NewStart CGSL MAIN 4.05 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0146)

The remote NewStart CGSL host, running version MAIN 4.05, has java-1.8.0-openjdk packages installed that are affected by multiple vulnerabilities: - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Sound. Supported versions that are affected are Ja...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4703)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-4703 advisory. kernel-uek 3.8.13-118.36.1 - tun: call devgetvalidname before registernetdevice Cong Wang Orabug: 29925557 CVE-2018-7191 Tenable has extracted the preceding...

Fedora 30 : kernel / kernel-headers (2019-6c3d89b3d0) (SACK Panic) (SACK Slowness)

Update to v5.1.11 - Fixes CVE-2019-11477 - Fixes CVE-2019-11479 - Fixes CVE-2019-11478 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Exim 4.87 < 4.92 Remote Command Execution

According to its banner, the version of Exim running on the remote host is between 4.87 and 4.91 inclusive. It is, therefore, potentially affected by a remote command execution vulnerability. A flaw exists in the delivermessage function that could allow an attacker to execute arbitrary commands v...

EulerOS 2.0 SP2 : kernel (EulerOS-SA-2019-1586)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4642)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4642 advisory. - X.509: Handle midnight alternative notation in GeneralizedTime David Howells Orabug: 29460344 CVE-2015-5327 - X.509: Support leap seconds David...

EulerOS Virtualization 3.0.1.0 : sqlite (EulerOS-SA-2019-1425)

According to the versions of the sqlite packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was found that SQLite's sqlite3VdbeExec function did not properly implement comparison operators. A local attacker could submi...

EulerOS 2.0 SP2 : libssh2 (EulerOS-SA-2019-1308)

According to the versions of the libssh2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An out of bounds read flaw was discovered in libssh2 when a specially crafted SFTP packet is received from the server. A remote attacker who...

RHEL 6 : java-1.7.1-ibm (RHSA-2019:0474)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0474 advisory. IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IB...

Fedora 28 : community-mysql (2019-21b76d179e)

MySQL 5.7.25 Release notes : https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-25.html CVEs fixed : CVE-2019-2420 CVE-2019-2434 CVE-2019-2455 CVE-2019-2481 CVE-2019-2482 CVE-2019-2486 CVE-2019-2503 CVE-2019-2507 CVE-2019-2510 CVE-2019-2528 CVE-2019-2529 CVE-2019-2531 CVE-2019-2532...

Adobe Flash Player <= 31.0.0.153 (APSB18-42)

The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 31.0.0.153. It is therefore affected by the following vulnerabilities : - An unspecified use-after-free error exists that allows remote code execution. CVE-2018-15982 - An unspecified insecure...

openSUSE Security Update : xen (openSUSE-2018-803)

This update for xen fixes the following issues : Security issues fixed : - CVE-2018-3665: Fix Lazy FP Save/Restore issue XSA-267 bsc1095242. - CVE-2018-12891: Fix possible Denial of Service DoS via certain PV MMU operations that affect the entire host XSA-264 bsc1097521. - CVE-2018-12892: Fix lib...

SUSE SLES11 Security Update : libvirt (SUSE-SU-2018:1452-1) (Spectre)

This update for libvirt fixes the following issues : - CVE-2018-3639: cpu: add support for 'ssbd' and 'virt-ssbd' CPUID feature bits pass through. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1237-1)

This update for the Linux Kernel 3.12.74-606466 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace could lead to memory corruption, possibly a denial of service or privilege escalation bsc1090036. - CVE-2017-0861:...

SUSE SLES12 Security Update : xen (SUSE-SU-2018:0609-1) (Meltdown) (Spectre)

This update for xen fixes several issues. These security issues were fixed : - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent information leaks via side effects of speculative execution, aka 'Spectre' and 'Meltdown' attacks bsc1074562, bsc1068032 - CVE-2018-5683: The vgadrawtext function...

Debian DSA-4065-1 : openssl1.0 - security update

Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2017-3737 David Benjamin of Google reported that OpenSSL does not properly handle SSLread and SSLwrite while being...

openSUSE Security Update : MozillaThunderbird (openSUSE-2017-1144)

Mozilla Thunderbird was updated to 52.4.0 boo1060445 - new behavior was introduced for replies to mailing list posts: 'When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header'. A new preference mail.overridelistreplyto allows to restore the previous...

Fedora 26 : jackson-databind (2017-6a75c816fa)

Security fix for CVE-2017-7525 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...

CentOS 7 : kernel (CESA-2017:1484) (Stack Clash)

An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

RHEL 7 : qemu-kvm-rhev (RHSA-2017:0350)

An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and Agents for RHEL-7 and RHEV 4.X RHEV-H and Agents for RHEL-7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

SUSE SLES11 Security Update : apache2-mod_nss (SUSE-SU-2016:2329-1) (POODLE)

This update provides apache2-modnss 1.0.14, which brings several fixes and enhancements : - SHA256 cipher names change spelling from sha256 to sha256. - Drop modnssmigrate.pl and use upstream migrate script instead. - Check for Apache user owner/group read permissions of NSS database at startup. ...

Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2910-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2910-1 advisory. halfdog discovered that OverlayFS, when mounting on top of a FUSE mount, incorrectly propagated file attributes, including setuid. A local unprivileged...

Amazon Linux AMI : glibc (ALAS-2016-653)

A stack-based buffer overflow flaw was found in the senddg and sendvc functions, used by getaddrinfo and other higher-level interfaces of glibc. A remote attacker able to cause an application to call either of these functions could use this flaw to execute arbitrary code with the permissions of t...

CentOS 6 / 7 : java-1.7.0-openjdk (CESA-2015:1920)

Updated java-1.7.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

CentOS 7 : kernel (CESA-2015:1534)

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity rating...

Debian DLA-67-1 : php5 security update

CVE-2014-3538 It was discovered that the original fix for CVE-2013-7345 did not sufficiently address the problem. A remote attacker could still cause a denial of service CPU consumption via a specially crafted input file that triggers backtracking during processing of an awk regular expression...

SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 9185)

This Mozilla Firefox and Mozilla NSS update to 24.5.0esr fixes the following several security and non-security issues : - Miscellaneous memory safety hazards. MFSA 2014-34 / CVE-2014-1518 - Out of bounds read while decoding JPG images. MFSA 2014-37 / CVE-2014-1523 - Buffer overflow when using...

ESXi 5.5 < Build 1746974 / 5.5 Update 1 < Build 1746018 OpenSSL Library Multiple Vulnerabilities (remote check) (Heartbleed)

The remote VMware ESXi host is 5.5 prior to build 1746974 or 5.5 Update 1 prior to build 1746018. It is, therefore, potentially affected by the following vulnerabilities in the OpenSSL library : - An error exists related to the implementation of the Elliptic Curve Digital Signature Algorithm ECDS...

Blue Coat ProxyAV Detection

Blue Coat ProxyAV, an anti-malware appliance, was found. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid69929; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate", value:"2020/09/14"; scriptnameenglish:"Blue Coat ProxyAV Detection";...

Oracle Linux 6 : php (ELSA-2013-0514)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0514 advisory. - remove reproducer from security fix for CVE-2012-0781 - add security fixes for CVE-2012-2688, CVE-2012-0831, CVE-2011-1398 Tenable has extracted the...

Mac OS X : Java for OS X 2013-003

The remote Mac OS X 10.7 or 10.8 host has a Java runtime that is missing the Java for OS X 2013-003 update, which updates the Java version to 1.6.045. It is, therefore, affected by multiple security vulnerabilities, the most serious of which may allow an untrusted Java applet to execute arbitrary...

Ubuntu 6.06 LTS : firefox vulnerabilities (USN-728-3)

Jesse Ruderman and Gary Kwong discovered flaws in the browser engine. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. CVE-2009-0772, CVE-2009-0774...

Scientific Linux Security Update : java (jdk 1.6.0) on SL4.x, SL5.x i386/x86_64

This update fixes several vulnerabilities in the Sun Java 6 Runtime Environment and the Sun Java 6 Software Development Kit. These vulnerabilities are summarized on the 'Advance notification of Security Updates for Java SE' page from Sun Microsystems, listed in the References section. All running...

Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2010-3169, CVE-2010-2762 Several use-after-free and dangling point...

RHEL 6 : openoffice.org (RHSA-2011:0183)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0183 advisory. OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application,...

Mac OS X : Apple Safari < 4.0.4

The version of Apple Safari installed on the remote Mac OS X host is earlier than 4.0.4. As such, it is potentially affected by several issues : - Multiple use-after-free issues exist in libxml2, the most serious of which could lead to a program crash. CVE-2009-2414, CVE-2009-2416 - An issue in t...

openSUSE Security Update : libpng-devel (libpng-devel-558)

A allocation mistake in libpng's pngread.c has been fixed CVE-2009-0040. The previous update was using an incomplete patch so it needed to be reissued. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...

Solaris 10 (sparc) : 128640-30 (deprecated)

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Container. Supported versions that are affected are 9.2.4, 10.0.2, 10.3.5, 10.3.6 and 12.1.1. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful...

Solaris 10 (x86) : 118669-86 (deprecated)

JavaSE 5.0x86: update 85 patch equivalent to JDK 5.0u85, 64bit. Date this patch was last updated by Sun : Apr/13/15 This plugin has been deprecated and either replaced with individual 118669 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security, In...

Microsoft Windows LAN Manager SNMP LanMan Services Disclosure

It is possible to obtain the list of LanMan services on the remote host by sending SNMP requests with the OID 1.3.6.1.4.1.77.1.2.3.1.1 An attacker may use this information to gain more knowledge about the target host. TRUSTED...

KB5037823: Windows Server 2012 R2 Security Update (May 2024)

The remote Windows host is missing security update 5037823. It is, therefore, affected by multiple vulnerabilities - Windows Routing and Remote Access Service RRAS Remote Code Execution Vulnerability CVE-2024-30009, CVE-2024-30014, CVE-2024-30015, CVE-2024-30022, CVE-2024-30023, CVE-2024-30024,...

Oracle Linux 8 : virt:kvm_utils2 (ELSA-2023-12195)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12195 advisory. - hw/pvrdma: Protect against buggy or malicious guest driver Yuval Shaia Orabug: 35064352 CVE-2022-1050 - hw/display/qxl: Avoid buffer overrun in...

Dell Client BIOS Multiple Vulnerabilities (DSA-2022-326)

The Dell BIOS on the remote device is missing a security patch and is, there, is affected by an input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable. Note that Nessus has not tested...

RHEL 7 : rh-ruby26-ruby (RHSA-2021:2230)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2230 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...

Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-042)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-042 advisory. A flaw was found in the Linux kernel in linux/net/netfilter/nftablesapi.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue. CVE-2022-1015 A flaw w...

RHEL 9 : xz (RHSA-2022:4940)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:4940 advisory. XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv- Markov chain algorithm LZMA, which performs...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:4891)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:4891-1 advisory. - Mozilla: Braille space character caused incorrect sender email to be shown for a digitally signed email CVE-2022-1834 - Mozilla: Cross-Origin...

AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2022:1759)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:1759 advisory. QEMU: virtio-net: heap use-after-free in virtionetreceivercu CVE-2021-3748 ntfs-3g: Out-of-bounds heap buffer access in ntfsgetattributevalue due to...

RHEL 8 : httpd:2.4 (RHSA-2022:1915)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1915 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Request splittin...

IBM Java 6.0 < 6.0.16.65 / 6.1 < 6.1.8.65 / 7.0 < 7.0.10.25 / 7.1 < 7.1.4.25 / 8.0 < 8.0.5.15 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is prior to 6.0 6.0.16.65 / 6.1 6.1.8.65 / 7.0 7.0.10.25 / 7.1 7.1.4.25 / 8.0 8.0.5.15. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle April 17 2018 CPU advisory. - Vulnerability in the Java SE, Java SE...