CentOS 6 : kernel (CESA-2015:1623)

Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, a...

OpenSSH < 7.0 Multiple Vulnerabilities

According to its banner, the version of OpenSSH running on the remote host is prior to 7.0. It is, therefore, affected by the following vulnerabilities : - A security bypass vulnerability exists in the kbdintnextdevice function in file auth2-chall.c that allows the circumvention of MaxAuthTries...

Palo Alto Networks PAN-OS <= 5.0.15 / 6.0.x <= 6.0.8 / 6.1.x <= 6.1.2 GNU C Library (glibc) Buffer Overflow (GHOST)

The remote host is running a version of Palo Alto Networks PAN-OS equal to or prior to 5.0.15 / 6.0.8 / 6.1.2. It is, therefore, affected by a heap-based buffer overflow in the GNU C Library glibc due to improperly validating user-supplied input in the glibc functions nsshostnamedigitsdots,...

RHEL 7 : java-1.7.1-ibm (RHSA-2014:1042)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1042 advisory. IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes sever...

Juniper Junos TCP Packet Processing Remote DoS (JSA10638)

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability. An attacker who can guess an in-window sequence number, source and destination addresses, and port numbers can exploit this vulnerability to reset any established TCP...

Oracle Linux 5 : php (ELSA-2014-0311)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0311 advisory. 5.1.6-44 - add security fixes for CVE-2006-7243, CVE-2009-0689 Tenable has extracted the preceding description block directly from the Oracle Linux...

Oracle Linux 5 : Important: / kernel (ELSA-2008-0089)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0089 advisory. 2.6.18-53.1.6.0.1.el5 - NET Add entropy support to e1000 and bnx2 John Sobecki ORA 6045759 - NET Fix msi issue with kexec/kdump Michael Chan ORA 621936...

SuSE 11.1 / 11.2 Security Update : xorg-x11-server-rdp (SAT Patch Numbers 6111 / 6113)

This update of xorg-x11-server-rdp fixed the following security issues : - memory exhaustion flaw CVE-2011-4028 / CVE-2011-4029 - race condition flaw. CVE-2010-2240 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE...

Ubuntu 10.10 : linux vulnerabilities (USN-1243-1)

It was discovered that the security fix for CVE-2010-4250 introduced a regression. A remote attacker could exploit this to crash the system, leading to a denial of service. CVE-2011-1479 Vasiliy Kulikov discovered that taskstats did not enforce access restrictions. A local attacker could exploit...

Fedora 14 : ecryptfs-utils-90-1.fc14 (2011-10718)

privilege escalation via mountpoint race conditions CVE-2011-1831, CVE-2011-1832 - race condition when checking source during mount CVE-2011-1833 - mtab corruption via improper handling CVE-2011-1834 - key poisoning via insecure temp directory handling CVE-2011-1835 - information disclosure via...

SuSE 11 Security Update : Mozilla (SAT Patch Number 2239)

Mozilla NSS was updated to version 3.12.6. This fixes all currently known issues in mozilla-nss, and also implements the new TLS/SSL renegotiation handling. CVE-2009-3555 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fro...

CentOS 5 : kernel (CESA-2009:1670)

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux...

Slackware 12.2 / current : kernel (SSA:2009-230-01)

New Linux kernel packages are available for Slackware 12.2 and -current to address a security issue. A kernel bug discovered by Tavis Ormandy and Julien Tinnes of the Google Security Team could allow a local user to fill memory page zero with arbitrary code and then use the kernel sendpage...

Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2008:235)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.18 CVE-2008-5012, CVE-2008-5014, CVE-2008-5016, CVE-2008-5017, CVE-2008-5018, CVE-2008-5021, CVE-2008-5022, CVE-2008-5024, CVE-2008-5052. This update provides the lates...

Fedora 8 : thunderbird-2.0.0.18-1.fc8 (2008-9807)

This update update upgrades thunderbird packages to upstream version 2.0.0.18, which fixes multiple security issues detailed in upstream security advisories: http://www.mozilla.org/security/known- vulnerabilities/thunderbird20.htmlthunderbird2.0.0.17 http://www.mozilla.org/security/known-...

