KB4487026: Windows 10 Version 1607 and Windows Server 2016 February 2019 Security Update

The remote Windows host is missing security update 4487026. It is, therefore, affected by multiple vulnerabilities : - An information vulnerability exists when Windows improperly discloses file information. Successful exploitation of the vulnerability could allow the attacker to read the contents...

Photon OS 2.0: Linux PHSA-2018-2.0-0015

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-2.0-0015. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid121914...

RHEL 6 : java-1.8.0-ibm (RHSA-2018:1975)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1975 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE ...

Cisco IOS XE Software Multiple Vulnerabilities in ntpd (cisco-sa-20150408-ntpd)

According to its self-reported version, the IOS XE is affected by one or more vulnerabilities. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. TRUSTED...

CentOS 6 : kernel (CESA-2018:0512) (Meltdown) (Spectre)

An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

RHEL 6 / 7 : eap7-jboss-ec2-eap (RHSA-2018:0005)

"The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0005 advisory. The eap7-jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services AW...

FreeBSD : mozilla -- multiple vulnerabilities (96eca031-1313-4daf-9be2-9d6e1c4f1eb5)

Mozilla Foundation reports : Please reference CVE/URL list for details %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2019 Jacques Vidrine and contributors Redistribution a...

McAfee ePolicy Orchestrator Agent < 5.0.4.449 Log Viewer DoS

According to its self-reported version, the McAfee ePolicy Orchestrator ePO Agent running on the remote host is 5.0.x prior to 5.0.4.449. It is, therefore, affected by a flaw in its remote log viewer component due to improper validation of input to an unspecified HTTP GET parameter. An...

Ubuntu 12.04 LTS : linux vulnerability (USN-3104-1) (Dirty COW)

It was discovered that a race condition existed in the memory manager of the Linux kernel when handling copy-on-write breakage of private read-only memory mappings. A local attacker could use this to gain administrative privileges. Note that Tenable Network Security has extracted the preceding...

Google Chrome < 52.0.2743.82 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 52.0.2743.82. It is, therefore, affected by multiple vulnerabilities as referenced in the 201607stable-channel-update advisory. - The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origi...

Oracle Linux 5 : Unbreakable enterprise kernel (ELSA-2010-2008)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-2008 advisory. - fs xfs: always use iget in bulkstat Dave Chinner CVE-2010-2943 - net net sched: fix some kernel memory leaks Eric Dumazet CVE-2010-2942 Tenable has...

Debian DSA-2153-1 : linux-2.6 - privilege escalation/denial of service/information leak

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-0435 Gleb Napatov reported an issue in the KVM subsystem...

Debian DSA-1751-1 : xulrunner - several vulnerabilities

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-0771 Martijn Wargers, Jesse Ruderman and Josh Soref...

Reverse NAT/Intercepting Proxy Detection

Reverse NAT is a technology which lets multiple computers offer public services on different ports via the same IP address. Based on OS fingerprinting results, it seems that different operating systems are listening on different remote ports. Note that this behavior may also indicate the presence...

Security Updates for Sysinternals Sysmon (December 2022)

The Sysinternals Sysmon installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability: - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2022-44704 %NASLMINLEVEL 80900 C Tenable Networ...

SUSE SLED15: xen / xen-devel / xen-libs / xen-tools / xen-tools-domU / etc (SUSE-SU-2022:0940-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0940-1 advisory. Update Xen to version 4.14.4 bsc1027519 Transient execution side-channel attacks attacking the Branch History...

CentOS 8 : kernel-rt (CESA-2021:4646)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4646 advisory. - kernel: timer tree corruption leads to missing wakeup and system freeze CVE-2021-20317 - kernel: Insufficient validation of user-supplied sizes for t...

Ubuntu 18.04 LTS / 20.04 LTS : curl vulnerabilities (USN-5021-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5021-1 advisory. Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled TELNET connections when the -t option was used on the command line...

Photon OS 4.0: Linux PHSA-2021-4.0-0011

An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0011. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid148815;...

Photon OS 1.0: Nodejs10 PHSA-2021-1.0-0373

An update of the nodejs10 package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-1.0-0373. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2020-5709)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5709 advisory. - HID: hiddev: do cleanup in failure of opening a device Hillf Danton Orabug: 31206362 CVE-2019-19527 - HID: hiddev: avoid opening a disconnected...

Amazon Linux 2 : python-virtualenv (ALAS-2020-1413)

The version of python-virtualenv installed on the remote host is prior to 15.1.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1413 advisory. urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirec...

RHEL 7 : kernel (RHSA-2020:1347)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1347 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: heap overflow in...

RHEL 6 : kernel-rt (RHSA-2020:0609)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0609 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

EulerOS 2.0 SP3 : ntp (EulerOS-SA-2019-2637)

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by...

RHEL 7 : OpenShift Container Platform 4.1 (RHSA-2019:3265)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3265 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

macOS : Apple Safari < 12.1.2 Multiple Vulnerabilities

The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 12.1.2 It is, therefore, affected by multiple vulnerabilities in the following components : - Safari - WebKit C Tenable Network Security, Inc. include'compat.inc'; if description scriptid128178;...

