This update for java-1_7_0-openjdk to version 7u201 fixes the following issues :

Security issues fixed :

  - CVE-2018-3136: Manifest better support (bsc#1112142)

  - CVE-2018-3139: Better HTTP Redirection (bsc#1112143)

  - CVE-2018-3149: Enhance JNDI lookups (bsc#1112144)

  - CVE-2018-3169: Improve field accesses (bsc#1112146)

  - CVE-2018-3180: Improve TLS connections stability     (bsc#1112147)

  - CVE-2018-3214: Better RIFF reading support (bsc#1112152)

  - CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35     (bsc#1112153)

  - CVE-2018-16435: heap-based buffer overflow in SetData     function in cmsIT8LoadFromFile

  - CVE-2018-2938: Support Derby connections (bsc#1101644)

  - CVE-2018-2940: Better stack walking (bsc#1101645)

  - CVE-2018-2952: Exception to Pattern Syntax (bsc#1101651)

  - CVE-2018-2973: Improve LDAP support (bsc#1101656)

  - CVE-2018-3639 cpu speculative store bypass mitigation

This update was imported from the SUSE:SLE-12:Update update project.

This update for lcms2 fixes the following issues :

CVE-2018-16435: A integer overflow was fixed in the AllocateDataSet function in cmscgats.c, that could lead to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile. (bsc#1108813)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_8_0-openjdk to version 8u191 fixes the following issues :

Security issues fixed :

CVE-2018-3136: Manifest better support (bsc#1112142)

CVE-2018-3139: Better HTTP Redirection (bsc#1112143)

CVE-2018-3149: Enhance JNDI lookups (bsc#1112144)

CVE-2018-3169: Improve field accesses (bsc#1112146)

CVE-2018-3180: Improve TLS connections stability (bsc#1112147)

CVE-2018-3214: Better RIFF reading support (bsc#1112152)

CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35 (bsc#1112153)

CVE-2018-3183: Improve script engine support (bsc#1112148)

CVE-2018-16435: heap-based buffer overflow in SetData function in cmsIT8LoadFromFile

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_0-openjdk to version 7u201 fixes the following issues :

Security issues fixed :

CVE-2018-3136: Manifest better support (bsc#1112142)

CVE-2018-3139: Better HTTP Redirection (bsc#1112143)

CVE-2018-3149: Enhance JNDI lookups (bsc#1112144)

CVE-2018-3169: Improve field accesses (bsc#1112146)

CVE-2018-3180: Improve TLS connections stability (bsc#1112147)

CVE-2018-3214: Better RIFF reading support (bsc#1112152)

CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35 (bsc#1112153)

CVE-2018-16435: heap-based buffer overflow in SetData function in cmsIT8LoadFromFile

CVE-2018-2938: Support Derby connections (bsc#1101644)

CVE-2018-2940: Better stack walking (bsc#1101645)

CVE-2018-2952: Exception to Pattern Syntax (bsc#1101651)

CVE-2018-2973: Improve LDAP support (bsc#1101656)

CVE-2018-3639 cpu speculative store bypass mitigation

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:3004 advisory.

    Chromium is an open-source web browser, powered by WebKit (Blink).

    This update upgrades Chromium to version 70.0.3538.67.

    Security Fix(es):

    * chromium-browser: Sandbox escape in AppCache (CVE-2018-17462)

    * chromium-browser: Remote code execution in V8 (CVE-2018-17463)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-17464)

    * chromium-browser: Use after free in V8 (CVE-2018-17465)

    * chromium-browser: Memory corruption in Angle (CVE-2018-17466)

    * lcms2: Integer overflow in AllocateDataSet() in cmscgats.c leading to heap-based buffer overflow     (CVE-2018-16435)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-17467)

    * chromium-browser: Cross-origin URL disclosure in Blink (CVE-2018-17468)

    * chromium-browser: Heap buffer overflow in PDFium (CVE-2018-17469)

    * chromium-browser: Memory corruption in GPU Internals (CVE-2018-17470)

    * chromium-browser: Security UI occlusion in full screen mode (CVE-2018-17471)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-17473)

    * chromium-browser: Use after free in Blink (CVE-2018-17474)

    * chromium-browser: Lack of limits on update() in ServiceWorker (CVE-2018-5179)

    * chromium-browser: URL spoof in Omnibox (CVE-2018-17475)

    * chromium-browser: Security UI occlusion in full screen mode (CVE-2018-17476)

    * chromium-browser: UI spoof in Extensions (CVE-2018-17477)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to chromium 70.0.3538.77. Fixes CVE-2018-16435 CVE-2018-17462 CVE-2018-17463 CVE-2018-17464 CVE-2018-17465 CVE-2018-17466 CVE-2018-17467 CVE-2018-17468 CVE-2018-17469 CVE-2018-17470 CVE-2018-17471 CVE-2018-17473 CVE-2018-17474 CVE-2018-17475 CVE-2018-17476 CVE-2018-5179 CVE-2018-17477

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Quang Nguyen discovered an integer overflow in the Little CMS 2 colour management library, which could result in denial of service and potentially the execution of arbitrary code if a malformed IT8 calibration file is processed.