Debian DSA-1663-1 : net-snmp - several vulnerabilities

Several vulnerabilities have been discovered in NET SNMP, a suite of Simple Network Management Protocol applications. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0960 Wes Hardaker reported that the SNMPv3 HMAC verification relies on the client t...

SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5644)

This update brings MozillaFirefox to version 2.0.0.17 to fix bugs and security issues : - XBM image uninitialized memory reading. MFSA 2008-45 / CVE-2008-4069 - resource: traversal vulnerabilities. MFSA 2008-44 / CVE-2008-4067 / CVE-2008-4068 - BOM characters stripped from JavaScript before...

SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5450)

MozillaFirefox was updated to version 2.0.0.16, which fixes various bugs and following security issues : - An anonymous researcher, via TippingPoint's Zero Day Initiative program, reported a vulnerability in Mozilla CSS reference counting code. The vulnerability was caused by an insufficiently...

Debian DSA-1617-1 : refpolicy - incompatible policy

In DSA-1603-1, Debian released an update to the BIND 9 domain name server, which introduced UDP source port randomization to mitigate the threat of DNS cache poisoning attacks identified by the Common Vulnerabilities and Exposures project as CVE-2008-1447 . The fix, while correct, was incompatibl...

MikroTik RouterOS Detection

According to one of its service banners, the remote host is running MikroTik RouterOS, a specialized Linux-based operating system that allows Intel-class PCs to act as a network router or access point. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid30212;...

Solaris 9 (sparc) : 125137-97

JavaSE 6: update 101 patch equivalent to. Date this patch was last updated by Sun : Jul/13/15 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include'deprecatednasllevel.inc'; include'compat.inc'; if...

FreeBSD : php -- multiple vulnerabilities (71d903fc-602d-11dc-898c-001921ab2fa4)

The PHP development team reports : Security Enhancements and Fixes in PHP 5.2.4 : - Fixed a floating point exception inside wordwrap Reported by Mattias Bengtsson - Fixed several integer overflows inside the GD extension Reported by Mattias Bengtsson - Fixed size calculation in chunksplit Reporte...

Proxy Web Server XSS

The remote host is running a proxy web server that fails to adequately sanitize request strings of malicious JavaScript. By leveraging this issue, an attacker may be able to cause arbitrary HTML and script code to be executed in a user's browser within the security context of the affected site. C...

Security Update for Microsoft ASP.NET Core (June 2026)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by the following vulnerability as referenced in the vendor advisory. - Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network...

Linux Distros Unpatched Vulnerability : CVE-2026-34182

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue Summary: Cryptographic Message Services CMS processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedDa...

OpenSSL 3.1.0 < 3.1.7 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.1.7. It is, therefore, affected by a vulnerability as referenced in the 3.1.7 advisory. - Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memor...

Intel Dynamic Tuning Technology Software Privilege Escalation (INTEL-SA-00875)

Improper access control in the Intel DTT Software before version 8.7.10400.15482 may allow an authenticated user to potentially enable escalation of privilege via local access. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

RHEL 8 : thunderbird (RHSA-2022:1326)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1326 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.8.0. Security Fixes: Mozilla:...

Rocky Linux 8 : java-11-openjdk (RLSA-2022:185)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:185 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported versions that are...

GLSA-202107-13 : GLib: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202107-13 GLib: Multiple vulnerabilities Multiple vulnerabilities have been discovered in GLib. Please review the CVE identifiers referenced below for details. Impact : Please review the referenced CVE identifiers for details...

openSUSE 15 Security Update : java-1_8_0-ibm (openSUSE-SU-2022:0108-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0108-1 advisory. - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Support...

KB5006699: Windows Server 2022 Security Update (October 2021)

The remote Windows host is missing security update 5006699. It is, therefore, affected by multiple vulnerabilities %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Microsoft Security Updates API. The text itself is...

CentOS 8 : java-1.8.0-openjdk (CESA-2021:2776)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:2776 advisory. - OpenJDK: FTP PASV command response can cause FtpClient to connect to arbitrary host Networking, 8258432 CVE-2021-2341 - OpenJDK: Incorrect verificati...

