Security Updates for Microsoft SQL Server (Uncredentialed Check) (February 2020)

The Microsoft SQL Server installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability : - A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests. An attacker who...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2020-5532)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5532 advisory. 2.6.39-400.319.1 - net-sysfs: Fix mem leak in netdevregisterkobject YueHaibing Orabug: 30350265 CVE-2019-15916 Tenable has extracted the preceding descripti...

KB4537794: Windows Server 2012 February 2020 Security Update

The remote Windows host is missing security update 4537794 or cumulative update 4537814. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server. An attacker who...

SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:2947-1)

The SUSE Linux Enterprise 15-SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exceptio...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1242-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

The SUSE Linux Enterprise 12 SP4 Azure kernel was updated to receive various security and bugfixes. Four new speculative execution information leak issues have been identified in Intel CPUs. bsc1111331 CVE-2018-12126: Microarchitectural Store Buffer Data Sampling MSBDS CVE-2018-12127:...

Fedora 29 : kernel / kernel-headers / kernel-tools (2019-164946aa7f)

The 4.20.8 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Security Updates for Microsoft Visual Studio Products (February 2019)

The Microsoft Visual Studio Products are missing a security update. It is, therefore, affected by the following vulnerability : - A remote code execution vulnerability exists in Visual Studio software when the software fails to check the source markup of a file. An attacker who successfully...

Photon OS 2.0: Linux PHSA-2018-2.0-0015

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-2.0-0015. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid121914...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3849-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3849-1 advisory. It was discovered that a NULL pointer dereference existed in the keyring subsystem of the Linux kernel. A local attacker could use this to cause a denial...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3621)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3621 advisory. - Bluetooth: Properly check L2CAP config option output buffer length Ben Seri Orabug: 26796364 CVE-2017-1000251 - xen: fix bio vec merging Roger Pa...

Scientific Linux Security Update : mariadb on SL7.x x86_64 (20170801)

The following packages have been upgraded to a later upstream version: mariadb 5.5.56. Security Fixes : - It was discovered that the mysql and mysqldump tools did not correctly handle database and table names containing newline characters. A database user with privileges to create databases or...

macOS 10.12.x < 10.12.5 Multiple Vulnerabilities

The remote host is running a version of macOS that is 10.12.x prior to 10.12.5. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption issues exist in the Kernel component that allow a local attacker to gain kernel-level privileges. CVE-2017-2494, CVE-2017-2546 - A...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1247-1)

The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2015-1350: The VFS subsystem in the Linux kernel provided an incomplete set of requirements for setattr operations that underspecifies removing extended...

openSUSE Security Update : the openSUSE Leap 42.1 kernel. (openSUSE-2016-1439)

The openSUSE Leap 42.1 kernel has been updated to fix a security issue : - CVE-2016-9576: A use-after-free vulnerability in the SCSI generic driver allows users with write access to /dev/sg or /dev/bsg to elevate their privileges bsc1013604. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Th...

MS16-155: Security Update for .NET Framework (3205640)

The remote Windows host is missing a security update. It is, therefore, affected by an information disclosure vulnerability in the .NET Framework Data Provider for SQL Server due to improper handling of developer-supplied keys. An unauthenticated, remote attacker can exploit this to disclose...

Debian DSA-3548-1 : samba - security update (Badlock)

Several vulnerabilities have been discovered in Samba, a SMB/CIFS file, print, and login server for Unix. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2015-5370 Jouni Knuutinen from Synopsys discovered flaws in the Samba DCE-RPC code which can lead to...

FreeBSD : php -- multiple vulnerabilities (85eb4e46-cf16-11e5-840f-485d605f4717)

PHP reports : - Core : - Fixed bug 71039 exec functions ignore length but look for NULL termination. - Fixed bug 71323 Output of streamgetmetadata can be falsified by its input. - Fixed bug 71459 Integer overflow in iptcembed. - PCRE : - Upgraded bundled PCRE library to 8.38.CVE-2015-8383,...

Debian DLA-177-1 : openssl security update

Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2015-0209 It was discovered that a malformed EC private key might result in memory corruption. CVE-2015-0286 Stephen...

RHEL 5 / 6 : java-1.7.0-oracle (RHSA-2014:0413)

Updated java-1.7.0-oracle packages that fix several security issues are now available for Oracle Java for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores, which give...

FreeBSD : PHP multiple vulnerabilities (d2a892b9-2605-11e4-9da0-00a0986f28c4)

The PHP Team reports : insecure temporary file use in the configure script unserialize SPL ArrayObject / SPLObjectStorage Type Confusion Heap buffer over-read in DateInterval fileinfo: cdfreadshortsector insufficient boundary check fileinfo: CDF infinite loop in nelements DoS fileinfo: fileinfo:...

RHEL 7 : httpd (RHSA-2014:0921)

Updated httpd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Fedora 20 : kernel-3.11.10-301.fc20 (2013-22818)

Fixes for SELinux issues and crashes related to bigkey krb functionality. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

MySQL Server COM_CHANGE_USER Command Security Bypass

The installed version of MySQL may be affected by a security bypass vulnerability because the salt used during password validation does not change when switching users with the 'COMCHANGEUSER' command. Additionally, the connection is not reset when invalid credentials are submitted. Normally, whe...

Mac OS X : Java for Mac OS X 10.6 Update 17

The remote Mac OS X host has a version of Java for Mac OS X 10.6 that is missing Update 17, which updates the Java version to 1.6.065. It is, therefore, affected by multiple security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary code with the...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2011-2025)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-2025 advisory. - Apply new fix for CVE-2011-1576. - net: Fix memory leak/corruption on VLAN GRODROP CVE-2011-1576 - iommu-api: Extension to check for interrupt...