Security fix for CVE-2018-16435

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the lcms2 package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - Little CMS (aka Little Color Management System) 2.9 has     an integer overflow in the AllocateDataSet function in     cmscgats.c, leading to a heap-based buffer overflow in     the SetData function via a crafted file in the second     argument to cmsIT8LoadFromFile.(CVE-2018-16435)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2018-17478 CVE-2018-17479. Update to 70.0.3538.110.

----

Update to chromium 70.0.3538.77. Fixes CVE-2018-16435 CVE-2018-17462 CVE-2018-17463 CVE-2018-17464 CVE-2018-17465 CVE-2018-17466 CVE-2018-17467 CVE-2018-17468 CVE-2018-17469 CVE-2018-17470 CVE-2018-17471 CVE-2018-17473 CVE-2018-17474 CVE-2018-17475 CVE-2018-17476 CVE-2018-5179 CVE-2018-17477

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was an integer overflow vulnerability in the 'Little CMS 2' colour management library. A specially crafted input file could lead to a heap-based buffer overflow.

For Debian 8 'Jessie', this issue has been fixed in lcms2 version 2.6-3+deb8u2.

We recommend that you upgrade your lcms2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the lcms2 package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Little CMS (aka Little Color Management System) 2.9 has     an integer overflow in the AllocateDataSet function in     cmscgats.c, leading to a heap-based buffer overflow in     the SetData function via a crafted file in the second     argument to cmsIT8LoadFromFile.(CVE-2018-16435)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202105-18 (LittleCMS: User-assisted execution of arbitrary code)

    It was discovered that LittleCMS (aka Little Color Management System)       had an integer overflow in the AllocateDataSet function in cmscgats.c.
  Impact :

    A remote attacker could entice a user or automated system to open a       specially crafted file containing malicious color data, possibly       resulting in execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	名稱	產品	系列	已發布	已更新	嚴重性
121151	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2019-42) (Spectre)	Nessus	SuSE Local Security Checks	2019/1/14	2026/1/9	critical
120148	SUSE SLED15 / SLES15 Security Update : lcms2 (SUSE-SU-2018:3498-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/10	medium
121091	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:0057-1)	Nessus	SuSE Local Security Checks	2019/1/11	2024/6/27	critical
121059	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2019:0049-1) (Spectre)	Nessus	SuSE Local Security Checks	2019/1/10	2026/1/9	critical
118373	RHEL 6 : chromium-browser (RHSA-2018:3004)	Nessus	Red Hat Local Security Checks	2018/10/25	2024/11/5	critical
120342	Fedora 29 : chromium (2018-34f7f68029)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/8	critical
112280	Debian DSA-4284-1 : lcms2 - security update	Nessus	Debian Local Security Checks	2018/9/5	2024/8/12	medium
117927	Fedora 27 : lcms2 (2018-3e9f26489b)	Nessus	Fedora Local Security Checks	2018/10/5	2024/8/1	medium
131507	EulerOS Virtualization for ARM 64 3.0.3.0 : lcms2 (EulerOS-SA-2019-2342)	Nessus	Huawei Local Security Checks	2019/12/3	2024/4/8	medium
120933	Fedora 28 : chromium (2018-fd194a1f14)	Nessus	Fedora Local Security Checks	2019/1/3	2024/6/28	critical
117350	Debian DLA-1496-1 : lcms2 security update	Nessus	Debian Local Security Checks	2018/9/7	2024/8/8	medium
120500	Fedora 29 : lcms2 (2018-6ac39c63c4)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/5	medium
145163	EulerOS 2.0 SP3 : lcms2 (EulerOS-SA-2021-1081)	Nessus	Huawei Local Security Checks	2021/1/20	2024/1/29	medium
146707	EulerOS 2.0 SP2 : lcms2 (EulerOS-SA-2021-1313)	Nessus	Huawei Local Security Checks	2021/2/22	2024/1/19	medium
151329	EulerOS Virtualization for ARM 64 3.0.2.0 : lcms2 (EulerOS-SA-2021-2098)	Nessus	Huawei Local Security Checks	2021/7/2	2023/12/11	medium
156979	GLSA-202105-18 : LittleCMS: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	2022/1/24	2023/12/21	medium

偵測

搜尋 Plugin

critical

medium

critical

critical

critical

critical

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium