Debian DLA-2397-1 : php7.0 security update

A vulnerability was discovered in PHP, a server-side, HTML-embedded scripting language. When PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like Host confused with cookies that decode to such prefix, thus leading to an...

Debian DLA-2333-1 : imagemagick security update

Several security vulnerabilities were fixed in Imagemagick. Various memory handling problems and cases of missing or incomplete input sanitizing may result in denial of service, memory or CPU exhaustion, information disclosure or potentially the execution of arbitrary code when a malformed image...

Fedora 31 : php (2020-8e36afc743)

PHP version 7.3.21 06 Aug 2020 Apache: - Fixed bug php79030 Upgrade apache2handler's phpapachesapigetrequesttime to return usec. Herbert256 Core: - Fixed bug php79877 getimagesize function silently truncates after a null byte cmb - Fixed bug php79778 Assertion failure if dumping closure with...

Photon OS 1.0: Mysql PHSA-2020-1.0-0292

An update of the mysql package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0292. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid136556...

Fedora 30 : php (2019-437d94e271)

PHP version 7.3.13 18 Dec 2019 Bcmath: - Fixed bug php78878 Buffer underflow in bcshiftaddsub. CVE-2019-11046. cmb Core: - Fixed bug php78862 link silently truncates after a null byte on Windows. CVE-2019-11044. cmb - Fixed bug php78863 DirectoryIterator class silently truncates after a null byte...

EulerOS 2.0 SP3 : libtiff (EulerOS-SA-2019-2621)

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - DISPUTED LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service memory consumption, as...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4145-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4145-1 advisory. It was discovered that a race condition existed in the GFS2 file system in the Linux kernel. A local attacker could possibly use this to cause a denial o...

RHEL 6 : kernel-rt (RHSA-2019:2730)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2730 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

EulerOS Virtualization for ARM 64 3.0.2.0 : glibc (EulerOS-SA-2019-1703)

According to the version of the glibc packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - The iconv program in the GNU C Library aka glibc or libc6 2.25 and earlier, when invoked with the -c option, enters an...

Ubuntu 14.04 LTS : linux-lts-xenial vulnerabilities (USN-3982-2) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

USN-3982-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 for Ubuntu 14.04 LTS. Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan Horea Lutas,...

openSUSE Security Update : MozillaFirefox (openSUSE-2019-1056)

This update for MozillaFirefox fixes the following issues : Mozilla Firefox was updated to 60.6.1esr MFSA 2019-10 boo1130262 - CVE-2019-9810: IonMonkey MArraySlice has incorrect alias information - CVE-2019-9813: Ionmonkey type confusion with proto mutations Mozilla Firefox was updated to 60.6.0e...

openSUSE Security Update : the Linux Kernel (openSUSE-2018-826)

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-5390 aka 'SegmentSmack': A remote attacker even with relatively low bandwidth could have caused lots of CPU usage by triggering the worst case scenario during IP...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2110-1)

This update for the Linux Kernel 3.12.74-606496 fixes one issue. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from...

Apache Zookeeper x < 3.4.10 / 3.5.x < 3.5.4 Missing Authentication Remote Quorum Joining Vulnerability

The instance of Apache Zookeeper listening on the remote host is either running a version that does not support quorum authentication or has not been configured to use quorum authentication. This may allow a remote attacker to join a cluster quorum and begin propagating counterfeit changes to the...

Fedora 26 : hostapd (2017-45044b6b33) (KRACK)

Latest hostapd release with KRACK patches applied. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Security Updates for Microsoft Sharepoint Server (October 2017)

The Microsoft Sharepoint Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an...

Fedora 26 : jackson-databind (2017-6a75c816fa)

Security fix for CVE-2017-7525 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

Windows Server 2012 May 2017 Security Updates

The remote Windows host is missing security update 4019214 or cumulative update 4019216. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in the Windows COM Aggregate Marshaler due to an unspecified flaw. A local attacker can exploit this,...

EulerOS 2.0 SP1 : java-1.7.0-openjdk (EulerOS-SA-2016-1015)

According to the versions of the java-1.7.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Multiple flaws were discovered in the Serialization and Hotspot components in OpenJDK. An untrusted Java application or applet could...

Debian DLA-849-1 : linux security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or have other impacts. CVE-2016-9588 Jim Mattson discovered that the KVM implementation for Intel x86 processors does not properly handle BP and OF exceptions in an L2 neste...

Fedora 23 : community-mysql-5.6.29-1.fc23 (2016-65a1f22818)

This is an update to 5.6.29 that delivers also all fixes for CVE-2015-4766, CVE-2015-4791, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862,...

Scientific Linux Security Update : NetworkManager on SL7.x x86_64 (20151119)

It was discovered that NetworkManager would set device MTUs based on MTU values received in IPv6 RAs Router Advertisements, without sanity checking the MTU value first. A remote attacker could exploit this flaw to create a denial of service attack, by sending a specially crafted IPv6 RA packet to...

Debian DSA-3364-1 : linux - security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation or denial of service. - CVE-2015-8215 It was discovered that NetworkManager would set IPv6 MTUs based on the values received in IPv6 RAs Router Advertisements, without sufficiently validating...

F5 Networks BIG-IP : Linux kernel vulnerability (K17241)

The vdsoaddr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD. CVE-2014-9585 Impact When exploite...

Oracle Linux 6 / 7 : java-1.8.0-openjdk (ELSA-2015-0809)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0809 advisory. 1:1.8.0.45-30.b13 - repacked sources - Resolves: RHBZ1209076 1:1.8.0.45-7.b13 - Re-add %name prefix to patches to avoid conflicts with OpenJDK 7...