Security Update for Microsoft Power BI Report Server (July 2021) (deprecated)

Deprecated because the exposure impacts Power BI Desktop %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2021/10/14. Deprecated because this impacts Power BI Desktop, not the server include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid151623;...

openSUSE Security Update : nodejs10 (openSUSE-2021-372)

This update for nodejs10 fixes the following issues : New upstream LTS version 10.24.0 : - CVE-2021-22883: HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion bsc1182619 - CVE-2021-22884: DNS rebinding in --inspect bsc1182620 - CVE-2021-23840: OpenSSL - Integer overflow in...

EulerOS Virtualization 3.0.6.6 : postgresql (EulerOS-SA-2021-1511)

According to the version of the postgresql packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. A...

Oracle Database Server Multiple Vulnerabilities (Jan 2021 CPU)

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2021 CPU advisory. - Vulnerability in the RDBMS Scheduler component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c...

Photon OS 2.0: Openssl PHSA-2020-2.0-0304

An update of the openssl package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0304. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Fedora 32 : mingw-python3 (2020-d42cb01973)

Fix mingw32,64py3build,install macros. ---- Add %mingw32,64py3build,install macros ---- This update backports a fix for CVE-2020-26116. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to...

openSUSE Security Update : python3 (openSUSE-2020-1258)

This update for python3 fixes the following issues : - bsc1174091, CVE-2019-20907: avoiding possible infinite loop in specifically crafted tarball. This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks in this...

Photon OS 1.0: Linux PHSA-2020-1.0-0314

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0314. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid139700...

Amazon Linux AMI : python27, python35, python36 (ALAS-2020-1342)

The version of python27 installed on the remote host is prior to 2.7.16-1.131. The version of python35 installed on the remote host is prior to 3.5.7-1.25. The version of python36 installed on the remote host is prior to 3.6.10-1.16. It is, therefore, affected by a vulnerability as referenced in...

Photon OS 1.0: Python2 PHSA-2019-1.0-0257

An update of the python2 package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0257. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2019:2866-1)

This update for provides the following fixes : Following security issues were fixed : CVE-2019-14847: User with 'get changes' permission could have crashed AD DC LDAP server via dirsync bsc1154598. CVE-2019-10218: Client code could have returned filenames containing path separators bsc1144902...

NewStart CGSL MAIN 5.04 : firefox Multiple Vulnerabilities (NS-SA-2019-0011)

The remote NewStart CGSL host, running version MAIN 5.04, has firefox packages installed that are affected by multiple vulnerabilities: - Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6. Some of these bugs showed evidence of memory corruption and we presume that with enough...

Oracle Business Intelligence Publisher Multiple Vulnerabilities (Jul 2017 CPU)

The version of Oracle Business Intelligence Publisher running on the remote host is 11.1.1.7.x prior to 11.1.1.7.170718, 11.1.1.9.x prior to 11.1.1.9.170718, 12.2.1.1.x prior to 12.2.1.1.170718, or 12.2.1.2.x prior to 12.2.1.2.170718. It is, therefore, affected by multiple vulnerabilities as note...

Ubuntu 16.04 LTS / 18.04 LTS : Firefox regression (USN-3991-3)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3991-3 advisory. USN-3991-1 fixed vulnerabilities in Firefox, and USN-3991-2 fixed a subsequent regression. The update caused an additional regression that resulted in...

Fedora 30 : libssh2 (2019-70a9d4f970)

This update addresses various overflow conditions that could result in possible memory read/write out of bounds errors or zero byte allocations when connected to a malicious server. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...

Oracle Tuxedo Multiple Vulnerabilities (Apr 2019 CPU)

The version of Oracle Tuxedo installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities: - An information disclosure vulnerability exists in OpenSSL due to the potential for a side-channel timing attack. An unauthenticated attacker can exploit...

openSUSE Security Update : ImageMagick (openSUSE-2019-758)

This update for ImageMagick fixes the following security issues : - CVE-2018-16413: Prevent heap-based buffer over-read in the PushShortPixel function leading to DoS bsc1106989 - CVE-2018-16329: Prevent NULL pointer dereference in the GetMagickProperty function leading to DoS bsc1106858. -...