SUSE SLED12 / SLES12 Security Update : python (SUSE-SU-2019:2091-1)

This update for python fixes the following issues : CVE-2019-10160: Fixed a regression in urlparse and urlsplit introduced by the fix for CVE-2019-9636 bsc1138459. CVE-2018-20852: Fixed an information leak where cookies could be send to the wrong server because of incorrect domain validation...

Mozilla Thunderbird < 60.7.2

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 60.7.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-20 advisory. - Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent...

EulerOS 2.0 SP3 : samba (EulerOS-SA-2019-1342)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an...

RHEL 7 : polkit (RHSA-2019:0230)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0230 advisory. The polkit packages provide a component for controlling system-wide privileges. This component provides a uniform and organized way for non-privilege...

SUSE SLED12 / SLES12 Security Update : binutils (SUSE-SU-2018:3207-1)

This update for binutils to 2.31 fixes the following issues : These security issues were fixed : CVE-2017-15996: readelf allowed remote attackers to cause a denial of service excessive memory allocation or possibly have unspecified other impact via a crafted ELF file that triggered a buffer...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1009-1)

This update for the Linux Kernel 3.12.61-5286 fixes several issues. The following security issues were fixed : - CVE-2017-13166: An elevation of privilege vulnerability was fixed in the kernel v4l2 video driver. bsc1085447. - CVE-2018-1068: A flaw was found in the Linux kernels implementation of...

Ubuntu 14.04 LTS / 16.04 LTS : QEMU regression (USN-3575-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3575-2 advisory. USN-3575-1 fixed vulnerabilities in QEMU. The fix for CVE-2017-11334 caused a regression in Xen environments. This update removes the problematic fix...

KB4056887: Security update for Adobe Flash Player (January 2018)

The remote Windows host is missing security update KB4056887. It is, therefore, affected by a an out-of-bounds read vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid105693; scriptversion"1.8"; scriptcvsdate"Date: 2019/11/08"; scriptcveid"CVE-2018-4871";...

Debian DSA-3920-1 : qemu - security update

Multiple vulnerabilities were found in qemu, a fast processor emulator : - CVE-2017-9310 Denial of service via infinite loop in e1000e NIC emulation. - CVE-2017-9330 Denial of service via infinite loop in USB OHCI emulation. - CVE-2017-9373 Denial of service via memory leak in IDE AHCI emulation....

RHEL 5 : kernel (RHSA-2017:1482)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1482 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: A flaw was found in the way memory was...

Security Update for Live Meeting 2007 / Lync 2010 and 2013 / Skype for Business 2016 (June 2017)

The Microsoft Live Meeting 2007, Lync 2010, Lync 2013, or Skype 2016 for Business application installed on the remote Windows host is missing a security update. It is, therefore, affected remote code execution vulnerability in Windows Uniscribe software due to improper handling of objects in...

Windows 8.1 and Windows Server 2012 R2 April 2017 Security Updates

The remote Windows host is missing security update 4015547 or cumulative update 4015550. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the open-source libjpeg image processing library due to improper handling of objects in memory. An...

Oracle Linux 5 / 6 / 7 : thunderbird (ELSA-2017-0498)

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2017-0498 advisory. 45.8.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 45.8.0-1 - Update to 45.8.0 Tenable has...

Fedora 22 : ntp (2016-777d838c1b)

Security fix for CVE-2016-1548, CVE-2016-2516, CVE-2016-2518, CVE-2016-1550 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

OracleVM 3.2 : openssl (OVMSA-2016-0071)

The remote OracleVM system is missing necessary patches to address critical security updates : - To disable SSLv2 client connections create the file /etc/sysconfig/openssl-ssl-client-kill-sslv2 John Haxby orabug 21673934 - Backport openssl 08-Jan-2015 security fixes John Haxby orabug 20409893 - f...

Ubuntu 12.04 LTS : openjdk-6 vulnerabilities (USN-2885-1)

Multiple vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity, and availability. An attacker could exploit these to cause a denial of service, expose sensitive data over the network, or possibly execute arbitrary code. CVE-2016-0483, CVE-2016-0494 A...

