EulerOS Virtualization 2.5.3 : glibc (EulerOS-SA-2019-1260)

According to the version of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - In the GNU C Library aka glibc or libc6 through 2.29, proceednextnode in posix/regexec.c has a heap-based buffer over-read via an...

MySQL 5.6.x < 5.6.43 Multiple Vulnerabilities (Jan 2019 CPU)

The version of MySQL running on the remote host is 5.6.x prior to 5.6.43. It is, therefore, affected by multiple vulnerabilities, including three of the top vulnerabilities below, as noted in the January 2019 Critical Patch Update advisory: - An unspecified vulnerability in MySQL in the 'Server:...

OracleVM 3.4 : xen (OVMSA-2018-0248) (Bunker Buster) (Foreshadow) (Meltdown) (POODLE) (Spectre)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0248 for details. C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory OVMSA-2018-0248...

Oracle Linux 7 : qemu-kvm (ELSA-2018-2462)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-2462 advisory. - Resolves: bz1549824 CVE-2018-7550 qemu-kvm: Qemu: i386: multiboot OOB access while loading kernel image rhel-7.5.z - Resolves: bz1586248 CVE-2018-118...

SUSE SLES11 Security Update : kernel (SUSE-SU-2017:3265-1) (KRACK)

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-16649: The usbnetgenericcdcbind function in drivers/net/usb/cdcether.c in the Linux kernel allowed local users to cause a denial of service...

HP Data Protector 8.x < 8.17 / 9.x < 9.09 Multiple Vulnerabilities (HPSBGN03732)

The version of HP Data Protector installed on the remote host is 8.x prior to 8.17, or 9.x prior to 9.09. It is, therefore, affected by the following vulnerabilities : - HPE Data Protector contains an unspecified overflow condition that is triggered as certain input is not properly validated. Thi...

openSUSE Security Update : the Linux Kernel (openSUSE-2016-1076)

The openSUSE Leap 42.1 kernel was updated to 4.1.31 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2016-2847: fs/pipe.c in the Linux kernel did not limit the amount of unread data in pipes, which allowed local users to cause a denial of service memory...

Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2015-616)

Multiple flaws were discovered in the CORBA, Libraries, RMI, Serialization, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. CVE-2015-4835 , CVE-2015-4881 , CVE-2015-4843 , CVE-2015-4883 , CVE-2015-4860 ,...

RHEL 5 / 6 / 7 : java-1.6.0-sun (RHSA-2015:0858)

Updated java-1.6.0-sun packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detaile...

Oracle Linux 4 : glibc (ELSA-2015-0101) (GHOST)

From Red Hat Security Advisory 2015:0101 : Updated glibc packages that fix one security issue are now available for Red Hat Enterprise Linux 4 Extended Life Cycle Support. Red Hat Product Security has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS...

Ubuntu 10.04 LTS : linux vulnerabilities (USN-2441-1)

An information leak in the Linux kernel was discovered that could leak the high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine KVM paravirt guests. A user in the guest OS could exploit this leak to obtain information that could potentially be used to aid in attacking the...

SuSE 11.3 Security Update : IBM Java (SAT Patch Number 9615)

java-160-ibm has been updated to fix ten security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is copyright C Novell, Inc. if NASLLEVEL 3000 exit0;...

CentOS 5 / 6 : firefox / xulrunner (CESA-2013:0696)

Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings...

RHEL 5 : kernel (RHSA-2009:1672)

Updated kernel packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 5.2 Extended Update Support. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the...

Scientific Linux Security Update : java-1.6.0-openjdk on SL6.x i386/x86_64 (20120613)

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. Multiple flaws were discovered in the CORBA Common Object Request Broker Architecture implementation in Java. A malicious Java application or applet could use these flaws to bypass Java sandb...

PCI DSS Compliance : Database Reachable from the Internet

The remote host is running a database server that is reachable from the Internet. This violates PCI DSS, section 1.3.7. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid57581; scriptversion"1.13"; scriptsetattributeattribute:"pluginmodificationdate", value:"2020/04/27"...

Mac OS X : Java for Mac OS X 10.6 Update 6 (BEAST)

The remote Mac OS X host is running a version of Java for Mac OS X 10.6 that is missing Update 6, which updates the Java version to 1.6.029. It is, therefore, affected by multiple security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with...

OpenSSH < 4.9 'ForceCommand' Directive Bypass

According to its banner, the version of OpenSSH installed on the remote host is earlier than 4.9. It may allow a remote, authenticated user to bypass the 'sshdconfig' 'ForceCommand' directive by modifying the '.ssh/rc' session file. C Tenable, Inc. include"compat.inc"; if description scriptid4407...

Firefox < 3.0.18 Multiple Vulnerabilities

The installed version of Firefox is earlier than 3.0.18. Such versions are potentially affected by the following security issues : - Multiple crashes can result in arbitrary code execution. MFSA 2010-01 - The implementation of 'Web Workers' contained an error in its handling of array data types...

openSUSE 10 Security Update : libxml (libxml-6477)

This update of libxml does not use pointers after they were freed anymore. CVE-2009-2416 Additionally a stack-based buffer overflow was fixed while parsing the root XML document. CVE-2009-2414 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Fedora 9 : kernel-2.6.27.12-78.2.8.fc9 (2009-0816)

Update to kernel 2.6.27.12: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.10 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.11 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.12 Includes security fixes: CVE-2009-0029 Linux Kernel insecure 64 bit system ca...

RHEL 6 : openssh (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - openssh: loading of untrusted PKCS11 modules in ssh-agent CVE-2016-10009 - openssh: scp allows command...

Dell EMC NetWorker RCE (DSA-2023-041)

The version of Dell EMC NetWorker installed on the remote Windows host is affected by a remote code execution vulnerability in the NetWorker Client execution service nsrexecd irrespective of any auth used. Note that Nessus has not tested for this issue but has instead relied only on the...

Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2022-9412)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-9412 advisory. 4.14.35-2047.513.2.1.el7 - perf: Fix sysperfeventopen race against self Peter Zijlstra Orabug: 34175592 CVE-2022-1729 Tenable has extracted the preceding...

RHEL 8 : thunderbird (RHSA-2022:0123)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0123 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.5.0. Security Fixes: Mozilla:...

KB5007255: Windows 8.1 and Windows Server 2012 R2 Security Update (November 2021)

The remote Windows host is missing security update 5007255 or cumulative update 5007247. It is, therefore, affected by multiple vulnerabilities: - A denial of service DoS vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services...

openSUSE 15 Security Update : nodejs10 (openSUSE-SU-2021:2353-1)

"The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2353-1 advisory. - This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require'y18n' %NASLMINLEVEL 70300 C Tenable...

CentOS 8 : thunderbird (CESA-2019:1308)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:1308 advisory. - mozilla: Cross-origin theft of images with ImageBitmapRenderingContext CVE-2018-18511 - Mozilla: Use-after-free in XMLHttpRequest CVE-2019-11691 -...

CentOS 8 : firefox (CESA-2019:3196)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:3196 advisory. - Mozilla: Use-after-free when creating index updates in IndexedDB CVE-2019-11757 - Mozilla: Potentially exploitable crash due to 360 Total Security...

F5 Networks BIG-IP : Linux kernel vulnerability (K32804955)

The Linux kernel 4.x starting from 4.1 and 5.x before 5.0.8 allows Information Exposure partial kernel address disclosure, leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols e.g....

RHEL 7 / 8 : OpenShift Container Platform 4.6.1 (RHSA-2020:4297)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4297 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use...

EulerOS 2.0 SP9 : kernel (EulerOS-SA-2020-2176)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic functions of the...

RHEL 7 : java-1.8.0-openjdk (RHSA-2020:2968)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2968 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...

RHEL 7 : grub2 (RHSA-2020:3276)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3276 advisory. The grub2 packages provide version 2 of the Grand Unified Boot Loader GRUB, a highly configurable and customizable boot loader with modular...

Fedora 32 : python27 (2020-e9251de272)

Avoid infinite loop when reading specially crafted TAR files CVE-2019-20907 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

SUSE SLES12 Security Update : openldap2 (SUSE-SU-2020:1210-1)

This update for openldap2 fixes the following issues : CVE-2020-12243: Fixed a denial of service related to recursive filters bsc1170771. CVE-2019-13565: Fixed an authentication bypass caused by incorrect authorization of another connection, granting excess connection rights bsc1143194...

Ubuntu 18.04 LTS : WebKitGTK+ vulnerabilities (USN-4281-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4281-1 advisory. A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, ...

Scientific Linux Security Update : firefox on SL7.x x86_64 (20190524)

This update upgrades Firefox to version 60.7.0 ESR. Security Fixes : - Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 CVE-2019-9800 - Mozilla: Cross-origin theft of images with createImageBitmap CVE-2019-9797 - Mozilla: Type confusion with object groups and UnboxedObjects...

openSUSE Security Update : ImageMagick (openSUSE-2019-1141)

This update for ImageMagick fixes the following issues : Security issues fixed : - CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function bsc1128649. - CVE-2018-18544: Fixed a memory leak in the function WriteMSLImage bsc1113064. - CVE-2018-20467: Fixed an infinite loop in coders/bmp....

F5 Networks BIG-IP : Kernel vulnerability (K62442245)

The tcpchecksendhead function in include/net/tcp.h in the Linux kernel before 4.7.5 does not properly maintain certain SACK state after a failed data copy, which allows local users to cause a denial of service tcpxmitretransmitqueue use-after-free and system crash via a crafted SACK option...

RHEL 7 : JBoss Core Services (RHSA-2017:1413)

An update is now available for Red Hat JBoss Core Services on RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Dell iDRAC Products Multiple Vulnerabilities (June 2018)

The remote host is running iDRAC6 with a firmware version prior to 2.91, iDRAC7 or iDRAC8 with a firmware version prior to 2.60.60.60, or iDRAC9 with a firmware version prior to 3.21.21.21 and is therefore affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerability (USN-3732-2)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3732-2 advisory. USN-3732-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2106-1)

This update for the Linux Kernel 3.12.74-606488 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data fr...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2087-1)

This update for the Linux Kernel 3.12.74-606493 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data fr...

Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20180521) (Spectre)

Security Fixes : - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions a commonly used performance optimization. It relies on the presence of a precisely-defined instruction sequence in the privileged...

EulerOS 2.0 SP1 : qemu-kvm (EulerOS-SA-2017-1223)

According to the versions of the qemu-kvm package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An out-of-bounds memory access issue was found in Quick Emulator QEMU in the VNC display driver. This flaw could occur while refreshing the VNC...

Virtuozzo 7 : readykernel-patch (VZA-2017-077)

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - The ip6appenddata function in net/ipv6/ip6output.c in the Linux kernel through 4.11.3 is too late in checking whethe...

Veritas NetBackup 7.7.x / 8.0.x Multiple Vulnerabilities (VTS17-004)

The Veritas NetBackup application installed on the remote Windows host is 7.7.x or 8.0.x and may be missing a vendor-supplied security hotfix. It is, therefore, affected by multiple vulnerabilities : - A remote command execution vulnerability exists in the bprd process due to improper directory...

RHEL 6 / 7 : java-1.8.0-openjdk (RHSA-2016:1458)

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...