SUSE SLES11 Security Update : libtcnative-1-0 (SUSE-SU-2016:2385-1) (Logjam)

This update for libtcnative-1-0 fixes the following issues : - CVE-2015-4000: Disable 512-bit export-grade cryptography to prevent Logjam vulnerability bsc938945 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

Ubuntu 12.04 LTS : linux vulnerability (USN-2928-1)

Andrey Konovalov discovered that the ALSA USB MIDI driver incorrectly performed a double-free. A local attacker with physical access could use this to cause a denial of service system crash or possibly execute arbitrary code with administrative privileges. Note that Tenable Network Security has...

Debian DLA-412-1 : linux-2.6 security update

This update fixes the CVEs described below. CVE-2015-7566 Ralf Spenneberg of OpenSource Security reported that the visor driver crashes when a specially crafted USB device without bulk-out endpoint is detected. CVE-2015-8767 An SCTP denial of service was discovered which can be triggered by a loc...

openSUSE Security Update : polarssl (openSUSE-2016-60) (SLOTH)

This update for polarssl fixes the following issues : - CVE-2015-7575: Disables by default MD5 handshake signatures in TLS 1.2 to prevent the SLOTH attack on TLS 1.2 server authentication boo961284 - boo961290: potential double free during certificate generation %NASLMINLEVEL 70300 C Tenable...

Ubuntu 15.04 : linux vulnerabilities (USN-2691-1)

Andy Lutomirski discovered a flaw in the Linux kernel's handling of nested NMIs non-maskable interrupts. An unprivileged local user could exploit this flaw to cause a denial of service system crash or potentially escalate their privileges. CVE-2015-3290 Colin King discovered a flaw in the addkey...

SUSE SLES11 Security Update : Xen (SUSE-SU-2014:0372-1)

The SUSE Linux Enterprise Server 11 Service Pack 2 LTSS Xen hypervisor and toolset has been updated to fix various security issues and several bugs. The following security issues have been addressed : XSA-88: CVE-2014-1950: Use-after-free vulnerability in the xccpupoolgetinfo function in Xen 4.1....

Slackware 14.0 / 14.1 / current : php (SSA:2015-111-10)

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2015-111-10. The text itself is copyright C...

RHEL 5 : java-1.7.0-ibm (RHSA-2015:0134)

Updated java-1.7.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-2252-1)

A bounds check error was discovered in the socket filter subsystem of the Linux kernel. A local user could exploit this flaw to cause a denial of service system crash via crafted BPF instructions. CVE-2014-3144 A remainder calculation error was discovered in the socket filter subsystem of the Lin...

Firefox ESR 24.x < 24.3 Multiple Vulnerabilities

The installed version of Firefox ESR 24.x is earlier than 24.3, and is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could result in a denial of service or arbitrary code execution. CVE-2014-1477 - An error exists related to...

Fedora 19 : libjpeg-turbo-1.2.90-3.fc19 (2013-23722)

Apply fixes CVE-2013-6629, CVE-2013-6630 1031737 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

ScMM DSL Modem/Router Backdoor Detection

The remote device is a DSL Modem/Router with a backdoor running on port 32764. It is possible for an attacker to run arbitrary commands or access configuration details including passwords on the device. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid71807;...

Ubuntu 10.04 LTS : linux vulnerabilities (USN-2064-1)

Stephan Mueller reported an error in the Linux kernel's ansi cprng random number generator. This flaw makes it easier for a local attacker to break cryptographic protections. CVE-2013-4345 A flaw was discovered in the Linux kernel's IP Virtual Server IPVS support. A local user with the CAPNETADMI...

Oracle Linux 6 : kernel (ELSA-2012-1426)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1426 advisory. - mm hugetlb: do not use vmahugecacheoffset for vmapriotreeforeach Frederic Weisbecker 843034 843035 CVE-2012-2133 - mm hugepages: fix use after free b...

CentOS 5 : kernel (CESA-2010:0661)

Updated kernel packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : openjdk-6, openjdk-7 vulnerabilities (USN-1724-1)

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure and data integrity. An attacker could exploit these to cause a denial of service. CVE-2012-1541, CVE-2012-3342, CVE-2013-0351, CVE-2013-0419, CVE-2013-0423, CVE-2013-0446, CVE-2012-3213, CVE-2013-0425,...

Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2010-3175, CVE-2010-3176, CVE-2010-3179, CVE-2010-3183,...

Mozilla Thunderbird 10.0.x < 10.0.6 Multiple Vulnerabilities

The installed version of Thunderbird 10.0.x is potentially affected by the following security issues : - Several memory safety issues exist, some of which could potentially allow arbitrary code execution. CVE-2012-1948 - Several memory safety issues exist related to the Gecko layout engine...

Firefox < 7.0 Multiple Vulnerabilities

The installed version of Firefox is earlier than 7.0 and thus, is potentially affected by the following security issues : - If an attacker could trick a user into holding down the 'Enter' key, via a malicious game, for example, a malicious application or extension could be downloaded and...

CGI Generic Tests Load Estimation (quick tests, HTML injection)

This script computes the maximum number of requests that would be done by the generic web tests, depending on miscellaneous options. It does not perform any test by itself. It adjusts the mode of each script if it is unable to run in the given time. The results can be used to estimate the duratio...

Debian DSA-2099-1 : openoffice.org - buffer overflows

Charlie Miller has discovered two vulnerabilities in OpenOffice.org Impress, which can be exploited by malicious people to compromise a user's system and execute arbitrary code. - An integer truncation error when parsing certain content can be exploited to cause a heap-based buffer overflow via a...

RHEL 4 / 5 : firefox (RHSA-2010:0332)

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0332 advisory. Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several use-after-fre...

Mandriva Linux Security Advisory : firefox (MDVSA-2009:290-1)

Security issues were identified and fixed in firefox 3.0.x : Security researcher Alin Rad Pop of Secunia Research reported a heap-based buffer overflow in Mozilla's string to floating point number conversion routines. Using this vulnerability an attacker could craft some malicious JavaScript code...

Slackware 11.0 / 12.0 / 12.1 / 12.2 / current : seamonkey (SSA:2009-176-01)

New seamonkey packages are available for Slackware 11.0, 12.0, 12.1, 12.2, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2009-176-01. The text itself ...

Global variable settings

This plugin configures miscellaneous global variables for Nessus plugins. It does not perform any security checks but may disable or change the behavior of others. TRUSTED...

Multiple Linux rpc.mountd Remote Overflow

The remote mount daemon seems to have a buffer overflow vulnerability. A remote attacker could exploit this to execute arbitrary code as root. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11337; scriptversion"1.18"; scriptcvsdate"Date: 2018/07/16 14:09:13";...

RHEL 8 : kpatch-patch-4_18_0-553_109_1, kpatch-patch-4_18_0-553_40_1, kpatch-patch-4_18_0-553_53_1, kpatch-patch-4_18_0-553_72_1, and kpatch-patch-4_18_0-553_85_1 (RHSA-2026:15976)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:15976 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module ...

Oracle Java SE Multiple Vulnerabilities (April 2025 CPU)

The versions of Java installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2025 CPU advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JavaFX gstreamer. Supported versions that are...

GLSA-202208-24 : GNU C Library: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202208-24 GNU C Library: Multiple Vulnerabilities - The wordexp function in the GNU C Library aka glibc through 2.33 may crash or read arbitrary memory in parseparam in posix/wordexp.c when called with an untrusted, crafted patter...

RHEL 8 : firefox (RHSA-2021:4605)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4605 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

VMware vCenter Server < 6.7 Multiple Vulnerabilities (VMSA-2021-0020)

The version of VMware vCenter Server installed on the remote host is 6.7 prior to 6.7 U3o. It is, therefore, affected by multiple vulnerabilities: - A privilege escalation vulnerability exists in vCenter Server due to the way it handles session tokens. An authenticated, local attacker can exploit...

Mozilla Thunderbird < 91.0

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-36 advisory. - Mozilla developers Kershaw Chang, Philipp, Chris Peterson, Sebastian Hengst, Christoph Kerschbaumer, Olli...

