EulerOS 2.0 SP3 : openssl (EulerOS-SA-2022-1181)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a field...

EulerOS 2.0 SP9 : curl (EulerOS-SA-2021-2682)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.T...

MariaDB 10.3.0 < 10.3.31 Multiple Vulnerabilities

The version of MariaDB installed on the remote host is prior to 10.3.31. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.3.31 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 5.7.34 and...

RHEL 7 : java-1.8.0-openjdk (RHSA-2021:2845)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2845 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...

Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-4999-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4999-1 advisory. Norbert Slusarek discovered a race condition in the CAN BCM networking protocol of the Linux kernel leading to multiple use-after-free vulnerabilities. A...

SUSE SLED15: postgresql10 / postgresql10-contrib / postgresql10-devel / etc (SUSE-SU-2021:1970-1)

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1970-1 advisory. - Upgrade to version 10.17: - CVE-2021-32027: Fixed integer overflows in array subscripting calculations bsc1185924. - CVE-2021-32028:...

Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2021-9308)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-9308 advisory. - dm ioctl: fix out of bounds array access when no devices Mikulas Patocka Orabug: 32860493 CVE-2021-31916 - powerpc/64s: flush L1D after user accesses...

Oracle Linux 6 : openssl (ELSA-2021-9150) (deprecated)

This plugin has been deprecated, please use oraclelinuxELSA-2021-9137.nasl instead. C Tenable Network Security, Inc. @DEPRECATED@ The descriptive text and package checks in this plugin were extracted from Oracle Linux Security Advisory ELSA-2021-9150. Disabled on 2021/04/28. Use...

Debian DSA-4877-1 : webkit2gtk - security update

The following vulnerabilities have been discovered in the webkit2gtk web engine : - CVE-2020-27918 Liu Long discovered that processing maliciously crafted web content may lead to arbitrary code execution. - CVE-2020-29623 Simon Hunt discovered that users may be unable to fully delete their browsi...

NewStart CGSL MAIN 4.06 : bind Multiple Vulnerabilities (NS-SA-2021-0003)

The remote NewStart CGSL host, running version MAIN 4.06, has bind packages installed that are affected by multiple vulnerabilities: - Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows or successfully guesses th...

EulerOS 2.0 SP9 : kernel (EulerOS-SA-2021-1009)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic functions of the...

RHEL 8 : firefox (RHSA-2020:2382)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2382 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

SUSE SLES12 Security Update : xen (SUSE-SU-2020:1630-1)

This update for xen fixes the following issues : CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it. This attack is known as Special Register Buffer Data Sampling SRBDS or 'CrossTalk'...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4163-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4163-1 advisory. It was discovered that a race condition existed in the ARC EMAC ethernet driver for the Linux kernel, resulting in a use-after-free vulnerability. An...

openSUSE Security Update : python-urllib3 (openSUSE-2019-2133)

This update for python-urllib3 fixes the following issues : Security issues fixed : - CVE-2019-9740: Fixed CRLF injection issue bsc1129071. - CVE-2019-11324: Fixed invalid CA certificat verification bsc1132900. - CVE-2019-11236: Fixed CRLF injection via request parameter bsc1132663. This update w...

MySQL 5.7.x < 5.7.27 Multiple Vulnerabilities (Jul 2019 CPU)

The version of MySQL running on the remote host is 5.7.x prior to 5.7.27. It is, therefore, affected by multiple vulnerabilities, including three of the top vulnerabilities below, as noted in the July 2019 Critical Patch Update advisory: - A stack-based buffer overflow vulnerability in the 'Serve...

Fedora 30 : kernel / kernel-headers (2019-6c3d89b3d0) (SACK Panic) (SACK Slowness)

Update to v5.1.11 - Fixes CVE-2019-11477 - Fixes CVE-2019-11479 - Fixes CVE-2019-11478 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

openSUSE Security Update : python3 (openSUSE-2019-1282)

This update for python3 fixes the following issues : Security issue fixed : - CVE-2019-9636: Fixed an information disclosure because of incorrect handling of Unicode encoding during NFKC normalization bsc1129346. This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL...

RHEL 7 : java-1.8.0-openjdk (RHSA-2019:0775)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0775 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security...

Amazon Linux AMI : openssl (ALAS-2019-1153)

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. CVE-2018-0734 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Adobe Flash Player <= 31.0.0.153 (APSB18-42)

The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 31.0.0.153. It is therefore affected by the following vulnerabilities : - An unspecified use-after-free error exists that allows remote code execution. CVE-2018-15982 - An unspecified insecure...

Debian DLA-1566-1 : mysql-5.5 security update

Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.62, which includes additional changes. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details :...

openSUSE Security Update : tiff (openSUSE-2018-1242)

This update for tiff fixes the following issues : Security issue fixed : - CVE-2018-10779: TIFFWriteScanline in tifwrite.c had a heap-based buffer over-read, as demonstrated by bmp2tiff.bsc1092480 - CVE-2018-17100: There is a int32 overflow in multiplyms in tools/ppm2tiff.c, which can cause a...

Apache Tomcat 9.0.0.M1 < 9.0.12 Open Redirect Weakness

The version of Apache Tomcat installed on the remote host is 9.0.x prior to 9.0.12. It is, therefore, affected by a open redirect vulnerability. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid118037;...

Debian DLA-1531-1 : linux-4.9 security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2018-6554 A memory leak in the irdabind function in the irda subsystem was discovered. A local user can take advantage of this flaw to cause a deni...

openSUSE Security Update : xen (openSUSE-2018-803)

This update for xen fixes the following issues : Security issues fixed : - CVE-2018-3665: Fix Lazy FP Save/Restore issue XSA-267 bsc1095242. - CVE-2018-12891: Fix possible Denial of Service DoS via certain PV MMU operations that affect the entire host XSA-264 bsc1097521. - CVE-2018-12892: Fix lib...

KB4338823: Windows 7 and Windows Server 2008 R2 July 2018 Security Update

The remote Windows host is missing security update 4338823 or cumulative update 4338818. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level. CVE-2018-8202 - A...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1223-1)

This update for the Linux Kernel 4.4.114-9267 fixes one issue. The following security issue was fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace could lead to memory corruption, possibly a denial of service or privilege escalation bsc1090036. Note that Tenable Network...

RHEL 6 : kernel (RHSA-2018:1351)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1351 advisory. - Kernel: error in exception handling leads to DoS CVE-2018-8897 Note that Nessus has not tested for this issue but has instead relied only on the...

SUSE SLES12 Security Update : xen (SUSE-SU-2018:0609-1) (Meltdown) (Spectre)

This update for xen fixes several issues. These security issues were fixed : - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent information leaks via side effects of speculative execution, aka 'Spectre' and 'Meltdown' attacks bsc1074562, bsc1068032 - CVE-2018-5683: The vgadrawtext function...

ProFTPD 1.3.4d / 1.3.5rc3 Denial of Service

The remote host is using ProFTPD, a free FTP server for Unix and Linux. According to its banner, the version of ProFTPD installed on the remote host is earlier than 1.3.5rc4 and is affected by a Denial of Service vulnerability in the modsftppam module. C Tenable Network Security, Inc...

openSUSE Security Update : ucode-intel (openSUSE-2018-24) (Spectre)

This update for ucode-intel fixes the following issues : Update to Intel CPU Microcode version 20180108 boo1075262 - The pre-released microcode fixing some important security issues is now officially published and included in the added tarball. New firmware updates since last version 20170707 are...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0115) (Stack Clash)

The remote OracleVM system is missing necessary patches to address critical security updates : - mm: fix new crash in unmappedareatopdown Hugh Dickins Orabug: 26326143 CVE-2017-1000364 - mm: larger stack guard gap, between vmas Hugh Dickins Orabug: 26326143 CVE-2017-1000364 %NASLMINLEVEL 70300 C...

Debian DLA-954-1 : openjdk-7 security update

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in privilege escalation, denial of service, newline injection in SMTP or use of insecure cryptography. For Debian 7 'Wheezy', these problems have been fixed in version...

Debian DLA-939-1 : qemu-kvm security update

Multiple vulnerabilities have been discovered in qemu-kvm, a full virtualization solution on x86 hardware based on Quick EmulatorQemu. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2016-9603 qemu-kvm built with the Cirrus CLGD 54xx VGA Emulator and the V...

MS17-017: Security Update for Windows Kernel (4013081)

The remote Windows host is missing a security update. It is, therefore, affected by multiple elevation of privilege vulnerabilities : - An elevation of privilege vulnerability exists in the Windows Kernel API due to improper enforcement of permissions. A local attacker can exploit this, via a...

RHEL 7 : qemu-kvm-rhev (RHSA-2017:0350)

An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and Agents for RHEL-7 and RHEV 4.X RHEV-H and Agents for RHEL-7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

openSUSE Security Update : qemu (openSUSE-2016-1504)

This update for qemu to version 2.6.2 fixes the several issues. These security issues were fixed : - CVE-2016-7161: Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU aka Quick Emulator allowed attackers to execute arbitrary code on the QEMU host via a large...

Oracle Java SE Multiple Vulnerabilities (July 2016 CPU)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is prior to 8 Update 101, 7 Update 111, or 6 Update 121. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the CORBA subcomponent that allows an unauthenticated,...

Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20160121) (SLOTH)

An out-of-bounds write flaw was found in the JPEG image format decoder in the AWT component in OpenJDK. A specially crafted JPEG image could cause a Java application to crash or, possibly execute arbitrary code. An untrusted Java application or applet could use this flaw to bypass Java sandbox...

F5 Networks BIG-IP : Linux kernel vulnerability (SOL16122)

arch/x86/kernel/entry64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment SS segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space. C Tenabl...

CentOS 7 : kernel (CESA-2015:1534)

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity rating...

Ubuntu 15.04 : linux vulnerabilities (USN-2638-1)

Xiong Zhou discovered a bug in the way the EXT4 filesystem handles fallocate zero range functionality when the page size is greater than the block size. A local attacker could exploit this flaw to cause a denial of service system crash. CVE-2015-0275 Wen Xu discovered a use-after-free flaw in the...

RHEL 5 : kernel (RHSA-2013:1860)

Updated kernel packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5.9 Extended Update Support. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, whic...

Oracle Linux 6 : java-1.8.0-openjdk (ELSA-2014-1636)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1636 advisory. 1:1.8.0.25-1.b17 - Update to October CPU patch update. - Resolves: RHBZ1148896 1:1.8.0.20-3.b26 - fixed headless policytool moved to normal -...

Oracle Linux 6 : kernel (ELSA-2012-0481)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0481 advisory. - Revert: fs NFSv4: include bitmap in nfsv4 get acl data Sachin Prabhu 753231 753232 CVE-2011-4131 - kernel regset: Return -EFAULT, not -EIO, on...

Scientific Linux Security Update : samba and cifs-utils on SL6.x i386/x86_64

Samba is a suite of programs used by machines to share files, printers, and other information. The cifs-utils package contains utilities for mounting and managing CIFS Common Internet File System shares. A cross-site scripting XSS flaw was found in the password change page of the Samba Web...

Mandriva Linux Security Advisory : samba (MDVSA-2012:055)

A vulnerability has been found and corrected in samba : The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers ...

Mandriva Linux Security Advisory : php (MDVSA-2011:052)

Multiple vulnerabilities has been identified and fixed in php : The zipnamelocate function in zipnamelocate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FLUNCHANGED argument, which might allow context-dependent attackers to cause a denial of service applicatio...

Fedora 13 : firefox-3.6.11-1.fc13 / galeon-2.0.7-34.fc13 / gnome-python2-extras-2.25.3-23.fc13 / etc (2010-16593)

Update to new upstream Firefox version 3.6.11, fixing multiple security issues detailed in the upstream advisories : http://www.mozilla.org/security/known-vulnerabilities/firefox36.htmlf irefox3.6.11 Update also includes all packages depending on gecko-libs rebuilt against new version of Firefox ...