357681 matches found
EulerOS Virtualization for ARM 64 3.0.2.0 : bind (EulerOS-SA-2020-1953)
According to the versions of the bind packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - An assertion failure was found in BIND, which checks the validity of messages containing TSIG resource records. This fla...
Oracle Linux 7 : java-11-openjdk (ELSA-2020-2969)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-2969 advisory. 1:11.0.8.10-0.0.1 - link atomic for ix86 build 1:11.0.8.10-0 - Update to shenandoah-jdk-11.0.8+10 GA - Switch to GA mode for final release. - Update...
RHEL 6 : microcode_ctl (RHSA-2020:2706)
The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2706 advisory. Security Fixes: hw: Special Register Buffer Data Sampling SRBDS CVE-2020-0543 hw: L1D Cache Eviction Sampling CVE-2020-0549 hw: Vector...
openSUSE Security Update : gcc9 (openSUSE-2020-716)
This update includes the GNU Compiler Collection 9. This update ships the GCC 9.3 release. A full changelog is provided by the GCC team on : https://www.gnu.org/software/gcc/gcc-9/changes.html The base system compiler libraries libgccs1, libstdc++6 and others are now built by the gcc 9 packages. ...
Oracle Linux 7 : firefox (ELSA-2020-2037)
The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-2037 advisory. 68.8.0-1.0.1 - Remove upstream references Orabug: 30143292 - Update distribution for Oracle Linux Orabug: 30143292 - Add firefox-oracle-default-prefs.j...
CentOS 7 : qemu-kvm (RHSA-2020:1116)
The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1116 advisory. - tcpemu in tcpsubr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMUIRC. This can cause a heap-based...
CentOS 7 : thunderbird (RHSA-2020:0576)
The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0576 advisory. - When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affects...
Oracle Linux 6 : java-1.7.0-openjdk (ELSA-2019-3158)
The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3158 advisory. 1:1.7.0.241-2.6.20.0.0.1 - Update DISTRONAME in specfile 1:1.7.0.241-2.6.20.0 - Bump to 2.6.20 and OpenJDK 7u241-b01. - Drop PR1834/RH1022017 which is...
EulerOS Virtualization for ARM 64 3.0.2.0 : python-requests (EulerOS-SA-2019-1947)
According to the version of the python-requests package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected 30...
SUSE SLED15 / SLES15 Security Update : ucode-intel (SUSE-SU-2019:1236-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)
This update for ucode-intel fixes the following issues : This update contains the Intel QSR 2019.1 Microcode release bsc1111331 Four new speculative execution information leak issues have been identified in Intel CPUs. bsc1111331 CVE-2018-12126: Microarchitectural Store Buffer Data Sampling MSBDS...
Photon OS 1.0: Openssl PHSA-2018-1.0-0175
An update of the openssl package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-1.0-0175. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 1.0: Linux PHSA-2018-1.0-0097
An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-1.0-0097. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid121797...
Oracle Linux 6 : firefox (ELSA-2018-3831)
The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2018-3831 advisory. 60.4.0-1.0.1 - fix LDLIBRARYPATH - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one 60.4.0-1 - Update to 60.4.0 ESR 60.3.0-...
openSUSE Security Update : texlive (openSUSE-2018-1099)
This update for texlive fixes the following issue : - CVE-2018-17407: Prevent buffer overflow when handling of Type 1 fonts allowed arbitrary code execution when a malicious font was loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex bsc1109673 %NASLMINLEVEL 70300 C Tenable...
openSUSE Security Update : qemu (openSUSE-2018-603) (Spectre)
This update for qemu fixes the following issues : This security issue was fixed : - CVE-2018-3639: Spectre v4 vulnerability mitigation support for KVM guests bsc1092885. Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of...
SUSE SLES11 Security Update : libvirt (SUSE-SU-2018:1452-1) (Spectre)
This update for libvirt fixes the following issues : - CVE-2018-3639: cpu: add support for 'ssbd' and 'virt-ssbd' CPUID feature bits pass through. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to...
SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1237-1)
This update for the Linux Kernel 3.12.74-606466 fixes several issues. The following security issues were fixed : - CVE-2018-1000199: A bug in x86 debug register handling of ptrace could lead to memory corruption, possibly a denial of service or privilege escalation bsc1090036. - CVE-2017-0861:...