GLSA-201502-15 : Samba: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201502-15 Samba: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Samba. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker may be able to execute arbitra...

CentOS 5 : samba3x (CESA-2015:0249)

Updated samba3x packages that fix one security issue are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fro...

Amazon Linux AMI : xerces-j2 (ALAS-2014-436)

A resource consumption issue was found in the way Xerces-J handled XML declarations. A remote attacker could use an XML document with a specially crafted declaration using a long pseudo-attribute name that, when parsed by an application using Xerces-J, would cause that application to use an...

Fedora 21 : kernel-3.16.3-300.fc21 (2014-11097)

Linux v3.16.3. Various bugfixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Oracle Linux 7 : unbreakable enterprise kernel (ELSA-2014-3049)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3049 advisory. - l2tp: fix an unprivileged user to kernel privilege escalation Sasha Levin Orabug: 19229497 CVE-2014-4943 CVE-2014-4943 - ptrace,x86: force IRET path...

openSUSE Security Update : java-1_7_0-openjdk (openSUSE-SU-2013:1288-1)

java-170-openjdk was updated to icedtea-2.4.1 bnc828665 - Security fixes - S6741606, CVE-2013-2407: Integrate Apache Santuario - S7158805, CVE-2013-2445: Better rewriting of nested subroutine calls - S7170730, CVE-2013-2451: Improve Windows network stack support. - S8000638, CVE-2013-2450: Improv...

SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 9185)

This Mozilla Firefox and Mozilla NSS update to 24.5.0esr fixes the following several security and non-security issues : - Miscellaneous memory safety hazards. MFSA 2014-34 / CVE-2014-1518 - Out of bounds read while decoding JPG images. MFSA 2014-37 / CVE-2014-1523 - Buffer overflow when using...

KB2915720: Changes in Windows Authenticode Signature Verification

The remote Windows host has not enabled the Windows Authenticode signature verification certificate padding check. This means extraneous information can be included in signed binaries. Note that Microsoft announced on July 29, 2014, that it no longer plans to enforce the stricter signature...

Amazon Linux AMI : java-1.6.0-openjdk (ALAS-2013-185)

Multiple flaws were discovered in the font layout engine in the 2D component. An untrusted Java application or applet could possibly use these flaws to trigger Java Virtual Machine memory corruption. CVE-2013-1569 , CVE-2013-2383 , CVE-2013-2384 Multiple improper permission check issues were...

CentOS 3 / 5 : httpd (CESA-2009:1579)

Updated httpd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular Web server. A flaw was found in the way the...

IBM Rational ClearQuest Installed

IBM Rational ClearQuest, change management software for development, is installed on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid61564; scriptversion"1.7"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/10/10";...

FreeBSD : mozilla -- multiple vulnerabilities (6c8ad3e8-0a30-11e1-9580-4061862b8c22)

The Mozilla Project reports : MFSA 2011-46 loadSubScript unwraps XPCNativeWrapper scope parameter 1.9.2 branch MFSA 2011-47 Potential XSS against sites using Shift-JIS MFSA 2011-48 Miscellaneous memory safety hazards rv:8.0 MFSA 2011-49 Memory corruption while profiling using Firebug MFSA 2011-50...

CentOS 5 : postgresql84 (CESA-2011:1378)

Updated postgresql84 packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

Ubuntu 8.04 LTS / 10.04 LTS : firefox, firefox-3.0, xulrunner-1.9.2 vulnerabilities (USN-930-1)

If was discovered that Firefox could be made to access freed memory. If a user were tricked into viewing a malicious site, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.0...

Fedora 10 : kernel-2.6.27.12-170.2.5.fc10 (2009-0923)

Update to kernel 2.6.27.12: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.10 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.11 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.12 Includes security fixes: CVE-2009-0029 Linux Kernel insecure 64 bit system ca...

PowerDNS Version Detection

The remote host is running PowerDNS, an open source DNS server. It was possible to extract the version number of the remote installation by sending a special DNS request for the text 'version.pdns' in the domain 'chaos'. C Tenable Network Security, Inc. include"compat.inc"; if description...

RHEL 3 / 5 : php (RHSA-2008:0544)

Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web...

Mac OS X Multiple Vulnerabilities (Security Update 2005-005)

Binary data 2878.prm...

CDE RPC tooltalk Service Multiple Overflows

The tooltalk RPC service is running. A possible implementation fault in the ToolTalk object database server may allow an attacker to execute arbitrary commands as root. This warning may be a false positive since the presence of this vulnerability is only accurately identified with local access. C...

nginx 1.25.x < 1.25.4 DoS

The installed version of nginx is 1.25.x prior to 1.25.4. It may, therefore, affected by the following vulnerabilities: - When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is...

CentOS 8 : openssh (CESA-2024:0606)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0606 advisory. - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integri...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.3)

The version of AOS installed on the remote host is prior to 5.11.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.11.3 advisory. - A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver...

EulerOS 2.0 SP10 : kernel (EulerOS-SA-2022-1781)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in the Linux kernel's cgroupreleaseagentwrite in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain...

AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2022:1759)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:1759 advisory. QEMU: virtio-net: heap use-after-free in virtionetreceivercu CVE-2021-3748 ntfs-3g: Out-of-bounds heap buffer access in ntfsgetattributevalue due to...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-018)

The version of kernel installed on the remote host is prior to 5.4.80-40.140. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-018 advisory. A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing ...