Oracle Linux 4 : kernel (ELSA-2010-0474)

From Red Hat Security Advisory 2010:0474 : Updated kernel packages that fix three security issues and several bugs are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CV...

Oracle Linux 5 : firefox (ELSA-2008-0207)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0207 advisory. 1.5.0.12-14.0.1 - Add firefox-oracle-default-bookmarks.html and firefox-oracle-default-prefs.js 1.5.0.12-14 - Fix assertions from script 1.5.0.12-13 -...

Ubuntu 10.04 LTS : linux vulnerabilities (USN-1899-1)

Dmitry Monakhov reported a race condition flaw the Linux ext4 filesystem that can expose stale data. An unprivileged user could exploit this flaw to cause an information leak. CVE-2012-4508 An information leak was discovered in the Linux kernel's tkill and tgkill system calls when used from compa...

RHEL 6 : firefox (RHSA-2013:0696)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0696 advisory. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found ...

SuSE 10 Security Update : kernel-debug (ZYPP Patch Number 6986)

This SUSE Linux Enterprise 10 SP3 kernel update for x8664 only fixes a severe regression introduced by the previous bugfix that would make some machines not boot due to iommu / AGP memory issues. The update also fixes several other bugs and the following security issue : - drivers/net/r8169.c in...

PHP < 5.3.9 Multiple Vulnerabilities

Binary data 6263.prm...

Ubuntu 8.04 LTS : linux regression (USN-974-2)

USN-974-1 fixed vulnerabilities in the Linux kernel. The fixes for CVE-2010-2240 caused failures for Xen hosts. This update fixes the problem. We apologize for the inconvenience. Gael Delalleu, Rafal Wojtczuk, and Brad Spengler discovered that the memory manager did not properly handle when...

Fedora 13 : seamonkey-2.0.4-1.fc13 (2010-6236)

Update to new upstream SeaMonkey version 2.0.4, fixing multiple security issues detailed in the upstream advisories: http://www.mozilla.org/security/known- vulnerabilities/seamonkey20.htmlseamonkey2.0.4 CVE-2010-0173 CVE-2010-0174 CVE-2010-0175 CVE-2010-0176 CVE-2010-0177 CVE-2010-0178...

Debian DSA-1931-1 : nspr - several vulnerabilities

Several vulnerabilities have been discovered in the NetScape Portable Runtime Library, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-1563 A programming error in the string handling code may lead t...

openSUSE 10 Security Update : xpdf (xpdf-6376)

Specially crafted PDF documents could crash xpdf or potentially even allow execution of arbitrary code CVE-2009-0791. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update xpdf-6376. The text...

SuSE 11 Security Update : Xerces-j2 (SAT Patch Number 1235)

The xerces-j2 package was vulnerable to various bugs while parsing XML.CVE-2009-2625 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE 11 update information. The text itself is...

SuSE 11 Security Update : Sun JDK 6 (SAT Patch Number 699)

The Sun JDK 6 was updated to Update13 to fix various bugs and security issues. - LdapCtx in the LDAP service in Java SE Development Kit JDK and Java Runtime Environment JRE 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.124 and earlier; and 1.4.219 and earlier does not close...

Fedora 11 : kernel-2.6.29.5-191.fc11 (2009-6768)

Update to kernel 2.6.29.5: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.29.5 Includes DRM modesetting bug fixes. Adds driver for VIA SD/MMC controllers and full support for the Nano processor in 64-bit mode. Note that Tenable Network Security has extracted the preceding description...

Web Application Tests Settings

This script sets options for generic web tests. It does not perform any test by itself. Several scripts use the options set here to test web applications, look for cross-site scripting attacks, SQL injection, etc. in CGIs. C Tenable Network Security, Inc. include"compat.inc"; ifdescription...

RHEL 4 : kernel (RHSA-2008:0508)

Updated kernel packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating...

openSUSE 10 Security Update : seamonkey (seamonkey-3632)

This update brings Mozilla SeaMonkey to security update version 1.1.2 - MFSA 2007-17 / CVE-2007-2871 : Chris Thomas demonstrated that XUL popups opened by web content could be placed outside the boundaries of the content area. This could be used to spoof or hide parts of the browser chrome such a...

lighttpd mod_fastcgi HTTP Request Header Remote Overflow

The remote web server appears to be lighttpd running with the FastCGI module modfastcgi. The version of the FastCGI module on the remote host is affected by a buffer overflow vulnerability. A remote attacker can exploit this, by sending a specially crafted request with a long header, to add or...

Finger Service Remote Information Disclosure

The remote host is running the 'finger' service. The purpose of this service is to show who is currently logged into the remote system, and to give information about the users of the remote system. It provides useful information to attackers, since it allows them to gain usernames, determine how...

Node.js Module Undici 6.17.x < 6.27.0 / 7.x < 7.28.0 / 8.x < 8.5.0 DoS (CVE-2026-12151)

The nodejs module Undici detected on the host is version 6.17.x prior to 6.27.0, 7.x prior to 7.28.0, or 8.x prior to 8.5.0. It is, therefore, affected by a denial of service vulnerability: - The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a messag...

Apache Log4j 2.21.0 < 2.25.4 Rfc5424Layout Log Injection (CVE-2026-34478)

The version of Apache Log4j on the remote host is 2.21.0 through 2.25.3. It is, therefore, affected by a vulnerability: - The Rfc5424Layout is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. The newLineEscape attribute was...

Oracle MySQL Workbench <= 8.0.32 (April 2023)

The version of Oracle MySQL Workbench installed on the remote Windows host is prior to 8.0.32. It is, therefore, affected by a Use After Free vulnerability in the MySQL Workbench product of Oracle MySQL component: Workbench: OpenSSL. Supported versions that are affected are 8.0.32 and prior. Easi...

SUSE SLES15: kernel-livepatch-5_3_18-150300_59_71-default / etc (SUSE-SU-2022:2696-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2696-1 advisory. This update for the Linux Kernel 5.3.18-1503005971 fixes several issues. The following security issues were fixed: - CVE-2022-34918: Fixed a...

SUSE SLES15 Security Update : kernel (Live Patch 0 for SLE 15 SP4) (SUSE-SU-2022:2268-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2268-1 advisory. - In aiopollcompletework of aio.c, there is a possible memory corruption due to a use after free. This could lead to local escalati...

EulerOS 2.0 SP10 : expat (EulerOS-SA-2022-1786)

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a...

RHEL 7 : kernel (RHSA-2022:1104)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1104 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: use after free in eventpoll.c...

RHEL 8 : openssl (RHSA-2022:1065)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1065 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

Oracle Linux 8 : httpd:2.4 (ELSA-2022-1049)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-1049 advisory. httpd 2.4.37-43.0.2.3 - Set vstring per ORACLESUPPORTPRODUCT Orabug: 29892262 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-43.3 -...

Oracle Linux 8 : gnutls (ELSA-2022-9221)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9221 advisory. 3.6.16-4.0.1fips - Allow RSA keygen with modulus sizes bigger than 3072 bits and validate the seed length as defined in FIPS 186-4 section B.3.2 Orabug...

Microsoft Windows Codecs Library Multiple Vulnerabilities (March 2022)

The Windows 'HEVC Video Extensions' or 'HEVC from Device Manufacturer' app installed on the remote host is affected by multiple code execution vulnerabilities. An attacker who successfully exploits these vulnerabilities could execute arbitrary code. Exploitation of the vulnerability requires that...

RHEL 8 : kpatch-patch (RHSA-2022:0335)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0335 advisory. This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Security Fixe...

Windows HTTP Protocol Stack CVE-2022-21907 Mitigation (EnableTrailerSupport)

The remote system may be in a vulnerable state to CVE-2022-21907 by having the following registry key set: - HKLM\System\CurrentControlSet\Services\HTTP\Parameters\EnableTrailerSupport An unauthenticated, remote attacker could exploit this, by sending specially crafted requests, to execute...

RHEL 8 : samba (RHSA-2022:0008)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0008 advisory. Samba is an open-source implementation of the Server Message Block SMB protocol and the related Common Internet File System CIFS protocol,...

EulerOS Virtualization 3.0.2.0 : vim (EulerOS-SA-2021-2845)

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - vim is vulnerable to Heap-based Buffer Overflow CVE-2021-3778, CVE-2021-3872, CVE-2021-3984 - vim is vulnerable to Use After Free...

Apache Log4j Message Lookup Substitution RCE (Log4Shell) (Direct Check)

Binary data apachelog4jjdnildapgeneric.nbin...

NewStart CGSL CORE 5.05 / MAIN 5.05 : python3 Multiple Vulnerabilities (NS-SA-2021-0147)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has python3 packages installed that are affected by multiple vulnerabilities: - The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the servertitle field. This occur...

EulerOS Virtualization 3.0.2.2 : samba (EulerOS-SA-2021-2168)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access...

Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-4999-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4999-1 advisory. Norbert Slusarek discovered a race condition in the CAN BCM networking protocol of the Linux kernel leading to multiple use-after-free vulnerabilities. A...

RHEL 7 : python (RHSA-2021:0761)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0761 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...

CentOS 8 : nodejs:10 (CESA-2020:2848)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2848 advisory. - nghttp2: overly large SETTINGS frames can lead to DoS CVE-2020-11080 - nodejs-minimist: prototype pollution allows adding or modifying properties of...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20200806)

Security Fixes : - chromium-browser: Use after free in ANGLE CVE-2020-6463 - chromium-browser: Inappropriate implementation in WebRTC CVE-2020-6514 - Mozilla: Potential leak of redirect targets when loading scripts in a worker CVE-2020-15652 - Mozilla: Memory safety bugs fixed in Firefox 79 and...

Oracle Linux 7 : docker-cli / docker-engine (ELSA-2020-5739)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5739 advisory. - update to 19.03.11 for CVE-2020-13401 - apply e4931e664feac6fa8846f3f04268a0cc98822549, fixes CVE-2019-5736 - update to 19.03.11 for CVE-2020-13401 - apply...

openSUSE Security Update : MozillaFirefox (openSUSE-2020-621)

This update for MozillaFirefox fixes the following issues : Update to version 68.8.0 ESR bsc1171186 : - CVE-2020-12387: Use-after-free during worker shutdown - CVE-2020-12388: Sandbox escape with improperly guarded Access Tokens - CVE-2020-12389: Sandbox escape with improperly separated process...

CentOS 6 : java-1.8.0-openjdk (RHSA-2020:1506)

The remote CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1506 advisory. - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Scripting. Supported versions that are affected are Java SE: 8u24...

EulerOS 2.0 SP3 : qemu-kvm (EulerOS-SA-2020-1430)

According to the versions of the qemu-kvm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In libslirp 4.1.0, as used in QEMU 4.2.0, tcpsubr.c misuses snprintf return values, leading to a buffer overflow in later code.CVE-2020-8608 -...

Fedora 30 : glibc (2020-7f625c5ea8)

This update incorporates fixes from the upstream glibc 2.29 stable release branch, including 3 fixes for medium severity security vulnerabilities. CVE-2020-10029, CVE-2020-1752, CVE-2020-1751 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

Slackware 14.2 : Slackware 14.2 kernel (SSA:2020-008-01)

New kernel packages are available for Slackware 14.2 to fix security issues. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2020-008-01. The text itself is copyright C Slackware Linux, Inc. include'compat.inc...

RHEL 8 : container-tools:1.0 (RHSA-2019:4273)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:4273 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: HTTP/2:...

openSUSE Security Update : go1.12 (openSUSE-2019-2000) (Ping Flood) (Reset Flood)

This update for go1.12 fixes the following issues : Security issues fixed : - CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth. bsc1146111 - CVE-2019-9514: Fixed HTTP/2 implementation is vulnerable to a reset flood, potentially leading to a denial of...

NewStart CGSL MAIN 5.04 : kernel-rt Vulnerability (NS-SA-2019-0018)

The remote NewStart CGSL host, running version MAIN 5.04, has kernel-rt packages installed that are affected by a vulnerability: - A race condition was found in the Linux kernel, present since v3.14-rc1 through v4.12. The race happens between threads of inotifyhandleevent and vfsrename while...

CentOS 7 : firefox (CESA-2019:1603)

An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...