F5 Networks BIG-IP : NTP vulnerabilities (K17530)

CVE-2015-7691 The cryptoxmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service crash via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750...

F5 Networks BIG-IP : OpenSSL vulnerability (SOL16139) (FREAK)

The ssl3getkeyexchange function in s3clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORTRSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role. C Tenable...

CentOS 6 : kernel (CESA-2015:1623)

Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, a...

OpenSSH < 7.0 Multiple Vulnerabilities

According to its banner, the version of OpenSSH running on the remote host is prior to 7.0. It is, therefore, affected by the following vulnerabilities : - A security bypass vulnerability exists in the kbdintnextdevice function in file auth2-chall.c that allows the circumvention of MaxAuthTries...

openSUSE Security Update : openssl (openSUSE-2015-447) (Logjam)

openssl was updated to fix six security issues. The following vulnerabilities were fixed : - CVE-2015-4000: The Logjam Attack / weakdh.org. Rject connections with DH parameters shorter than 768 bits, generates 2048-bit DH parameters by default. boo931698 - CVE-2015-1788: Malformed ECParameters...

RHEL 6 : Red Hat Satellite IBM Java Runtime (RHSA-2015:1091)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1091 advisory. IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update corrects several...

SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2014:1422-1)

OpenJDK was updated to icedtea 2.5.3 OpenJDK 7u71 fixing security issues and bugs. - Security : - S8015256: Better class accessibility - S8022783, CVE-2014-6504: Optimize C2 optimizations - S8035162: Service printing service - S8035781: Improve equality for annotations - S8036805: Correct linker...

CodeMeter < 5.20 Local Privilege Escalation Vulnerability

According to its self-reported version, the CodeMeter WebAdmin server installed on the remote host is prior to 5.20a 5.20.1458.500. It is affected by insecure read/write permissions for the 'codemeter.exe' service, which a local attacker can exploit to gain elevated privileges via a trojan horse...

OracleVM 3.3 : xen (OVMSA-2014-0038) (POODLE)

The remote OracleVM system is missing necessary patches to address critical security updates : - xend: disable sslv3 due to CVE-2014-3566 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory OVMSA-2014-0038...

Oracle Linux 5 / 6 : unbreakable enterprise kernel (ELSA-2014-3043)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3043 advisory. - fix autofs/afs/etc. magic mountpoint breakage Al Viro Orabug: 19028505 CVE-2014-0203 - SELinux: Fix kernel BUG on empty security contexts. Stephe...

Mozilla Thunderbird ESR < 17.0.10 Multiple Vulnerabilities

The installed version of Thunderbird ESR is earlier than 17.0.10 and is, therefore, potentially affected the following vulnerabilities: - The implementation of Network Security Services NSS does not ensure that data structures are initialized, which could result in a denial of service or disclosu...

Erlang Port Mapper Daemon Detection

The remote host is running Erlang Port Mapper Daemon, which acts as a name server on all hosts involved in distributed Erlang computations. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid62351; scriptversion"1.4";...

SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 6641)

This update fixes various bugs and some security issues in the SUSE Linux Enterprise 10 SP 3 kernel. The following security issues were fixed: CVE-2009-3238: The getrandomint function in drivers/char/random.c in the Linux kernel produces insufficiently random numbers, which allows attackers to...

PHP < 5.3.12 / 5.4.2 CGI Query String Code Execution

According to its banner, the version of PHP installed on the remote host is earlier than 5.3.12 / 5.4.2, and as such is potentially affected by a remote code execution and information disclosure vulnerability. An error in the file 'sapi/cgi/cgimain.c' can allow a remote attacker to obtain PHP...

Debian DSA-1956-1 : xulrunner - several vulnerabilities

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-3986 : David James discovered that the window.opener...

Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2008:235)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.18 CVE-2008-5012, CVE-2008-5014, CVE-2008-5016, CVE-2008-5017, CVE-2008-5018, CVE-2008-5021, CVE-2008-5022, CVE-2008-5024, CVE-2008-5052. This update provides the lates...

Debian DSA-1479-1 : linux-2.6 - several vulnerabilities

Several local vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-2878 Bart Oldeman reported a denial of service DoS issue ...

FreeBSD : php -- multiple vulnerabilities (71d903fc-602d-11dc-898c-001921ab2fa4)

The PHP development team reports : Security Enhancements and Fixes in PHP 5.2.4 : - Fixed a floating point exception inside wordwrap Reported by Mattias Bengtsson - Fixed several integer overflows inside the GD extension Reported by Mattias Bengtsson - Fixed size calculation in chunksplit Reporte...

Intel Dynamic Tuning Technology Software Privilege Escalation (INTEL-SA-00875)

Improper access control in the Intel DTT Software before version 8.7.10400.15482 may allow an authenticated user to potentially enable escalation of privilege via local access. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...

EulerOS 2.0 SP9 : golang (EulerOS-SA-2022-1449)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header falsely designating that many files are present can cause ...

RHEL 8 : thunderbird (RHSA-2022:1326)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1326 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.8.0. Security Fixes: Mozilla:...

Oracle Linux 8 : kernel (ELSA-2022-0188)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-0188 advisory. - vfs: Out-of-bounds write of heap buffer in fscontext.c Frantisek Hrbata 2040585 2040586 CVE-2022-0185 - xfs: map unwritten blocks in XFSIOCALLOC,FREE...

KB5006699: Windows Server 2022 Security Update (October 2021)

The remote Windows host is missing security update 5006699. It is, therefore, affected by multiple vulnerabilities %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Microsoft Security Updates API. The text itself is...

RHEL 7 : thunderbird (RHSA-2021:2881)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2881 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 78.12.0. Security Fixes: Mozilla:...

Photon OS 3.0: Linux PHSA-2021-3.0-0229

An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-3.0-0229. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descripti...

RHEL 8 : virt:rhel (RHSA-2020:4058)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4058 advisory. Kernel-based Virtual Machine KVM offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packag...

openSUSE Security Update : MozillaThunderbird (openSUSE-2020-643)

This update for MozillaThunderbird fixes the following issues : - Update to 68.8.0 ESR MFSA 2020-18 bsc1171186 - CVE-2020-12397 bmo1617370 Sender Email Address Spoofing using encoded Unicode characters - CVE-2020-12387 bmo1545345 Use-after-free during worker shutdown - CVE-2020-6831 bmo1632241...

KB4540673: Windows 10 Version 1903 and Windows 10 Version 1909 March 2020 Security Update

The remote Windows host is missing security update 4540673. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists when the Windows Device Setup Manager improperly handles file operations. An attacker who successfully exploited this vulnerability...

FreeBSD : drm graphics drivers -- Local privilege escalation and denial of service (ecb7fdec-0b82-11ea-874d-0c9d925bbbc0)

Intel reports : As part of IPU 2019.2, INTEL-SA-00242 advises that insufficient access control may allow an authenticated user to potentially enable escalation of privilege via local access. INTEL-SA-00260 advises that insufficient access control may allow an authenticated user to potentially...

Oracle Linux 8 : thunderbird (ELSA-2019-1799)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-1799 advisory. 60.8.0-1.0.1 60.8.0-1 - Updated to 60.8.0 60.7.2-3 - Rebuild to fix rhbz1725919 - Thunderbird fails to authenticate with gmail with ssl/tls and OAuth2...

Debian DLA-1869-1 : firefox-esr security update

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, cross-site scripting, spoofing, information disclosure, denial of service or cross-site request forgery. For Debian 8 'Jessie', these problems have been...

Fedora 28 : kernel / kernel-headers (2019-c36afa818c) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

The 5.0.16 stable updates contain a number of important fixes across the tree. Most importantly, these updates address the kernel portion of the MDS CVEs. ---- The 5.0.14 update contains a number of important fixes across the tree. There is no kernel-headers or kernel-tools build this time. Note...

Fedora 29 : 2:qemu / libvirt (2019-0332a96d31) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

Define md-clear CPUID bit. Assuming an updated host kernel and microcode, the md-clear bit will be automatically exposed to guests using the QEMU '-cpu host' arg, or libvirt 'host-model' or 'host-passthrough' configurations. Guests using a named CPU model it must be manually updated to add this...

RHEL 7 : kernel (RHSA-2019:1172)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1172 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: A flaw was found in the implementation...