SUSE SLES12 Security Update : xen (SUSE-SU-2017:0582-1)

This update for xen fixes several issues. These security issues were fixed : - CVE-2017-5973: A infinite loop while doing control transfer in xhcikickepctx allowed privileged user inside the guest to crash the host process resulting in DoS bsc1025188 - CVE-2016-10155: The virtual hardware watchdo...

McAfee ePolicy Orchestrator Agent < 5.0.4.449 Log Viewer DoS

According to its self-reported version, the McAfee ePolicy Orchestrator ePO Agent running on the remote host is 5.0.x prior to 5.0.4.449. It is, therefore, affected by a flaw in its remote log viewer component due to improper validation of input to an unspecified HTTP GET parameter. An...

SUSE SLES11 Security Update : zlib (SUSE-SU-2016:3209-1)

This update for zlib fixes the following issues : - Incompatible declarations for external linkage function deflate bnc1003577 - CVE-2016-9842: Undefined Left Shift of Negative Number bnc1003580 - CVE-2016-9840 CVE-2016-9841: Out-of-bounds pointer arithmetic in inftrees.c bnc1003579 -...

RHEL 7 : kernel (RHSA-2016:0185)

Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, a...

Ubuntu 14.10 : linux vulnerability (USN-2600-1)

A race condition between chown and execve was discovered in the Linux kernel. A local attacker could exploit this race by using chown on a setuid-user-binary to gain administrative privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Ubunt...

Juniper Junos Multiple OpenSSL Vulnerabilities (JSA10679) (FREAK)

According to its self-reported version number, the remote Juniper Junos device is affected by the following vulnerabilities related to OpenSSL : - A NULL pointer dereference flaw exists when the SSLv3 option isn't enabled and an SSLv3 ClientHello is received. This allows a remote attacker, using ...

Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2419-1)

A flaw was discovered in how the Linux kernel's KVM Kernel Virtual Machine subsystem handles the CR4 control register at VM entry on Intel processors. A local host OS user can exploit this to cause a denial of service kill arbitrary processes, or system disruption by leveraging /dev/kvm access...

Slackware 14.1 / current : glibc (SSA:2014-296-01)

New glibc packages are available for Slackware 14.1 and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2014-296-01. The text itself is copyright C Slackwar...

Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2014-430)

Multiple flaws were discovered in the Libraries, 2D, and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. CVE-2014-6506 , CVE-2014-6531 , CVE-2014-6502 , CVE-2014-6511 , CVE-2014-6504 , CVE-2014-6519 It was...

RHEL 6 : Red Hat JBoss Enterprise Application Platform 6.3.0 update (Important) (RHSA-2014:1020)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1020 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. A race condition...

SuSE 11.3 Security Update : PHP 5.3 (SAT Patch Number 9537)

PHP 5.3 has been updated to fix several security problems : - The SPL component in PHP incorrectly anticipated that certain data structures will have the array data type after unserialization, which allowed remote attackers to execute arbitrary code via a crafted string that triggers use of a...

Debian DSA-2923-1 : openjdk-7 - security update

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in the execution of arbitrary code, breakouts of the Java sandbox, information disclosure or denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive te...

Amazon Linux AMI : openssl Information Disclosure Vulnerability (ALAS-2014-320)

A missing bounds check was found in the way OpenSSL handled TLS heartbeat extension packets. This flaw could be used to reveal up to 64k of memory from a connected client or server. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amazon...

Wireshark / Ethereal Unsupported Version Detection

According to its version, the installation of Wireshark / Ethereal on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. C Tenable Network...

Oracle GlassFish Server Administration Console GET Request Authentication Bypass

The version of GlassFish Server running on the remote host has an authentication bypass vulnerability. The server fails to enforce authentication on HTTP requests that contain lower case method names e.g. 'get'. A remote, unauthenticated attacker could exploit this to upload and execute arbitrary...

RHEL 4 / 5 : java-1.6.0-sun (RHSA-2010:0770)

Updated java-1.6.0-sun packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which gi...

Fedora 12 : kernel-2.6.32.19-163.fc12 (2010-13110)

Update to kernel 2.6.32.19: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.17 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.18 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.19 - Includes fixes from kernel 2.6.36-rc1 for problems caused by the...

OpenOffice < 3.2.1 Multiple Vulnerabilities

Binary data 5564.prm...

TCP Channel Detection

The remote host is running a TCP-based .NET Remoting Channel Service, also known as a 'TCP channel'. .NET Remoting is an API developed by Microsoft and used for interprocess communications, and a channel service provides the mechanism by which such communications occur. Two channel services are...

MySQL Server Detection

The remote host is running MySQL, an open source database server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10719; scriptversion"1.46"; scriptsetattributeattribute:"pluginmodificationdate", value:"2026/08/06"; scriptxrefname:"IAVT", value:"0001-T-0802";...

KB5036910: Windows Server version 23H2 Security Update (April 2024)

The remote Windows host is missing security update 5036910. It is, therefore, affected by multiple vulnerabilities - SmartScreen Prompt Security Feature Bypass Vulnerability CVE-2024-29988 - Secure Boot Security Feature Bypass Vulnerability CVE-2024-20669, CVE-2024-26168, CVE-2024-26171,...

RHEL 8 : nodejs:16 (RHSA-2022:6964)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6964 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

RHEL 7 : kernel (RHSA-2022:5937)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5937 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: Incomplete cleanup of multi-core share...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2022-9583)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9583 advisory. - floppy: use a statically allocated error counter Willy Tarreau Orabug: 34218640 CVE-2022-1652 Tenable has extracted the preceding description block directly...

Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5443-2)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5443-2 advisory. Kyle Zeng discovered that the Network Queuing and Scheduling subsystem of the Linux kernel did not properly perform reference counting in some situations...

Rocky Linux 8 : openssh (RLSA-2022:2013)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:2013 advisory. - sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not...

SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2020:14588-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14588-1 advisory. - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization. Supported versions that are affected are...

Oracle Linux 6 : bind (ELSA-2021-9213)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-9213 advisory. 32:9.8.2-0.68.rc1.0.2.8 - Backport possible assertion failure on DNAME processing CVE-2021-25215 Tenable has extracted the preceding description block directly...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-4576-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4576-1 advisory. Hadar Manor discovered that the DCCP protocol implementation in the Linux kernel improperly handled socket reuse, leading to a use-after-free...

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal (cisco-sa-asaftd-ro-path-KJuQhB86)

A vulnerability exists in the web services interface of Cisco Adaptive Security Appliance ASA and Firepower Threat Defense FTD Software. An unauthenticated, remote attacker can exploit this, by sending a crafted HTTP request containing directory traversal character sequences to an affected device...

Microsoft OneDrive Elevation of Privilege (CVE-2020-1465)

The version of Microsoft OneDrive installed on the remote Windows host is prior to 20.084.0426.0007. It is, therefore, affected by an elevation of privilege vulnerability that allows file deletion in arbitrary locations. To exploit the vulnerability, an attacker would first have to log on to the...

Photon OS 2.0: Glibc PHSA-2020-2.0-0248

An update of the glibc package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0248. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid137198...

Debian DSA-4603-1 : thunderbird - security update

Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code or information disclosure. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4603. The...

macOS : Apple Safari < 12.1.2 Multiple Vulnerabilities

The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 12.1.2 It is, therefore, affected by multiple vulnerabilities in the following components : - Safari - WebKit C Tenable Network Security, Inc. include'compat.inc'; if description scriptid128178;...

Ubuntu 19.04 : linux, linux-aws, linux-gcp, linux-kvm, linux-raspi2, linux-snapdragon (USN-4005-1)

It was discovered that a NULL pointer dereference vulnerability existed in the LSI Logic MegaRAID driver in the Linux kernel. A local attacker could use this to cause a denial of service system crash. CVE-2019-11810 It was discovered that a race condition leading to a use-after-free existed in th...

Fedora 30 : httpd (2019-cf7695b470)

Resolves: 1695046 CVE-2019-0196 CVE-2019-0197 CVE-2019-0215 CVE-2019-0217 CVE-2019-0220 httpd: various flaws Resolves: 1694510 httpd-2.4.39 is available Resolves: 1694986 - CVE-2019-0211 httpd: privilege escalation from modules scripts Note that Tenable Network Security has extracted the precedin...

openSUSE Security Update : libqt5-qtsvg (openSUSE-2019-1116)

This update for libqt5-qtsvg fixes the following issues : Security issues fixed : - CVE-2018-19869: Fixed Denial of Service when parsing malformed URL reference bsc1118599 This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Photon OS 2.0: Linux PHSA-2018-2.0-0009

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-2.0-0009. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid121903...

Oracle Linux 7 : qemu-kvm (ELSA-2018-2462)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-2462 advisory. - Resolves: bz1549824 CVE-2018-7550 qemu-kvm: Qemu: i386: multiboot OOB access while loading kernel image rhel-7.5.z - Resolves: bz1586248 CVE-2018-118...

CentOS 7 : firefox (CESA-2018:1415)

An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CentOS 6 : kernel (CESA-2018:0512) (Meltdown) (Spectre)

An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Palo Alto Networks PAN-OS Management Interface RCE (PAN-SA-2017-0027)

The Palo Alto Networks PAN-OS running on the remote host is affected by a remote code execution vulnerability in the management interface due to improper validation of user-supplied input when handling HTTP requests. An unauthenticated, remote attacker can exploit this, via a series of specially...

Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerability (USN-3333-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3333-1 advisory. USN-3326-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.10. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel...

Google Chrome < 52.0.2743.82 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 52.0.2743.82. It is, therefore, affected by multiple vulnerabilities as referenced in the 201607stable-channel-update advisory. - The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origi...

Oracle Linux 7 : kernel (ELSA-2015-1534)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1534 advisory. - net ipv4: Missing sknullsnodeinit in pingunhash Denys Vlasenko 1218104 1218105 CVE-2015-3636 - net nfconntrack: reserve two bytes for nfctext-len...

SUSE SLED11 Security Update : java-1_7_0-openjdk (SUSE-SU-2015:1320-1) (Bar Mitzvah) (Logjam)

OpenJDK was updated to 2.6.1 - OpenJDK 7u85 to fix security issues and bugs. The following vulnerabilities were fixed : - CVE-2015-2590: Easily exploitable vulnerability in the Libraries component allowed successful unauthenticated network attacks via multiple protocols. Successful attack of this...

SUSE SLES11 Security Update : glibc (SUSE-SU-2014:1122-1)

This glibc update fixes a critical privilege escalation vulnerability and the following security and non-security issues : - bnc892073: An off-by-one error leading to a heap-based buffer overflow was found in gconvtranslitfind. An exploit that targets the problem is publicly available...

ManageEngine NetFlow Analyzer Default Credentials

The remote ManageEngine NetFlow Analyzer web administration interface uses a known set of default credentials. An attacker can use these to gain access to the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

SuSE 11.3 Security Update : IBM Java (SAT Patch Number 9615)

java-160-ibm has been updated to fix ten security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C Novell, Inc. if NASLLEVEL 3000 exit0;...

SuSE 11.3 Security Update : Linux Kernel (SAT Patch Numbers 9047 / 9050 / 9051)

The SUSE Linux Enterprise 11 Service Pack 3 kernel was updated to fix various bugs and security issues. ---------------------------------------------------------------------- - WARNING: If you are running KVM with PCI pass-through on a system with one of the following Intel chipsets: 5500 revisio...