EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-1972)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB device in the drivers/usb/misc/rio500...

Photon OS 3.0: Linux PHSA-2019-3.0-0030

An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-3.0-0030. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid129163;...

Oracle Linux 6 : kernel (ELSA-2019-2736)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2736 advisory. - scsi scsi: megaraidsas: return error when create DMA pool failed Tomas Henzl 1712858 CVE-2019-11810 - net net: Set skprotcreator when copying sockets...

openSUSE Security Update : go1.12 (openSUSE-2019-2000) (Ping Flood) (Reset Flood)

This update for go1.12 fixes the following issues : Security issues fixed : - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth. bsc1146111 - CVE-2019-9514: Fixed HTTP/2 implementation is vulnerable to a reset flood, potentially leading to a denial of...

CentOS 7 : firefox (CESA-2019:1603)

An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

EulerOS 2.0 SP5 : glibc (EulerOS-SA-2019-1667)

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - elf/dl-load.c in the GNU C Library aka glibc or libc6 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged setuid o...

openSUSE Security Update : the Linux Kernel (openSUSE-2019-1570) (SACK Panic) (SACK Slowness)

Example: The openSUSE Leap 42.3 kernel was updated to 4.4.180 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2019-11477: A sequence of SACKs may have been crafted by a remote attacker such that one can trigger an integer overflow, leading to a kernel pani...

SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1425-1)

This update for the Linux Kernel 3.12.74-6064110- fixes one issue. The following security issue was fixed : CVE-2018-5390: The Linux kernel could be forced to make very expensive calls to tcpcollapseofoqueue and tcppruneofoqueue for every incoming packet which can lead to a denial of service...

EulerOS Virtualization 2.5.4 : kvm (EulerOS-SA-2019-1372)

According to the version of the kvm package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor implements its device control API. While creating ...

openSUSE Security Update : ImageMagick (openSUSE-2019-1141)

This update for ImageMagick fixes the following issues : Security issues fixed : - CVE-2019-7175: Fixed multiple memory leaks in DecodeImage function bsc1128649. - CVE-2018-18544: Fixed a memory leak in the function WriteMSLImage bsc1113064. - CVE-2018-20467: Fixed an infinite loop in coders/bmp....

SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2018:3920-1)

java-170-ibm is updated to Java 7.0 Service Refresh 10 Fix Pack 35 bsc1116574 : Class Libraries - IJ10934 CVE-2018-13785 - IJ10935 CVE-2018-3136 - IJ10895 CVE-2018-3139 - IJ10932 CVE-2018-3149 - IJ10894 CVE-2018-3180 - IJ10933 CVE-2018-3214 - IJ09315 FLOATING POINT EXCEPTION FROM...

Photon OS 1.0: Httpd PHSA-2017-0027 (deprecated)

An update of httpd packages for PhotonOS has been released. File data PhotonOSPHSA-2017-0027.nasl...

Apache Zookeeper x < 3.4.10 / 3.5.x < 3.5.4 Missing Authentication Remote Quorum Joining Vulnerability

The instance of Apache Zookeeper listening on the remote host is either running a version that does not support quorum authentication or has not been configured to use quorum authentication. This may allow a remote attacker to join a cluster quorum and begin propagating counterfeit changes to the...

RHEL 6 : java-1.8.0-ibm (RHSA-2018:1722)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1722 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE ...

Scientific Linux Security Update : libvirt on SL7.x x86_64 (20180522) (Spectre)

Security Fixes : - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions a commonly used performance optimization. It relies on the presence of a precisely-defined instruction sequence in the privileged...

Debian DSA-4196-1 : linux - security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation or denial of service. - CVE-2018-1087 Andy Lutomirski discovered that the KVM implementation did not properly handle DB exceptions while deferred by MOV SS/POP SS, allowing an unprivileged KVM...

Oracle Java SE Multiple Vulnerabilities (January 2018 CPU)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 9 Update 4, 8 Update 161, 7 Update 171, or 6 Update 181. It is, therefore, affected by multiple vulnerabilities related to the following components : - AWT - Deployment - Hotspot - I18n -...

PHP 7.0.x < 7.0.25 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.25. It is, therefore, affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid104632;...

Windows 7 and Windows Server 2008 R2 October 2017 Security Updates (KRACK)

The remote Windows host is missing security update 4041678 or cumulative update 4041681. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in...

Oracle Linux 7 : kernel (ELSA-2017-1308)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-1308 advisory. - net packet: fix overflow in check for tpreserve Hangbin Liu 1441171 1441172 CVE-2017-7308 - net packet: fix overflow in check for tpframenr Hangbin L...

SUSE SLES12 Security Update : kernel (SUSE-SU-2017:0770-1)

This update for the Linux Kernel 3.12.60-5257 fixes one issue. The following security bug was fixed : - CVE-2017-5970: The ipv4pktinfoprepare function in net/ipv4/ipsockglue.c in the Linux kernel allowed attackers to cause a denial of service system crash via 1 an application that made crafted...

Ubuntu 12.04 LTS : linux, linux-ti-omap4 vulnerability (USN-3218-1)

Alexander Popov discovered that the NHDLC line discipline implementation in the Linux kernel contained a double-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly gain administrative privileges. Note that Tenable Network Security has extracte...

SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:0571-1)

This update for xen fixes several issues. These security issues were fixed : - CVE-2017-2620: In CIRRUSBLTMODEMEMSYSSRC mode the bitblit copy routine cirrusbitbltcputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation bsc1024834. -...

Scientific Linux Security Update : kernel on SL7.x x86_64 (20160512)

Security Fixes : - A flaw was found in the way the Linux kernel's ASN.1 DER decoder processed certain certificate files with tags of indefinite length. A local, unprivileged user could use a specially crafted X.509 certificate DER file to crash the system or, potentially, escalate their privilege...

Fedora 23 : community-mysql-5.6.29-1.fc23 (2016-65a1f22818)

This is an update to 5.6.29 that delivers also all fixes for CVE-2015-4766, CVE-2015-4791, CVE-2015-4792, CVE-2015-4800, CVE-2015-4802, CVE-2015-4807, CVE-2015-4815, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830, CVE-2015-4833, CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4862,...

RHEL 7 : kernel (RHSA-2015:2152)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:2152 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. A flaw was found in the way the Linux kernel's file...

RHEL 6 : php (RHSA-2015:1218)

Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for...

F5 Networks BIG-IP : Path MTU discovery vulnerability (K15792)

Multiple TCP/IP and ICMP implementations, when using Path MTU PMTU discovery PMTUD, allow remote attackers to cause a denial of service network throughput reduction for TCP connections via forged ICMP 'Fragmentation Needed and Don't Fragment was Set' packets with a low next-hop MTU value, aka the...

Debian DSA-3290-1 : linux - security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, information leaks or data corruption. - CVE-2015-1805 Red Hat discovered that the pipe iovec read and write implementations may iterate over the iovec twice but will modify...

SUSE SLED12 / SLES12 Security Update : Security Update for Linux Kernel (SUSE-SU-2015:0658-1)

The SUSE Linux Enterprise Server 12 kernel was updated to 3.12.39 to receive various security and bugfixes. Following security bugs were fixed : - CVE-2015-0777: The XEN usb backend could leak information to the guest system due to copying uninitialized memory. - CVE-2015-2150: Xen and the Linux...

Scientific Linux Security Update : java-1.6.0-openjdk on SL5.x, SL6.x, SL7.x i386/x86_64 (20150126) (POODLE)

A flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions. CVE-2014-6601 Multiple improper permission check issues were discovered in the JAX-WS, and...

Oracle Solaris Third-Party Patch Update : ntp (cve_2013_5211_input_validation)

The remote Solaris system is missing necessary patches to address security updates : - The monlist feature in ntprequest.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service traffic amplification via forged 1 REQMONGETLIST or 2 REQMONGETLIST1 requests, as exploite...

RHEL 6 : kernel (RHSA-2013:1026)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1026 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues: A...

RHEL 6 : kernel-rt (RHSA-2012:1150)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1150 advisory. The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues: A...

openSUSE Security Update : kernel (openSUSE-SU-2014:0856-1)

The Linux kernel was updated to fix security issues and bugs : Security issues fixed: CVE-2014-3153: The futexrequeue function in kernel/futex.c in the Linux kernel did not ensure that calls have two different futex addresses, which allowed local users to gain privileges via a crafted FUTEXREQUEU...

openSUSE Security Update : MozillaThunderbird (MozillaThunderbird-4458)

Mozilla Thunderbird was updated to the 3.1.10 security release. MFSA 2011-12: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain...

Scientific Linux Security Update : struts on SL5.x i386/x86_64 (20140507)

It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass method. A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution...

Scientific Linux Security Update : php53 and php on SL5.x, SL6.x i386/x86_64 (20131211)

A memory corruption flaw was found in the way the opensslx509parse function of the PHP openssl extension parsed X.509 certificates. A remote attacker could use this flaw to provide a malicious self-signed certificate or a certificate signed by a trusted authority to a PHP application using the...

KB2915720: Changes in Windows Authenticode Signature Verification

The remote Windows host has not enabled the Windows Authenticode signature verification certificate padding check. This means extraneous information can be included in signed binaries. Note that Microsoft announced on July 29, 2014, that it no longer plans to enforce the stricter signature...

Ubuntu 12.10 / 13.04 : openjdk-7 vulnerabilities (USN-1907-1)

Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure and data integrity. An attacker could exploit these to expose sensitive data over the network. CVE-2013-1500, CVE-2013-2454, CVE-2013-2458 A vulnerability was discovered in the OpenJDK Javadoc related to...

Oracle Linux 4 : kernel (ELSA-2010-0474)

From Red Hat Security Advisory 2010:0474 : Updated kernel packages that fix three security issues and several bugs are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CV...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel Security (ELSA-2013-2519)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-2519 advisory. - KVM: x86: Convert MSRKVMSYSTEMTIME to use gfntohvacache functions CVE-2013-1797 Andy Honig Orabug: 16711660 CVE-2013-1797 - Bluetooth: Fix...

Ubuntu 10.04 LTS : linux vulnerabilities (USN-1899-1)

Dmitry Monakhov reported a race condition flaw the Linux ext4 filesystem that can expose stale data. An unprivileged user could exploit this flaw to cause an information leak. CVE-2012-4508 An information leak was discovered in the Linux kernel's tkill and tgkill system calls when used from compa...

Ubuntu 12.04 LTS : linux-lts-quantal vulnerabilities (USN-1834-1)

A buffer overflow vulnerability was discovered in the Broadcom tg3 ethernet driver for the Linux kernel. A local user could exploit this flaw to cause a denial of service crash the system or potentially escalate privileges on the system. CVE-2013-1929 A flaw was discovered in the Linux kernel's...

RHEL 6 : firefox (RHSA-2013:0696)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0696 advisory. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found ...

FreeBSD : mozilla -- multiple vulnerabilities (a4ed6632-5aa9-11e2-8fcb-c8600054b392)

The Mozilla Project reports : MFSA 2013-01 Miscellaneous memory safety hazards rv:18.0/ rv:10.0.12 / rv:17.0.2 MFSA 2013-02 Use-after-free and buffer overflow issues found using Address Sanitizer MFSA 2013-03 Buffer Overflow in Canvas MFSA 2013-04 URL spoofing in addressbar during page loads MFSA...

Scientific Linux Security Update : gpdf on SL4.x i386/x86_64

Multiple integer overflow flaws were found in GPdf's JBIG2 decoder. An attacker could create a malicious PDF file that would cause GPdf to crash or, potentially, execute arbitrary code when opened. CVE-2009-0147, CVE-2009-1179 Multiple buffer overflow flaws were found in GPdf's JBIG2 decoder. An...

GLSA-201205-03 : Chromium, V8: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201205-03 Chromium, V8: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Chromium and V8. Please review the CVE identifiers and release notes referenced below for details. Impact : A context-dependent...

RHEL 4 / 5 : thunderbird (RHSA-2010:0780)

The remote Redhat Enterprise Linux 4 / 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2010:0780 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content...

Fedora 13 : seamonkey-2.0.4-1.fc13 (2010-6236)

Update to new upstream SeaMonkey version 2.0.4, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/seamonkey20.htmlseamonkey2.0.4 CVE-2010-0173 CVE-2010-0174 CVE-2010-0175 CVE-2010-0176 CVE-2010-0177 CVE-2010-0178...