Debian DLA-2653-1 : libxml2 security update

Several vulnerabilities were discovered in libxml2, a library providing support to read, modify and write XML and HTML files, which could cause denial of service via application crash when parsing specially crafted files. For Debian 9 stretch, these problems have been fixed in version...

Amazon Linux 2 : perl (ALAS-2021-1610)

The version of perl installed on the remote host is prior to 5.16.3-299. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1610 advisory. Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers...

RHEL 8 : mariadb-connector-c (RHSA-2020:5655)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5655 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. The following...

Oracle Linux 6 : thunderbird (ELSA-2020-4947)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-4947 advisory. 78.4.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 78.4.0-1 - Update to 78.4.0 build1 - Disabled...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5804)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5804 advisory. - fs/binfmtelf.c: allocate initialized memory in fillthreadcoreinfo Alexander Potapenko Orabug: 31350638 CVE-2020-10732 - net-sysfs: call devhold if...

EulerOS Virtualization for ARM 64 3.0.6.0 : binutils (EulerOS-SA-2020-1363)

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simpleobjectelfmatch in...

Amazon Linux 2 : php (ALAS-2019-1344)

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code...

Apple iOS < 13.2 Multiple Vulnerabilities

Binary data appleios132check.nbin...

Oracle Linux 8 : kernel (ELSA-2019-2703)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2703 advisory. - wireless mwifiex: fix 802.11n/WPA detection Jarod Wilson 1714475 1714476 CVE-2019-3846 - x86 x86/entry/64: Use JMP instead of JMPQ Josh Poimboeuf...

SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2019:1345-1)

This update for java-171-ibm fixes the following issues : Update to Java 7.1 Service Refresh 4 Fix Pack 45. Security issues fixed : CVE-2019-10245: Fixed Java bytecode verifier issue causing crashes bsc1134718. CVE-2019-2698: Fixed out of bounds access flaw in the 2D component bsc1132729...

EulerOS Virtualization 3.0.1.0 : file (EulerOS-SA-2019-1424)

According to the versions of the file packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A denial of service flaw was found in the File Information fileinfo extension rules for detecting AWK files. A remote attacker coul...

CentOS 6 : java-1.8.0-openjdk (CESA-2019:0416)

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHEL 6 : kernel (RHSA-2018:2645)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2645 advisory. - kernel: TCP segments with random offsets allow a remote denial of service SegmentSmack CVE-2018-5390 Note that Nessus has not tested for this issue...

Fedora 27 : 3:mariadb (2018-d1c4a4ca50)

MariaDB 10.2.17 Release notes : https://mariadb.com/kb/en/library/mariadb-10217-release-notes/ CVEs fixed : CVE-2018-3060 CVE-2018-3064 CVE-2018-3063 CVE-2018-3058 CVE-2018-3066 CVE-2018-3081 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2367-1) (Foreshadow)

This update for the Linux Kernel 3.12.74-606466 fixes several issues. The following security issues were fixed : - CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other...

SUSE SLES11 Security Update : gcc43 (SUSE-SU-2018:1498-1) (Spectre)

This update for gcc43 fixes the following issues: This update adds support for 'expolines' on s390x, allowing fixing CVE-2017-5715 in a more lightweight fashion. bsc1086069 The option flags are the same as for the x86 retpolines. A compiler crash when building userland packages with x86 retpoline...

SUSE SLES12 Security Update : CaaS Platform 2.0 images (SUSE-SU-2018:0053-1)

The Docker images provided with SUSE CaaS Platform 2.0 have been updated to include the following updates: binutils : - Update to version 2.29 - 18750 bsc1030296 CVE-2014-9939 - 20891 bsc1030585 CVE-2017-7225 - 20892 bsc1030588 CVE-2017-7224 - 20898 bsc1030589 CVE-2017-7223 - 20905 bsc1030584...

DNN (DotNetNuke) 5.2.0 < 9.1.1 Multiple Vulnerabilities

The version of DNN Platform formerly DotNetNuke running on the remote host is 5.2.0 or later but prior to 9.1.1. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists due to insecure use of web cookies to identify users. An unauthenticated, remote...