SUSE SLES12: libdcerpc-binding0 / libdcerpc-binding0-32bit / libdcerpc0 / etc (SUSE-SU-2022:0252-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:0252-1 advisory. - CVE-2021-44142: Fixed out-of-Bound Read/Write on Samba vfsfruit module. bsc1194859 Tenable has extracted the preceding description block directly fro...

CentOS 8 : grafana (CESA-2021:4226)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:4226 advisory. - grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call CVE-2021-27358 - golang: crypto/elliptic:...

EulerOS 2.0 SP9 : curl (EulerOS-SA-2021-2682)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.T...

MariaDB 10.4.0 < 10.4.22 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.4.22. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.4.22 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.35 and...

Debian DLA-2711-1 : thunderbird - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2711 advisory. Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. CVE-2021-30547 Description For Debian 9 stretch,...

openSUSE 15 Security Update : nodejs14 (openSUSE-SU-2021:2354-1)

"The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2354-1 advisory. - This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require'y18n' %NASLMINLEVEL 70300 C Tenable...

RHEL 7 : python (RHSA-2021:0761)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0761 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...

CentOS 8 : nodejs:10 (CESA-2020:2848)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2848 advisory. - nghttp2: overly large SETTINGS frames can lead to DoS CVE-2020-11080 - nodejs-minimist: prototype pollution allows adding or modifying properties of...

KB4586830: Windows 10 Version 1607 and Windows Server 2016 November 2020 Security Update

The Microsoft 4586830 Product is missing security updates. - Remote Desktop Protocol Server Information Disclosure Vulnerability CVE-2020-16997 - DirectX Elevation of Privilege Vulnerability CVE-2020-16998 - Windows WalletService Information Disclosure Vulnerability CVE-2020-16999 - Remote Deskto...

RHEL 8 : firefox (RHSA-2020:2382)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2382 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

EulerOS 2.0 SP2 : bind (EulerOS-SA-2020-1676)

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can,...

EulerOS 2.0 SP2 : sqlite (EulerOS-SA-2020-1624)

According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect...

openSUSE Security Update : MozillaFirefox (openSUSE-2020-621)

This update for MozillaFirefox fixes the following issues : Update to version 68.8.0 ESR bsc1171186 : - CVE-2020-12387: Use-after-free during worker shutdown - CVE-2020-12388: Sandbox escape with improperly guarded Access Tokens - CVE-2020-12389: Sandbox escape with improperly separated process...

Debian DSA-4641-1 : webkit2gtk - security update

The following vulnerability has been discovered in the webkit2gtk web engine : - CVE-2020-10018 Sudhakar Verma, Ashfaq Ansari and Siddhant Badhe discovered that processing maliciously crafted web content may lead to arbitrary code execution. C Tenable Network Security, Inc. The descriptive text a...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2019-4820)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4820 advisory. - xfrm: policy: Fix out-of-bound array accesses in xfrmpolicyunlink YueHaibing Orabug: 30322228 CVE-2019-15666 - floppy: fix out-of-bounds read in...

SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:1829-1)

The SUSE Linux Enterprise 15 kernel version 4.12.14 was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2019-10638: Attackers used to be able to track the Linux kernel by the IP ID values the kernel produces for connection-less protocols. When such...

Exim 4.87 < 4.92 Remote Command Execution

According to its banner, the version of Exim running on the remote host is between 4.87 and 4.91 inclusive. It is, therefore, potentially affected by a remote command execution vulnerability. A flaw exists in the delivermessage function that could allow an attacker to execute arbitrary commands v...

KB4499179: Windows 10 Version 1709 and Windows Server Version 1709 May 2019 Security Update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

The remote Windows host is missing security update 4499179. It is, therefore, affected by multiple vulnerabilities : - A new subclass of speculative execution side channel vulnerabilities, known as Microarchitectural Data Sampling, exist in Windows. An attacker who successfully exploited these...

RHEL 7 : java-1.7.0-openjdk (RHSA-2019:0791)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0791 advisory. The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Security...

EulerOS Virtualization 2.5.4 : openssl (EulerOS-SA-2019-1201)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigat...

Amazon Linux AMI : openssl (ALAS-2019-1153)

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. CVE-2018-0734 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

RHEL 6 : java-1.7.0-openjdk (RHSA-2019:0462)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0462 advisory. The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Security Fixes:...

Photon OS 1.0: Linux PHSA-2016-0012

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2016-0012. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid121650;...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4510)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4510 advisory. - ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c Hui Peng Orabug: 29042981 CVE-2018-19824 - ALSA: usb-audio: Replace...

PHP 7.0.x < 7.0.25 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.25. It is, therefore, affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid104632;...

Apache Struts 2.3.x Struts 1 plugin RCE (remote)

The Struts 1 plugin in Apache Struts 2.3.x is affected by a remote code execution vulnerability via a malicious field value passed in a raw message to the ActionMessage class. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descriptio...

EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1154)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0115) (Stack Clash)

The remote OracleVM system is missing necessary patches to address critical security updates : - mm: fix new crash in unmappedareatopdown Hugh Dickins Orabug: 26326143 CVE-2017-1000364 - mm: larger stack guard gap, between vmas Hugh Dickins Orabug: 26326143 CVE-2017-1000364 %NASLMINLEVEL 70300 C...

CentOS 7 : kernel (CESA-2017:1484) (Stack Clash)

An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Debian DLA-954-1 : openjdk-7 security update

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in privilege escalation, denial of service, newline injection in SMTP or use of insecure cryptography. For Debian 7 'Wheezy', these problems have been fixed in version...

RHEL 5 : nss (RHSA-2017:1103)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:1103 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

SUSE SLED12 / SLES12 Security Update : compat-openssl098 (SUSE-SU-2017:0605-1)

This update for compat-openssl098 fixes the following issues contained in the OpenSSL Security Advisory 26 Jan 2017 bsc1021641 Security issues fixed : - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed bsc1019334 - CVE-2016-8610: A remote denial of...

RHEL 7 : kernel (RHSA-2016:1657)

An update for kernel is now available for Red Hat Enterprise Linux 7.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

OracleVM 3.3 : Unbreakable / etc (OVMSA-2016-0095)

The remote OracleVM system is missing necessary patches to address critical security updates : - KEYS: potential uninitialized variable Dan Carpenter Orabug: 24393864 CVE-2016-4470 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM...

Scientific Linux Security Update : openssl on SL6.x, SL7.x i386/x86_64 (20160107) (SLOTH)

A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could use this flaw to conduct collision attacks to...

CentOS 6 : kernel (CESA-2015:1272)

Updated kernel packages that fix multiple security issues, address several hundred bugs, and add numerous enhancements are now available as part of the ongoing support and maintenance of Red Hat Enterprise Linux version 6. This is the seventh regular update. Red Hat Product Security has rated thi...

Ubuntu 15.04 : linux vulnerabilities (USN-2638-1)

Xiong Zhou discovered a bug in the way the EXT4 filesystem handles fallocate zero range functionality when the page size is greater than the block size. A local attacker could exploit this flaw to cause a denial of service system crash. CVE-2015-0275 Wen Xu discovered a use-after-free flaw in the...

RHEL 6 : java-1.7.0-ibm (RHSA-2014:1882)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1882 advisory. IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several...

Oracle Linux 6 : java-1.8.0-openjdk (ELSA-2014-1636)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1636 advisory. 1:1.8.0.25-1.b17 - Update to October CPU patch update. - Resolves: RHBZ1148896 1:1.8.0.20-3.b26 - fixed headless policytool moved to normal -...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2014-3082)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3082 advisory. - ALSA: control: Don't access controls outside of protected regions Lars-Peter Clausen Orabug: 19817786 CVE-2014-4653 CVE-2014-4654 CVE-2014-4655 -...

SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 9185)

This Mozilla Firefox and Mozilla NSS update to 24.5.0esr fixes the following several security and non-security issues : - Miscellaneous memory safety hazards. MFSA 2014-34 / CVE-2014-1518 - Out of bounds read while decoding JPG images. MFSA 2014-37 / CVE-2014-1523 - Buffer overflow when using...

Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2014-327)

An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when processed. A remote attacker, or an untrusted Java application or applet, could possibly use this flaw to execute arbitrary code...

Solaris 10 (x86) : 150401-59 (deprecated)

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: Kernel. The supported version that is affected is 10. Easily exploitable vulnerability allows unauthenticated attacker with network access via ICMP to compromise Solaris. Successful attacks of this...

Oracle Linux 6 : kernel (ELSA-2011-1350)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1350 advisory. - Revert: net ipv6: make fragment identifications less predictable Jiri Pirko 723432 723433 CVE-2011-2699 - x86 perf, x86: Fix Intel fixed counters bas...

Oracle Linux 4 : seamonkey (ELSA-2009-1431)

From Red Hat Security Advisory 2009:1431 : Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser,...

Fedora 18 : seamonkey-2.14-1.fc18 (2012-18894)

Update to 2.14 Fix CVE-2012-5830, CVE-2012-5833, CVE-2012-5835, CVE-2012-4212-4218, CVE-2012-5829, CVE-2012-5839, CVE-2012-5840, CVE-2012-5836, CVE-2012-4202, CVE-2012-5842, CVE-2012-5843 and others, see http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html for more info. Note that...

Scientific Linux Security Update : samba and cifs-utils on SL6.x i386/x86_64

Samba is a suite of programs used by machines to share files, printers, and other information. The cifs-utils package contains utilities for mounting and managing CIFS Common Internet File System shares. A cross-site scripting XSS flaw was found in the password change page of the Samba Web...

OpenSSH < 4.3 scp Command Line Filename Processing Command Injection

According to its banner, the version of OpenSSH running on the remote host is potentially affected by an arbitrary command execution vulnerability. The scp utility does not properly sanitize user-supplied input prior to using a system function call. A local attacker could exploit this by creating...

MS11-067: Vulnerability in Microsoft Report Viewer Could Allow Information Disclosure (2578230)

The installed version of the Microsoft Report Viewer control fails to properly validate parameters within a data source, which results in a reflected or non-persistent cross-site scripting vulnerability. If an attacker can trick a user into clicking on a link to a malicious server, he could injec...

RHEL 6 : kernel (RHSA-2011:0836)

Updated kernel packages that fix multiple security issues and various bugs are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed...