Scientific Linux Security Update : java-1.8.0-openjdk on SL7.x x86_64 (20181018)

Security Fixes : - OpenJDK: Improper field access checks Hotspot, 8199226 CVE-2018-3169 - OpenJDK: Unrestricted access to scripting engine Scripting, 8202936 CVE-2018-3183 - OpenJDK: Incomplete enforcement of the trustURLCodebase restriction JNDI, 8199177 CVE-2018-3149 - OpenJDK: Incorrect handli...

SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2113-1)

This update for the Linux Kernel 3.12.74-606460 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data fr...

GLSA-201804-02 : glibc: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201804-02 glibc: Multiple vulnerabilities Multiple vulnerabilities have been discovered in glibc. Please review the CVE identifiers referenced below for details. Impact : An attacker could possibly execute arbitrary code, escalate...

Scientific Linux Security Update : libvirt on SL7.x x86_64 (20180104) (Spectre)

Security Fixes : - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions a commonly used performance optimization. There are three primary variants of the issue which differ in the way the speculative execution can be...

EulerOS 2.0 SP2 : kernel (EulerOS-SA-2017-1256)

According to the version of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An exploitable memory corruption flaw was found in the Linux kernel. The append path can be erroneously switched from UFO to non-UFO in...

SUSE SLED12 / SLES12 Security Update : MozillaFirefox, MozillaFirefox-branding-SLE (SUSE-SU-2017:1669-1)

The Mozilla Firefox was updated to the new ESR 52.2 release, which fixes the following issues bsc1043960 : - MFSA 2017-16/CVE-2017-7758 Out-of-bounds read in Opus encoder - MFSA 2017-16/CVE-2017-7749 Use-after-free during docshell reloading - MFSA 2017-16/CVE-2017-7751 Use-after-free with content...

OpenSSL 1.1.0 < 1.1.0b Multiple Vulnerabilities

Binary data 9628.prm...

Oracle Linux 7 : kernel (ELSA-2016-1633)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2016-1633 advisory. - net tcp: enable per-socket rate limiting of all 'challenge acks' Florian Westphal 1355603 1355605 CVE-2016-5696 - net tcp: uninline tcpoowratelimited Florian...

Oracle Linux 6 / 7 : java-1.8.0-openjdk (ELSA-2016-1458)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1458 advisory. 1:1.8.0.101-3.b13 - Replace bad 8159244 patch from upstream 8u with fresh backport from OpenJDK 9. - Resolves: rhbz1350034 1:1.8.0.101-2.b13 - Add...

Debian DLA-529-1 : tomcat7 security update

A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer 4096 bytes used to read the uploaded file. This caused the file upload process to take several orders of magnitude longer than if th...

Slackware 14.0 / 14.1 / current : php (SSA:2016-176-01)

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2016-176-01. The text itself is copyright C...

Drupal 6.x < 6.38 Multiple Vulnerabilities

The version of Drupal running on the remote web server is 6.x prior to 6.38. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the deserialization of user-supplied session data. An authenticated, remote attacker can exploit this, via truncated session data, to execu...

Fedora 22 : mingw-libxml2-2.9.3-1.fc22 (2016-a9ee80b01d)

Update to 2.9.3 which fixes various CVE's Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVE...

AIX Java Advisory : java_jan2016_advisory.asc (January 2016 CPU) (SLOTH)

The version of Java SDK installed on the remote AIX host is affected by multiple vulnerabilities in the following components : - 2D - AWT - IBM J9 JVM - JAXP - JMX - Libraries - Networking - Security %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

MySQL Enterprise Monitor 2.3.x < 2.3.21 / 3.0.x < 3.0.23 Multiple Vulnerabilities

According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 2.3.x prior to 2.3.21 or 3.0.x prior to 3.0.23. It is, therefore, potentially affected by multiple vulnerabilities : - An invalid read error exists in the ASN1TYPEcmp function due to...

RHEL 5 : php (RHSA-2014:0312)

Updated php packages that fix one security issue are now available for Red Hat Enterprise Linux 5.3 and 5.6 Long Life, and Red Hat Enterprise Linux 5.9 Extended Update Support. The Red Hat Security Response Team has rated this update as having Critical security impact. A Common Vulnerability...

Oracle Linux 6 / 7 : java-1.7.0-openjdk (ELSA-2014-1620)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1620 advisory. 1:1.7.0.65-2.5.3.1.0.1.el70 - Update DISTRONAME in specfile 1:1.7.0.65-2.5.3.1 - Bump to 2.5.3 for latest security fixes. - Remove obsolete patches...

RHEL 6 / 7 : java-1.7.0-openjdk (RHSA-2014:1620)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1620 advisory. The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. Multiple...

RHEL 7 : java-1.7.1-ibm (RHSA-2014:1042)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1042 advisory. IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes sever...

VMware Workstation < 9.0.4 / 10.0.3 OpenSSL Library Multiple Vulnerabilities (Windows)

The version of VMware Workstation installed on the remote host is version 9.x prior to 9.0.4 or 10.x prior to 10.0.3. It is, therefore, affected by the following vulnerabilities in the OpenSSL library : - An error exists in the function 'ssl3readbytes' that could allow data to be injected into...

openSUSE Security Update : seamonkey (openSUSE-2011-34)

SeaMonkey was updated to version 2.5 to fix several security issues : - MFSA 2011-47/CVE-2011-3648 bmo690225 Potential XSS against sites using Shift-JIS - MFSA 2011-48/CVE-2011-3651/CVE-2011-3652/CVE-2011-3654 Miscellaneous memory safety hazards - MFSA 2011-49/CVE-2011-3650 bmo674776 Memory...

openSUSE Security Update : mozilla-js192 (mozilla-js192-5832)

Mozilla XULRunner was updated to 1.9.2.27 to fix a security issue with the embedded libpng, where a integer overflow could allow remote attackers to crash the browser or potentially execute code CVE-2011-3026, %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

SuSE 10 Security Update : Java (ZYPP Patch Number 8481)

IBM Java 1.4.2 has been updated to SR13-FP15 which fixes various critical security issues and bugs. Please see the IBM JDK Alert page for more information : http://www.ibm.com/developerworks/java/jdk/alerts/ Security issues fixed : - / CVE-2013-0443. CVE-2013-1478 / CVE-2013-1480 / CVE-2013-1476 ...

PHP PHP-CGI Query String Parameter Injection Arbitrary Code Execution

The PHP installation on the remote web server contains a flaw that could allow a remote attacker to pass command-line arguments as part of a query string to the PHP-CGI program. This could be abused to execute arbitrary code, reveal PHP source code, cause a system crash, etc. %NASLMINLEVEL 70300 ...

CentOS 4 : seamonkey (CESA-2012:0084)

Updated SeaMonkey packages that fix two security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

CGI Generic SQL Injection

By providing specially crafted parameters to CGIs, Nessus was able to get an error from the underlying database. This error suggests that the CGI is affected by a SQL injection vulnerability. An attacker may exploit this flaw to bypass authentication, read confidential data, modify the remote...

Mandriva Linux Security Advisory : python (MDVSA-2009:003)

Multiple integer overflows in imageop.c in the imageop module in Python 1.5.2 through 2.5.1 allow context-dependent attackers to break out of the Python VM and execute arbitrary code via large integer values in certain arguments to the crop function, leading to a buffer overflow, a different...

Fedora 8 : thunderbird-2.0.0.18-1.fc8 (2008-9807)

This update update upgrades thunderbird packages to upstream version 2.0.0.18, which fixes multiple security issues detailed in upstream security advisories: http://www.mozilla.org/security/known- vulnerabilities/thunderbird20.htmlthunderbird2.0.0.17 http://www.mozilla.org/security/known-...

openSUSE 10 Security Update : seamonkey (seamonkey-5600)

SeaMonkey was updated to version 1.1.11. Problems fixed in the 1.1.11 update: CVE-2008-2785 MFSA 2008-34: An anonymous researcher, via TippingPoint's Zero Day Initiative program, reported a vulnerability in Mozilla's internal CSSValue array data structure. The vulnerability was caused by an...

Coppermine Photo Gallery < 1.4.19 data Cookie Local File Inclusion

Binary data 4613.prm...

SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5450)

MozillaFirefox was updated to version 2.0.0.16, which fixes various bugs and following security issues : - An anonymous researcher, via TippingPoint's Zero Day Initiative program, reported a vulnerability in Mozilla CSS reference counting code. The vulnerability was caused by an insufficiently...

SuSE 10 Security Update : MozillaFirefox (ZYPP Patch Number 5405)

Mozilla Firefox was updated to version 2.0.0.15, fixing various bugs including following security bugs : - Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these crashes showed evidence of memory...

FreeBSD : xorg -- multiple vulnerabilities (fe2b6597-c9a4-11dc-8da8-0008a18a9961)

Matthieu Herrb of X.Org reports : Several vulnerabilities have been identified in server code of the X window system caused by lack of proper input validation on user controlled data in various parts of the software, causing various kinds of overflows. Exploiting these overflows will crash the X...

Debian DSA-1408-1 : kdegraphics - buffer overflow

Alin Rad Pop discovered a buffer overflow in kpdf, which could allow the execution of arbitrary code if a malformed PDF file is displayed. The old stable distribution sarge will be fixed later. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

RHEL 4 : kdegraphics (RHSA-2005:868)

Updated kdegraphics packages that resolve several security issues in kpdf are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The kdegraphics packages contain applications for the K Desktop Environment including kpdf, a pdf file...

RIP Poisoning Routing Table Modification

The remote RIP listener accepts routes that are not sent by a neighbor. This cannot happen in the RIP protocol as defined by RFC2453, and although the RFC is silent on this point, such routes should probably be ignored. A remote attacker might use this flaw to access the local network if it is no...

Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-7007-3)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7007-3 advisory. Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use...

RHEL 8 : openssl (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - openssl: the crehash script allows command injection CVE-2022-2068 - The OpenSSL DSA signature algorithm...

Juniper Junos OS Pre-Auth RCE (JSA72300)

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA72300 advisory. - A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX and SRX Series allows an unauthenticated, network-based attacker to...

Azul Zulu Java Multiple Vulnerabilities (2023-01-17)

The version of Azul Zulu installed on the remote host is 6 prior to 6.53.0.12 / 7 prior to 7.59.0.18 / 8 prior to 8.67.0.22 / 11 prior to 11.61.18 / 13 prior to 13.53.18 / 15 prior to 15.45.18 / 17 prior to 17.39.20 / 19 prior to 19.32.14. It is, therefore, affected by multiple vulnerabilities as...

EulerOS 2.0 SP8 : openssl (EulerOS-SA-2022-2228)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not properl...

KB5012592: Windows 11 Security Update (April 2022)

The remote Windows host is missing security update 5012592. It is, therefore, affected by multiple vulnerabilities: - A denial of service DoS vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services. CVE-2022-26831 CVE-2022-26915,...

EulerOS 2.0 SP8 : httpd (EulerOS-SA-2021-2803)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier. CVE-2021-34798 -...

FreeBSD : Apache httpd -- Path Traversal and Remote Code Execution (d001c189-2793-11ec-8fb1-206a8a720317)

The Apache http server project reports : critical: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 incomplete fix of CVE-2021-41773 CVE-2021-42013. It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a...

Mozilla Thunderbird < 78.14

The version of Thunderbird installed on the remote Windows host is prior to 78.14. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-42 advisory. - Mozilla developers Tyson Smith and Gabriele Svelto reported memory safety bugs present in Thunderbird 78.13. Some ...

Photon OS 1.0: Linux PHSA-2020-1.0-0350

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0350. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid144519...

EulerOS Virtualization 3.0.6.0 : kvm (EulerOS-SA-2020-1792)

According to the versions of the kvm package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor...

Fedora 31 : kernel (2020-5436586091)

The 5.6.15 stable kernel update contains a number of important fixes across the tree. ---- The 5.6.14 stable kernel update contains a number of important fixes across the tree Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

EulerOS 2.0 SP3 : nss-util (EulerOS-SA-2020-1415)

According to the version of the nss-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory a...

FreeBSD : FreeBSD -- Intel CPU Microcode Update (fbe10a8a-05a1-11ea-9dfa-f8b156ac3ff9) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (Spectre)

Starting with version 1.26, the devcpu-data port/package includes updates and mitigations for the following technical and security advisories depending on CPU model. Intel TSX Updates TAA CVE-2019-11135 Voltage Modulation Vulnerability CVE-2019-11139 MDCLEAR Operations CVE-2018-12126 CVE-2018-121...