.3904.70 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 78.0.3904.70. It is, therefore, affected by multiple vulnerabilities as referenced in the 201910stable-channel-update-for-desktop22 advisory. - Out of bounds memory access in PDFium in Google Chrome prior to 78.0.3904.7...

Mozilla Firefox ESR < 68.2

The version of Firefox ESR installed on the remote Windows host is prior to 68.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-33 advisory. - Mozilla developers and community members Bob Clary, Jason Kratzer, Aaron Klotz, Iain Ireland, Tyson Smith, Christia...

Microsoft SQL Server Management Studio 18.x < 18.3.1 Multiple Vulnerabilities (October 2019)

The version of Microsoft SQL Server Management Studio installed on the remote Windows host is 18.x prior to 18.3.1. It is, therefore, affected by multiple information disclosure vulnerabilities: - An information disclosure vulnerability exists in Microsoft SQL Server Management Studio SSMS when i...

Adobe ColdFusion 2016.x < 2016u12 / 2018.x < 2018u5 Multiple Vulnerabilities (APSB19-47)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2016.x update 12 or 2018.x update 5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB19-47 advisory: - An unspecified command injection vulnerability via a vulnerable component could...

Apache Struts 2.3.20 < 2.3.29 / 2.5.x < 2.5.13 Denial of Service Vulnerability (S2-041)

The version of Apache Struts running on the remote Windows host is 2.3.20 prior to 2.3.29 or 2.5.x 2.5.13. It is, therefore, affected by a denial of service vulnerability in URLValidator due to improper handling of form fields. An unauthenticated, remote attacker can exploit this, via a crafted...

Wireshark 2.6.x < 2.6.7 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 2.6.7. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.6.7 advisory. - In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the RPCAP dissector could crash. This was addressed in...

Wireshark 3.0.x < 3.0.4 A Vulnerability

The version of Wireshark installed on the remote Windows host is prior to 3.0.4. It is, therefore, affected by a vulnerability as referenced in the wireshark-3.0.4 advisory. - In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop. This was addressed...

IBM WebSphere Portal Security Bypass Vulnerability (CVE-2018-1420)

The version of IBM WebSphere Portal installed on the remote Windows host is affected by a security bypass vulnerability due to improper validaiton of user context during impersionation senarios. An authenticated, remote attacker can exploit this, to perform actions in the user or administrator...