CentOS 6 : kernel (CESA-2018:0008) (Meltdown) (Spectre)
An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
Debian DSA-4065-1 : openssl1.0 - security update
Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2017-3737 David Benjamin of Google reported that OpenSSL does not properly handle SSLread and SSLwrite while being...
Grandstream Phone Web UI Information Disclosure
The remote Grandstream phone is affected by an information disclosure vulnerability in the web administration interface due to the failure to restrict access to sensitive configuration data. An unauthenticated, remote attacker can exploit this to disclose sensitive information related to the...
CentOS 7 : httpd (CESA-2017:2479)
An update for httpd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
Fedora 26 : jackson-databind (2017-6a75c816fa)
Security fix for CVE-2017-7525 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300...
SUSE SLES12 Security Update : kernel (SUSE-SU-2017:1909-1) (Stack Clash)
This update for the Linux Kernel 3.12.67-606418 fixes several issues. The following security bugs were fixed : - CVE-2017-1000364: An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be 'jumped' over the stack...
RHEL 6 / 7 : java-1.8.0-oracle (RHSA-2016:2088)
An update for java-1.8.0-oracle is now available for Oracle Java for Red Hat Enterprise Linux 6 and Oracle Java for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which give...
Ubuntu 14.04 LTS / 16.04 LTS : QEMU vulnerabilities (USN-3047-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3047-1 advisory. Li Qiang discovered that QEMU incorrectly handled 53C9X Fast SCSI controller emulation. A privileged attacker inside the guest could use this...
OracleVM 3.3 / 3.4 : nss-util (OVMSA-2016-0034)
The remote OracleVM system is missing necessary patches to address critical security updates : - Actually apply the fix for CVE-2016-1950 from NSS 3.19.2.3 ... - Rebuild to ensure use of correct NSPR. - Include the fix for CVE-2016-1950 from NSS 3.19.2.3 %NASLMINLEVEL 70300 C Tenable Network...
Fedora 22 : mingw-libxml2-2.9.3-1.fc22 (2016-a9ee80b01d)
Update to 2.9.3 which fixes various CVE's Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVE...
Debian DLA-346-1 : openjdk-6 security update
Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform. These vulnerabilities relate to execution of arbitrary code, breakouts of the Java sandbox, information disclosure and denial of service. For Debian 6 'Squeeze', these problems have been fixed ...
CentOS 6 / 7 : java-1.7.0-openjdk (CESA-2015:1920)
Updated java-1.7.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...
PHP 5.5.x < 5.5.24 Multiple Vulnerabilities
According to its banner, the version of PHP 5.5.x running on the remote web server is prior to 5.5.24. It is, therefore, affected by multiple vulnerabilities : - An unspecified use-after-free error exists in the zendsharedmemdup function within file ext/opcache/zendsharedalloc.c that allows an...
Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20150311)
It was found that the Linux kernel's Infiniband subsystem did not properly sanitize input parameters while registering memory regions from user space via the uverbs API. A local user with access to a /dev/infiniband/uverbsX device could use this flaw to crash the system or, potentially, escalate...
PHP 5.6.x < 5.6.6 Multiple Vulnerabilities (GHOST)
According to its banner, the version of PHP 5.6.x installed on the remote host is prior to 5.6.6. It is, therefore, affected by multiple vulnerabilities : - A heap-based buffer overflow flaw in the enchantbrokerrequestdict function in ext/enchant/enchant.c could allow a remote attacker to cause a...
openSUSE Security Update : libserf (openSUSE-SU-2014:1395-1) (POODLE)
libserf was updated to disable SSLv2 and SSLv3. libserf was updated to version 1.3.8 on openSUSE 13.1 and 13.2. This release also fixes a problem with handling very large gzip-encoded HTTP responses. For openSUSE 12.3 libserf 1.1.1 was patched to disable SSLv2 and SSLv3. %NASLMINLEVEL 70300 C...
RHEL 6 : kernel (RHSA-2014:0419)
Updated kernel packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6.3 Extended Update Support. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which...
openSUSE Security Update : bash (openSUSE-SU-2014:1308-1) (Shellshock)
Replace patches bash-4.2-heredoc-eof-delim.patch and bash-4.2-parse-exportfunc.patch with the official upstream patch levels bash42-052 and bash42-053 - Replace patch bash-4.2-CVE-2014-7187.patch with upstream patch level bash42-051 - Make bash-4.2-extra-import-func.patch an optional patch due...
Oracle Linux 5 / 6 / 7 : java-1.6.0-openjdk (ELSA-2014-1634)
The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1634 advisory. 1:1.6.0.33-1.13.5.0 - Update to IcedTea 1.13.5 - Remove upstreamed patches. - Regenerate add-final-location-rpaths patch against new release. -...
PHP 5.4.x < 5.4.30 / 5.5.x < 5.5.14 Multiple Vulnerabilities
Binary data 8320.prm...
Blue Coat ProxyAV Detection
Blue Coat ProxyAV, an anti-malware appliance, was found. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid69929; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate", value:"2020/09/14"; scriptnameenglish:"Blue Coat ProxyAV Detection";...
Oracle Linux 5 : gnutls (ELSA-2009-1232)
The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2009-1232 advisory. 1.4.1-3.5 - fix NUL characters in DN and SAN cert fields issue, make sure gnutlsx509crtcheckhostname fails when certificate has no CN or SAN CVE-2009-2730 51623...
RHEL 5 : kvm (RHSA-2012:0676)
The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0676 advisory. - kernel: kvm: irqchipinkernel and vcpu-arch.apic inconsistency CVE-2012-1601 - kvm: device assignment page leak CVE-2012-2121 Note that...
Ubuntu 12.10 : linux vulnerabilities (USN-1699-1)
Jon Howell reported a flaw in the Linux kernel's KVM Kernel-based virtual machine subsystem's handling of the XSAVE CPU feature. On hosts without the XSAVE CPU feature, using qemu userspace, an unprivileged local attacker could exploit this flaw to crash the system. CVE-2012-4461 A flaw was...
Thunderbird < 17.0.2 Multiple Vulnerabilities (Mac OS X)
The installed version of Thunderbird is earlier than 17.0.2 and thus, is potentially affected by the following security issues : - Two intermediate certificates were improperly issued by TURKTRUST certificate authority. CVE-2013-0743 - A use-after-free error exists related to displaying HTML tabl...
IBM WebSphere Portal Dojo Module Arbitrary File Download
The version of WebSphere Portal on the remote host is using a vulnerable version of the Dojo toolkit. Input to the 'path' parameter of layerLoader.jsp is not properly validated. A remote, unauthenticated attacker could exploit this to download arbitrary files. This vulnerability exists due to an...
Scientific Linux Security Update : firefox on SL4.x, SL5.x i386/x86_64
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2010-3169, CVE-2010-2762 Several use-after-free and dangling point...
Scientific Linux Security Update : tomcat6 on SL6.x i386/x86_64
A denial of service flaw was found in the way certain strings were converted to Double objects. A remote attacker could use this flaw to cause Tomcat to hang via a specially crafted HTTP request. CVE-2010-4476 A flaw was found in the Tomcat NIO Non-Blocking I/O connector. A remote attacker could...
Fedora 16 : kernel-3.2.1-3.fc16 (2012-0876)
Rebase F16 to the 3.2.1 stable release. Also fixes CVEs : - CVE-2012-0056 - CVE-2011-4127 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...
Mac OS X XProtect Installed
There is a problem with the installation of the Apple XProtect application on the remote Mac OS X host - either updates are not enabled / running or its definitions are out of date. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid56568; scriptversion"1.57";...
Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2010:258)
Security issues were identified and fixed in mozilla-thunderbird : Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 do not properly validate downloadable fonts before use within an operating system's font...
Debian DSA-1885-1 : xulrunner - several vulnerabilities
Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-3070 Jesse Ruderman discovered crashes in the layout...
Ubuntu 8.04 LTS / 8.10 / 9.04 : firefox-3.0, xulrunner-1.9 vulnerabilities (USN-873-1)
Jesse Ruderman, Josh Soref, Martijn Wargers, Jose Angel, Olli Pettay, and David James discovered several flaws in the browser and JavaScript engines of Firefox. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary...