346916 matches found
Oracle Linux 8 : virt:kvm_utils2 (ELSA-2023-12195)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12195 advisory. - hw/pvrdma: Protect against buggy or malicious guest driver Yuval Shaia Orabug: 35064352 CVE-2022-1050 - hw/display/qxl: Avoid buffer overrun in...
Oracle Linux 6 : kernel (ELSA-2022-9781)
The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9781 advisory. - epoll: Keep a reference on files added to the check list Al Viro CVE-2020-0466 Orabug: 34086960 - fix regression in 'epoll: Keep a reference on files...
Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-042)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-042 advisory. A flaw was found in the Linux kernel in linux/net/netfilter/nftablesapi.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue. CVE-2022-1015 A flaw w...
Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:4891)
The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:4891-1 advisory. - Mozilla: Braille space character caused incorrect sender email to be shown for a digitally signed email CVE-2022-1834 - Mozilla: Cross-Origin...
RHEL 8 : httpd:2.4 (RHSA-2022:1915)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1915 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Request splittin...
EulerOS Virtualization 2.9.0 : expat (EulerOS-SA-2022-1628)
According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts function in xmlparse.c can lead to realloc...
Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-018)
The version of kernel installed on the remote host is prior to 5.4.80-40.140. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-018 advisory. A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing ...
IBM Java 6.0 < 6.0.16.65 / 6.1 < 6.1.8.65 / 7.0 < 7.0.10.25 / 7.1 < 7.1.4.25 / 8.0 < 8.0.5.15 Multiple Vulnerabilities
The version of IBM Java installed on the remote host is prior to 6.0 6.0.16.65 / 6.1 6.1.8.65 / 7.0 7.0.10.25 / 7.1 7.1.4.25 / 8.0 8.0.5.15. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle April 17 2018 CPU advisory. - Vulnerability in the Java SE, Java SE...
RHEL 7 : rh-mariadb103-mariadb (RHSA-2022:1010)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1010 advisory. MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is binary-compatible with MySQL. The...
EulerOS 2.0 SP3 : openssl098e (EulerOS-SA-2022-1180)
According to the versions of the openssl098e package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data and a fie...
RHEL 8 : cyrus-sasl (RHSA-2022:0658)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:0658 advisory. The cyrus-sasl packages contain the Cyrus implementation of Simple Authentication and Security Layer SASL. SASL is a method for adding authentication...
Oracle Linux 7 : openssl (ELSA-2022-9023)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9023 advisory. - fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings Tenable has extracted the preceding description block directly from the Oracle Linu...
CentOS 8 : curl (CESA-2021:4511)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4511 advisory. - curl: Leak of authentication credentials in URL via automatic Referer CVE-2021-22876 - CVE-2021-22925 curl: Incorrect fix for TELNET stack contents...
Photon OS 4.0: Glibc PHSA-2021-4.0-0095
An update of the glibc package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-4.0-0095. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descripti...
Photon OS 2.0: C PHSA-2021-2.0-0378
An update of the c package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0378. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc';...
FreeBSD : polkit -- local privilege escalation using polkit_system_bus_name_get_creds_sync (36a35d83-c560-11eb-84ab-e0d55e2a8bf9)
Cedric Buissart reports : The function polkitsystembusnamegetcredssync is used to get the uid and pid of the process requesting the action. It does this by sending the unique bus name of the requesting process, which is typically something like ':1.96', to dbus-daemon. These unique names are...
FreeBSD : PostgreSQL server -- two security issues (62da9702-b4cc-11eb-b9c9-6cc21735f730)
The PostgreSQL project reports : Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an attacker can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can...
RHEL 8 : grub2 (RHSA-2021:0696)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0696 advisory. The grub2 packages provide version 2 of the Grand Unified Boot Loader GRUB, a highly configurable and customizable boot loader with modular...
KB4601345: Windows 10 Version 1809 and Windows Server 2019 February 2021 Security Update
The remote Windows host is missing security update 4601345. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive information. CVE-2021-1734, CVE-2021-24076, CVE-2021-24079, CVE-2021-24084...
CentOS 8 : pki-core:10.6 and pki-deps:10.6 (CESA-2020:1644)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1644 advisory. - jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig CVE-2019-14540 - jackson-databind: Serialization gadgets in...
CentOS 8 : libreoffice (CESA-2020:1598)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1598 advisory. - libreoffice: Remote resources protection module not applied to bullet graphics CVE-2019-9849 - libreoffice: Insufficient URL validation allowing...
Fedora 32 : python39 (2021-e3a5a74610)
The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-e3a5a74610 advisory. - Python 3.x through 3.9.1 has a buffer overflow in PyCArgrepr in ctypes/callproc.c, which may lead to remote code execution in certain Python...
openSUSE Security Update : openssl-1_1 (openSUSE-2020-2223)
This update for openssl-11 fixes the following issues : - CVE-2020-1971: Fixed a NULL pointer dereference in EDIPARTYNAME bsc1179491. This update was imported from the SUSE:SLE-15-SP2:Update update project. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin we...
SUSE SLES12 Security Update : openssl-1_0_0 (SUSE-SU-2020:3732-1)
This update for openssl-100 fixes the following issues : CVE-2020-1971: Fixed a NULL pointer dereference in EDIPARTYNAME bsc1179491. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically...
SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2020:3721-1)
This update for openssl-11 fixes the following issues : CVE-2020-1971: Fixed a NULL pointer dereference in EDIPARTYNAME bsc1179491. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically cle...
Oracle Linux 7 : freeradius (ELSA-2020-3984)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3984 advisory. 3.0.13-15 - Fixes EAP-PWD: DoS issues due to multithreaded BNCTX access Resolves: bz1818808 3.0.13-14 - Fixes receiving of multiple RADIUS packets unde...
openSUSE Security Update : gcc9 (openSUSE-2020-716)
This update includes the GNU Compiler Collection 9. This update ships the GCC 9.3 release. A full changelog is provided by the GCC team on : https://www.gnu.org/software/gcc/gcc-9/changes.html The base system compiler libraries libgccs1, libstdc++6 and others are now built by the gcc 9 packages. ...
CentOS 7 : qemu-kvm (RHSA-2020:1116)
The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1116 advisory. - tcpemu in tcpsubr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMUIRC. This can cause a heap-based...
CentOS 7 : thunderbird (RHSA-2020:0576)
The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0576 advisory. - When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affects...
NewStart CGSL MAIN 4.05 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2019-0146)
The remote NewStart CGSL host, running version MAIN 4.05, has java-1.8.0-openjdk packages installed that are affected by multiple vulnerabilities: - Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Sound. Supported versions that are affected are Ja...
Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4703)
The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-4703 advisory. kernel-uek 3.8.13-118.36.1 - tun: call devgetvalidname before registernetdevice Cong Wang Orabug: 29925557 CVE-2018-7191 Tenable has extracted the preceding...
EulerOS 2.0 SP2 : kernel (EulerOS-SA-2019-1586)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make...
SUSE SLED15 / SLES15 Security Update : ucode-intel (SUSE-SU-2019:1236-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)
This update for ucode-intel fixes the following issues : This update contains the Intel QSR 2019.1 Microcode release bsc1111331 Four new speculative execution information leak issues have been identified in Intel CPUs. bsc1111331 CVE-2018-12126: Microarchitectural Store Buffer Data Sampling MSBDS...
Debian DSA-4434-1 : drupal7 - security update
A cross-site scripting vulnerability has been found in Drupal, a fully-featured content management framework. For additional information, please refer to the upstream advisory at https://www.drupal.org/sa-core-2019-006 . C Tenable Network Security, Inc. The descriptive text and package checks in...
Photon OS 1.0: Openssl PHSA-2018-1.0-0175
An update of the openssl package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-1.0-0175. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
RHEL 7 : thunderbird (RHSA-2019:0160)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:0160 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 60.4.0. Security Fixes: Mozilla:...
Debian DLA-1566-1 : mysql-5.5 security update
Several issues have been discovered in the MySQL database server. The vulnerabilities are addressed by upgrading MySQL to the new upstream version 5.5.62, which includes additional changes. Please see the MySQL 5.5 Release Notes and Oracle's Critical Patch Update advisory for further details :...
openSUSE Security Update : texlive (openSUSE-2018-1099)
This update for texlive fixes the following issue : - CVE-2018-17407: Prevent buffer overflow when handling of Type 1 fonts allowed arbitrary code execution when a malicious font was loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex bsc1109673 %NASLMINLEVEL 70300 C Tenable...
openSUSE Security Update : qemu (openSUSE-2018-603) (Spectre)
This update for qemu fixes the following issues : This security issue was fixed : - CVE-2018-3639: Spectre v4 vulnerability mitigation support for KVM guests bsc1092885. Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of...
SUSE SLES11 Security Update : libvirt (SUSE-SU-2018:1452-1) (Spectre)
This update for libvirt fixes the following issues : - CVE-2018-3639: cpu: add support for 'ssbd' and 'virt-ssbd' CPUID feature bits pass through. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...
SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1237-1)
This update for the Linux Kernel 3.12.74-606466 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace could lead to memory corruption, possibly a denial of service or privilege escalation bsc1090036. - CVE-2017-0861:...
KB4103716: Windows 10 May 2018 Security Update
The remote Windows host is missing security update 4103716. It is, therefore, affected by multiple vulnerabilities : - A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard. An attacker who successfully exploited this vulnerability...
CentOS 6 : kernel (CESA-2018:0008) (Meltdown) (Spectre)
An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
Debian DSA-4065-1 : openssl1.0 - security update
Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2017-3737 David Benjamin of Google reported that OpenSSL does not properly handle SSLread and SSLwrite while being...
openSUSE Security Update : MozillaThunderbird (openSUSE-2017-1144)
Mozilla Thunderbird was updated to 52.4.0 boo1060445 - new behavior was introduced for replies to mailing list posts: 'When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header'. A new preference mail.overridelistreplyto allows to restore the previous...
CentOS 7 : httpd (CESA-2017:2479)
An update for httpd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
Fedora 26 : jackson-databind (2017-6a75c816fa)
Security fix for CVE-2017-7525 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...
RHEL 7 : qemu-kvm-rhev (RHSA-2017:0350)
An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and Agents for RHEL-7 and RHEV 4.X RHEV-H and Agents for RHEL-7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...
Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2017-3516)
The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3516 advisory. - vfs: read filehandle only once in handletopath Sasha Levin Orabug: 25388709 CVE-2015-1420 - USB: usbfs: fix potential infoleak in devio Kangjie L...
openSUSE Security Update : qemu (openSUSE-2016-1504)
This update for qemu to version 2.6.2 fixes the several issues. These security issues were fixed : - CVE-2016-7161: Heap-based buffer overflow in the .receive callback of xlnx.xps-ethernetlite in QEMU aka Quick Emulator allowed attackers to execute arbitrary code on the QEMU host via a large...