Fedora 30 : httpd (2019-cf7695b470)

Resolves: 1695046 CVE-2019-0196 CVE-2019-0197 CVE-2019-0215 CVE-2019-0217 CVE-2019-0220 httpd: various flaws Resolves: 1694510 httpd-2.4.39 is available Resolves: 1694986 - CVE-2019-0211 httpd: privilege escalation from modules scripts Note that Tenable Network Security has extracted the precedin...

EulerOS Virtualization 2.5.4 : kernel (EulerOS-SA-2019-1229)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic...

Fedora 29 : kernel / kernel-headers / kernel-tools (2019-164946aa7f)

The 4.20.8 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Amazon Linux 2 : binutils (ALAS-2019-1138)

An integer wraparound has been discovered in the Binary File Descriptor BFD library distributed in GNU Binutils up to version 2.30. An attacker could cause a crash by providing an ELF file with corrupted DWARF debug information.CVE-2018-7568 The ignoresectionsym function in elf.c in the Binary Fi...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : OpenSSH vulnerabilities (USN-3809-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3809-1 advisory. Robert Swiecki discovered that OpenSSH incorrectly handled certain messages. An attacker could possibly use this issue to cause a...

CentOS 7 : firefox (CESA-2018:1415)

An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

EulerOS 2.0 SP1 : php (EulerOS-SA-2018-1096)

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing a...

F5 Networks BIG-IP : Linux kernel vulnerability (K74413297)

The reportfixup functions in the HID subsystem in the Linux kernel before 3.16.2 might allow physically proximate attackers to cause a denial of service out-of-bounds write via a crafted device that provides a small report descriptor, related to 1 drivers/hid/hid-cherry.c, 2 drivers/hid/hid-kye.c...

CentOS 6 / 7 : java-1.8.0-openjdk (CESA-2017:2998)

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerability (USN-3333-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3333-1 advisory. USN-3326-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.10. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel...

SUSE SLES11 Security Update : zlib (SUSE-SU-2016:3209-1)

This update for zlib fixes the following issues : - Incompatible declarations for external linkage function deflate bnc1003577 - CVE-2016-9842: Undefined Left Shift of Negative Number bnc1003580 - CVE-2016-9840 CVE-2016-9841: Out-of-bounds pointer arithmetic in inftrees.c bnc1003579 -...

FreeBSD : OpenSSL -- multiple vulnerabilities (43eaa656-80bc-11e6-bf52-b499baebfeaf)

OpenSSL reports : High: OCSP Status Request extension unbounded memory growth SSLpeek hang on empty record SWEET32 Mitigation OOB write in MDC2Update Malformed SHA512 ticket DoS OOB write in BNbn2dec OOB read in TSOBJprintbio Pointer arithmetic undefined behaviour Constant time flag not preserved...

Blue Coat ProxySG 6.5.x < 6.5.9.8 / 6.6.x < 6.6.4.1 Multiple OpenSSL Vulnerabilities

The self-reported SGOS version installed on the remote Blue Coat ProxySG device is 6.5.x prior to 6.5.9.8 or 6.6.x prior to 6.6.4.1. It is, therefore, affected by multiple vulnerabilities in its bundled version of OpenSSL : - Multiple flaws exist in the aesnicbchmacsha1cipher function in file...

RHEL 7 : kernel (RHSA-2016:0185)

Updated kernel packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, a...

Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2419-1)

A flaw was discovered in how the Linux kernel's KVM Kernel Virtual Machine subsystem handles the CR4 control register at VM entry on Intel processors. A local host OS user can exploit this to cause a denial of service kill arbitrary processes, or system disruption by leveraging /dev/kvm access...

Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2014-430)

Multiple flaws were discovered in the Libraries, 2D, and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. CVE-2014-6506 , CVE-2014-6531 , CVE-2014-6502 , CVE-2014-6511 , CVE-2014-6504 , CVE-2014-6519 It was...

SuSE 11.3 Security Update : Linux Kernel (SAT Patch Numbers 9047 / 9050 / 9051)

The SUSE Linux Enterprise 11 Service Pack 3 kernel was updated to fix various bugs and security issues. ---------------------------------------------------------------------- - WARNING: If you are running KVM with PCI pass-through on a system with one of the following Intel chipsets: 5500 revisio...

Mac OS X : Java for Mac OS X 10.6 Update 17

The remote Mac OS X host has a version of Java for Mac OS X 10.6 that is missing Update 17, which updates the Java version to 1.6.065. It is, therefore, affected by multiple security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the...

Fedora 18 : kernel-3.9.5-201.fc18 (2013-10695)

Update to the latest upstream stable release, Linux v3.9.5 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security fix : - Using the SGIO IOCTL to issue SCSI requests to partitions or LVM volumes resulted in the requests being passed to the underlying block device. If a privileged user only had access to a single...

RHEL 4 / 5 : java-1.5.0-sun (RHSA-2009:1199)

Updated java-1.5.0-sun packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. The Sun 1.5.0 Java release includes the Sun Java 5...

Debian DSA-1428-2 : linux-2.6 - several vulnerabilities

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : This is an update to DSA 1428-1 which omitted a reference...

Novell NetWare Web Server sewse.nlm (viewcode.jse) Traversal Arbitrary File Access

The installed version of Nombas ScriptEase Web Server Edition for NetWare on the remote host fails to sanitize input to the 'sewse.nlm' page and associated 'viewcode.jse' script before using it to display the source code of a file. By passing in a specially crafted URL argument, an attacker can...