EulerOS 2.0 SP2 : libssh2 (EulerOS-SA-2019-1308)

According to the versions of the libssh2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An out of bounds read flaw was discovered in libssh2 when a specially crafted SFTP packet is received from the server. A remote attacker who...

openSUSE Security Update : python3 (openSUSE-2019-1282)

This update for python3 fixes the following issues : Security issue fixed : - CVE-2019-9636: Fixed an information disclosure because of incorrect handling of Unicode encoding during NFKC normalization bsc1129346. This update was imported from the SUSE:SLE-15:Update update project. %NASLMINLEVEL...

EulerOS Virtualization 2.5.4 : kernel (EulerOS-SA-2019-1236)

According to the version of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - The Linux kernel is vulnerable to a NULL pointer dereference in the ext4/xattr.c:ext4xattrinodehash function. An attacker could tric...

RHEL 6 : java-1.7.1-ibm (RHSA-2019:0474)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0474 advisory. IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IB...

Adobe Flash Player <= 31.0.0.153 (APSB18-42)

The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 31.0.0.153. It is therefore affected by the following vulnerabilities : - An unspecified use-after-free error exists that allows remote code execution. CVE-2018-15982 - An unspecified insecure...

SUSE SLES12 Security Update : qemu (SUSE-SU-2018:1362-2) (Spectre)

This update for qemu fixes several issues. This security issue was fixed : CVE-2018-3639: Spectre v4 vulnerability mitigation support for KVM guests bsc1092885. Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior...

Debian DLA-1531-1 : linux-4.9 security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2018-6554 A memory leak in the irdabind function in the irda subsystem was discovered. A local user can take advantage of this flaw to cause a deni...

KB4338823: Windows 7 and Windows Server 2008 R2 July 2018 Security Update

The remote Windows host is missing security update 4338823 or cumulative update 4338818. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level. CVE-2018-8202 - A...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1223-1)

This update for the Linux Kernel 4.4.114-9267 fixes one issue. The following security issue was fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace could lead to memory corruption, possibly a denial of service or privilege escalation bsc1090036. Note that Tenable Network...

EulerOS 2.0 SP1 : kernel (EulerOS-SA-2018-1085)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the Linux kernel's client-side implementation of the cifs protocol. This flaw allows an attacker controlling the server to...

SUSE SLES12 Security Update : xen (SUSE-SU-2018:0609-1) (Meltdown) (Spectre)

This update for xen fixes several issues. These security issues were fixed : - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent information leaks via side effects of speculative execution, aka 'Spectre' and 'Meltdown' attacks bsc1074562, bsc1068032 - CVE-2018-5683: The vgadrawtext function...

Slackware 14.2 / current : openssl (SSA:2017-306-02)

New openssl packages are available for Slackware 14.2 and -current to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2017-306-02. The text itself is copyright C...

RHEL 6 : MRG (RHSA-2017:2705) (BlueBorne)

An update for kernel-rt is now available for Red Hat Enterprise MRG 2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Amazon Linux AMI : glibc (ALAS-2017-844) (Stack Clash)

Glibc contains a vulnerability that allows specially crafted LDLIBRARYPATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap...

Debian DLA-939-1 : qemu-kvm security update

Multiple vulnerabilities have been discovered in qemu-kvm, a full virtualization solution on x86 hardware based on Quick EmulatorQemu. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2016-9603 qemu-kvm built with the Cirrus CLGD 54xx VGA Emulator and the V...

Amazon Linux AMI : nss / nss-util (ALAS-2017-825)

An out-of-bounds write flaw was found in the way NSS performed certain Base64-decoding operations. An attacker could use this flaw to create a specially crafted certificate which, when parsed by NSS, could cause it to crash or execute arbitrary code, using the permissions of the user running an...

Fedora 25 : kernel (2017-e6012e74b6)

The 4.9.5 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

OpenSSH 7.x < 7.4 Multiple Vulnerabilities

Binary data 9855.prm...

MySQL 5.6.x < 5.6.35 Multiple Vulnerabilities (January 2017 CPU)

The version of MySQL running on the remote host is 5.6.x prior to 5.6.35. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the Security: Encryption subcomponent that allows an authenticated, remote attacker to cause a denial of service condition...

Amazon Linux AMI : glibc (ALAS-2016-653)

A stack-based buffer overflow flaw was found in the senddg and sendvc functions, used by getaddrinfo and other higher-level interfaces of glibc. A remote attacker able to cause an application to call either of these functions could use this flaw to execute arbitrary code with the permissions of t...

Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20160121) (SLOTH)

An out-of-bounds write flaw was found in the JPEG image format decoder in the AWT component in OpenJDK. A specially crafted JPEG image could cause a Java application to crash or, possibly execute arbitrary code. An untrusted Java application or applet could use this flaw to bypass Java sandbox...

RHEL 6 / 7 : gnutls (RHSA-2016:0012) (SLOTH)

Updated gnutls packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...

CentOS 6 / 7 : openssl (CESA-2015:2617)

Updated openssl packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Debian DSA-3284-1 : qemu - security update

Several vulnerabilities were discovered in qemu, a fast processor emulator. - CVE-2015-3209 Matt Tait of Google's Project Zero security team discovered a flaw in the way QEMU's AMD PCnet Ethernet emulation handles multi-TMD packets with a length above 4096 bytes. A privileged guest user in a gues...

SUSE SLES10 Security Update : Xen (SUSE-SU-2014:0470-1)

The SUSE Linux Enterprise 10 Service Pack 3 LTSS Xen hypervisor and toolset have been updated to fix various security issues : The following security issues have been addressed : XSA-20: CVE-2012-4535: Xen 3.4 through 4.2, and possibly earlier versions, allows local guest OS administrators to cau...

Debian DLA-67-1 : php5 security update

CVE-2014-3538 It was discovered that the original fix for CVE-2013-7345 did not sufficiently address the problem. A remote attacker could still cause a denial of service CPU consumption via a specially crafted input file that triggers backtracking during processing of an awk regular expression...

openSUSE Security Update : bash (openSUSE-SU-2014:1308-1) (Shellshock)

Replace patches bash-4.2-heredoc-eof-delim.patch and bash-4.2-parse-exportfunc.patch with the official upstream patch levels bash42-052 and bash42-053 - Replace patch bash-4.2-CVE-2014-7187.patch with upstream patch level bash42-051 - Make bash-4.2-extra-import-func.patch an optional patch due...

Juniper Junos Multiple OpenSSL Vulnerabilities (JSA10629)

According to its self-reported version number, the remote Juniper Junos device is affected by the following vulnerabilities related to OpenSSL : - An error exists in the ssl3readbytes function that permits data to be injected into other sessions or allows denial of service attacks. Note that this...

Firefox ESR < 17.0.10 Multiple Vulnerabilities (Mac OS X)

The installed version of Firefox ESR is earlier than 17.0.10 and is, therefore, potentially affected by the following vulnerabilities : - The implementation of Network Security Services NSS does not ensure that data structures are initialized, which could result in a denial of service or disclosu...

CentOS 5 : java-1.7.0-openjdk (CESA-2013:0603)

Updated java-1.7.0-openjdk packages that fix two security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Scientific Linux Security Update : seamonkey on SL4.x i386/x86_64

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code with the privileges of the user running SeaMonkey. CVE-2010-3767, CVE-2010-3772, CVE-2010-3776 A flaw was found in th...

RHEL 6 : openoffice.org (RHSA-2011:0183)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0183 advisory. OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet application,...

Fedora 11 : gnash-0.8.6-13.fc11 (2010-1833)

This update makes Gnash use the system version of the libltdl library instead of the bundled copy which was vulnerable to CVE-2009-3736. An update to the system libltdl fixing CVE-2009-3736 was issued on December 21, 2009. Note that Tenable Network Security has extracted the preceding description...

Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2010:126)

Multiple vulnerabilities has been found and corrected in mozilla-thunderbird : Unspecified vulnerability in Mozilla Firefox 3 allows remote attackers to execute arbitrary code via unknown vectors that trigger memory corruption, as demonstrated by Nils during a Pwn2Own competition at CanSecWest 20...

openSUSE Security Update : seamonkey (openSUSE-SU-2010:0273-1)

This update brings Mozilla SeaMonkey to 1.1.19 fixing various bugs and security issues. Following security issues are fixed: MFSA 2010-07: Mozilla developers took fixes from previously fixed memory safety bugs in newer Mozilla-based products and ported them to the Mozilla 1.8.1 branch so they can...

Debian DSA-1928-1 : linux-2.6.24 - privilege escalation/denial of service/sensitive memory leak

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, sensitive memory leak or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-2846 Michael Buesch noticed a typing issue in the...

SuSE 11 Security Update : ruby (SAT Patch Number 1073)

This ruby update improves return value checks for openssl function OCSPbasicverify CVE-2009-0642 which allowed an attacker to use revoked certificates. The entropy of DNS identifiers was increased CVE-2008-3905 to avaid spoofing attacks. The code for parsing XML data was vulnerable to a denial of...

SuSE9 Security Update : libpng (YOU Patch Number 12358)

A allocation mistake in libpng's pngread.c has been fixed CVE-2009-0040. The previous update was using an incomplete patch so it needed to be reissued. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc';...

SuSE9 Security Update : Tomcat (YOU Patch Number 12460)

This update of tomcat fixes several vulnerabilities : - RequestDispatcher usage can lead to information leakage. CVE-2008-5515 - denial of service via AJP connection. CVE-2009-0033 - some authentication classes allow user enumeration. CVE-2009-0580 - XSS bug in example application cal2.jsp...

Solaris 10 (sparc) : 128640-30 (deprecated)

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Container. Supported versions that are affected are 9.2.4, 10.0.2, 10.3.5, 10.3.6 and 12.1.1. Easily exploitable vulnerability allows successful unauthenticated network attacks via HTTP. Successful...

PHP 5.x < 5.2.6 Multiple Vulnerabilities

Binary data 4493.prm...

CentOS 4 / 5 : firefox (CESA-2008:0207)

Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the...

openSUSE 10 Security Update : kdegraphics3-pdf (kdegraphics3-pdf-4681)

A buffer overflow in the xpdf code contained in kpdf could be exploited by attackers to potentially execute arbitrary code CVE-2007-5393. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

lighttpd mod_fastcgi HTTP Request Header Remote Overflow

The remote web server appears to be lighttpd running with the FastCGI module modfastcgi. The version of the FastCGI module on the remote host is affected by a buffer overflow vulnerability. A remote attacker can exploit this, by sending a specially crafted request with a long header, to add or...

RHEL 2.1 : kernel (RHSA-2007:0672)

Updated kernel packages that fix a number of security issues are now available for Red Hat Enterprise Linux 2.1 32-bit architectures. This security advisory has been rated as having important security impact by the Red Hat Security Response Team. The Linux kernel handles the basic functions of th...

Solaris 10 (x86) : 118669-86 (deprecated)

JavaSE 5.0x86: update 85 patch equivalent to JDK 5.0u85, 64bit. Date this patch was last updated by Sun : Apr/13/15 This plugin has been deprecated and either replaced with individual 118669 patch-revision plugins, or deemed non-security related. %NASLMINLEVEL 70300 C Tenable Network Security, In...

Apache Banner Linux Distribution Disclosure

Nessus was able to extract the banner of the Apache web server and determine which Linux distribution the remote host is running. %NASLMINLEVEL 70300 C Tenable, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid18261; scriptversion"1.102";...

nginx 1.25.x < 1.25.4 DoS

The installed version of nginx is 1.25.x prior to 1.25.4. It may, therefore, affected by the following vulnerabilities: - When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is...

Oracle MySQL Server (Apr 2023 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2023 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Packaging OpenSSL. Supported versions that are affected are 5.7.41 and...

Oracle Linux 8 : virt:kvm_utils2 (ELSA-2023-12195)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12195 advisory. - hw/pvrdma: Protect against buggy or malicious guest driver Yuval Shaia Orabug: 35064352 CVE-2022-1050 - hw/display/qxl: Avoid buffer overrun in...