Solaris 10 (sparc) : 150383-19 (deprecated)

SunOS 5.10: wanboot patch. Date this patch was last updated by Sun : Aug/13/17 This plugin has been deprecated and either replaced with individual 150383 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2018/03/1...

openSUSE Security Update : libfreebl3 (openSUSE-SU-2010:0904-1)

The Mozilla NSS Library was updated to version 3.12.8 and the Mozilla NSPR Library was updated to 4.8.6 to fix various bugs and one security issue. CVE-2010-3170: Disallow wildcard matching in X509 certificate Common Names. This update also has preparations for Firefox 4 support, and a updated Ro...

Debian DSA-2018-1 : php5 - DoS (crash)

Auke van Slooten discovered that PHP 5, an hypertext preprocessor, crashes because of a NULL pointer dereference when processing invalid XML-RPC requests. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Securit...

Safari < 3.1.2 Multiple Vulnerabilities

The version of Safari installed on the remote host reportedly is affected by several issues : - An out-of-bounds memory read while handling BMP and GIF images may lead to information disclosure CVE-2008-1573. - Safari will automatically launch executable files downloaded from a site if that site ...

Trend Micro Apex One Server Authentication Bypass (CVE-2022-40144)

Binary data trendmicroapexonecve-2022-40144.nbin...

SUSE SLES12 / SLES15 Security Update : kernel (Live Patch 17 for SLE 15 SP3) (SUSE-SU-2022:1988-1)

The remote SUSE Linux SLES12 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1988-1 advisory. - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACESEIZE code path allows attackers to bypass intended...

Oracle Linux 8 : virt:ol / and / virt-devel:ol (ELSA-2022-1759)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1759 advisory. - Limit recursion in ri-records CVE-2021-3622 resolves: rhbz1976194 - Fixes: CVE-2021-33285, CVE-2021-33286, CVE-2021-33287, CVE-2021-33289,...

SUSE SLES12: kgraft-patch-4_12_14-122_103-default / etc (SUSE-SU-2022:1580-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:1580-1 advisory. This update for the Linux Kernel 4.12.14-122103 fixes one issue. The following security issue was fixed: - CVE-2022-0330: A random memory access flaw w...

RHEL 7 : kernel (RHSA-2022:1324)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1324 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Use After Free in unixgc which...

openSUSE 15 Security Update : kernel (openSUSE-SU-2022:1039-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:1039-1 advisory. The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: -...

Ubuntu 20.04 LTS : Linux kernel (OEM) vulnerabilities (USN-5302-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5302-1 advisory. Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 releaseagent...

Oracle WebLogic Server (Jan 2022 CPU)

The 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2022 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Cor...

openSUSE 15 Security Update : kernel (openSUSE-SU-2021:3338-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3338-1 advisory. - A use-after-free flaw was found in the Linux kernel's Bluetooth subsystem in the way user calls connect to the socket and disconnect...

Ubuntu 18.04 LTS / 20.04 LTS : curl vulnerabilities (USN-5021-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5021-1 advisory. Harry Sintonen and Tomas Hoger discovered that curl incorrectly handled TELNET connections when the -t option was used on the command line...

CodeMeter Runtime Buffer Over-read (WIBU-210423-01)

Binary data codemetercve-2021-20093.nbin...

Microsoft 3D Viewer Multiple Vulnerabilities (June 2021)

The Windows '3D Viewer' app installed on the remote host is affected by multiple vulnerabilities. - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2021-31942, CVE-2021-31943 - An information disclosure...

CentOS 8 : firefox (CESA-2019:3196)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2019:3196 advisory. - Mozilla: Use-after-free when creating index updates in IndexedDB CVE-2019-11757 - Mozilla: Potentially exploitable crash due to 360 Total Security...

SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2020:3053-1)

This update for MozillaFirefox fixes the following issues : Firefox Extended Support Release 78.4.0 ESR - Fixed: Various stability, functionality, and security fixes MFSA 2020-46 bsc1177872, bsc1176756 - CVE-2020-15969 Use-after-free in usersctp - CVE-2020-15683 Memory safety bugs fixed in Firefo...

Oracle Linux 8 : qt5-qtbase / and / qt5-qtwebsockets (ELSA-2020-4690)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4690 advisory. qt5-qtbase 5.12.5-6 - OpenSSL: handle SSLshutdowns errors properly Resolves: bz1851538 5.12.5-5 - Fix: Files placed by attacker can influence the worki...

CentOS 7 : kernel (RHSA-2020:3220)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3220 advisory. - Insufficient access control in the IntelR PROSet/Wireless WiFi Software driver before version 21.10 may allow an unauthenticated user to potentially...

EulerOS 2.0 SP3 : python (EulerOS-SA-2020-1427)

According to the versions of the python packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Waveread.readfmtchunk function in Lib/wave.py in Python through 3.6.4 does not ensure a nonzero channel value, which allows attackers to cau...

Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20200311)

Security Fixes : - kernel: buffer overflow in cfg80211mgdwextgiwessid in net/wireless /wext-sme.c CVE-2019-17133 - kernel: unprivileged users able to create RAW sockets in AFISDN network protocol. CVE-2019-17055 Bug Fixes : - LACP bond does not function because bonding driver sees slave speed &...

RHEL 6 : kernel (RHSA-2019:4256)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:4256 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: Kernel: KVM: OOB memory access via mmio ring...

EulerOS 2.0 SP2 : openssl098e (EulerOS-SA-2019-2509)

According to the versions of the openssl098e package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared...

EulerOS Virtualization 2.5.4 : kernel (EulerOS-SA-2019-1229)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic...