According to its self-reported version number, the remote Junos Space version is prior to 19.2R1. It is, therefore, affected by multiple vulnerabilities:
    - A memory double free vulnerability exists in The libcurl API function called `curl_maprintf()` before version 7.51.0       due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables. An unauthiticated remote attacker       can leverage this issue to perform unauthorized actions. This may aid in further attacks. (CVE-2016-8618) 

    - A denial of service (DoS) vulnerability exists in Node.js 6.16.0 and earlier due to that Keep-alive HTTP and HTTPS       connections can remain open and inactive for up to 2 minutes. An unauthenticated, remote attacker can exploit this       issue to cause a denial of service. (CVE-2016-8619)       
    - A vulnerability in curl before version 7.51.0 due to the use of an outdated IDNA 2003 standard to handle International       Domain Names. This could lead users to unknowingly issue network transfer requests to the wrong host. (CVE-2016-8625)

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.155 to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-13093: Prevent NULL pointer dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image. This occured because of a lack of proper validation that cached inodes are free during allocation (bnc#1100001).

CVE-2018-13095: Prevent denial of service (memory corruption and BUG) that could have occurred for a corrupted xfs image upon encountering an inode that is in extent format, but has more extents than fit in the inode fork (bnc#1099999).

CVE-2018-13094: Prevent OOPS that may have occured for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp (bnc#1100000).

CVE-2018-12896: Prevent integer overflow in the POSIX timer code that was caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically made the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. This allowed a local user to cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls (bnc#1099922).

CVE-2018-16658: Prevent information leak in cdrom_ioctl_drive_status that could have been used by local attackers to read kernel memory (bnc#1107689).

CVE-2018-6555: The irda_setsockopt function allowed local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket (bnc#1106511).

CVE-2018-6554: Prevent memory leak in the irda_bind function that allowed local users to cause a denial of service (memory consumption) by repeatedly binding an AF_IRDA socket (bnc#1106509).

CVE-2018-1129: A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol (bnc#1096748).

CVE-2018-1128: It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service (bnc#1096748).

CVE-2018-10938: A crafted network packet sent remotely by an attacker forced the kernel to enter an infinite loop in the cipso_v4_optptr() function leading to a denial-of-service (bnc#1106016).

CVE-2018-15572: The spectre_v2_select_mitigation function did not always fill RSB upon a context switch, which made it easier for attackers to conduct userspace-userspace spectreRSB attacks (bnc#1102517).

CVE-2018-10902: Protect against concurrent access to prevent double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(). A malicious local attacker could have used this for privilege escalation (bnc#1105322 1105323).

CVE-2018-9363: Prevent buffer overflow in hidp_process_report (bsc#1105292)

CVE-2018-10883: A local user could have caused an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image (bsc#1099863).

CVE-2018-10879: A local user could have caused a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact by renaming a file in a crafted ext4 filesystem image (bsc#1099844).

CVE-2018-10878: A local user could have caused an out-of-bounds write and a denial of service or unspecified other impact by mounting and operating a crafted ext4 filesystem image (bsc#1099813).

CVE-2018-10876: A use-after-free was possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image (bsc#1099811).

CVE-2018-10877: Prevent out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image (bsc#1099846).

CVE-2018-10881: A local user could have caused an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image (bsc#1099864).

CVE-2018-10882: A local user could have caused an out-of-bound write, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image (bsc#1099849).

CVE-2018-10880: Prevent stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could have used this to cause a system crash and a denial of service (bsc#1099845).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2018-6554     A memory leak in the irda_bind function in the irda     subsystem was discovered. A local user can take     advantage of this flaw to cause a denial of service     (memory consumption).

  - CVE-2018-6555     A flaw was discovered in the irda_setsockopt function in     the irda subsystem, allowing a local user to cause a     denial of service (use-after-free and system crash).

  - CVE-2018-7755     Brian Belleville discovered a flaw in the     fd_locked_ioctl function in the floppy driver in the     Linux kernel. The floppy driver copies a kernel pointer     to user memory in response to the FDGETPRM ioctl. A     local user with access to a floppy drive device can take     advantage of this flaw to discover the location kernel     code and data.

  - CVE-2018-9363     It was discovered that the Bluetooth HIDP implementation     did not correctly check the length of received report     messages. A paired HIDP device could use this to cause a     buffer overflow, leading to denial of service (memory     corruption or crash) or potentially remote code     execution.

  - CVE-2018-9516     It was discovered that the HID events interface in     debugfs did not correctly limit the length of copies to     user buffers. A local user with access to these files     could use this to cause a denial of service (memory     corruption or crash) or possibly for privilege     escalation. However, by default debugfs is only     accessible by the root user.

  - CVE-2018-10902     It was discovered that the rawmidi kernel driver does     not protect against concurrent access which leads to a     double-realloc (double free) flaw. A local attacker can     take advantage of this issue for privilege escalation.

  - CVE-2018-10938     Yves Younan from Cisco reported that the Cipso IPv4     module did not correctly check the length of IPv4     options. On custom kernels with CONFIG_NETLABEL enabled,     a remote attacker could use this to cause a denial of     service (hang).

  - CVE-2018-13099     Wen Xu from SSLab at Gatech reported a use-after-free     bug in the F2FS implementation. An attacker able to     mount a crafted F2FS volume could use this to cause a     denial of service (crash or memory corruption) or     possibly for privilege escalation.

  - CVE-2018-14609     Wen Xu from SSLab at Gatech reported a potential NULL     pointer dereference in the F2FS implementation. An     attacker able to mount a crafted F2FS volume could use     this to cause a denial of service (crash).

  - CVE-2018-14617     Wen Xu from SSLab at Gatech reported a potential NULL     pointer dereference in the HFS+ implementation. An     attacker able to mount a crafted HFS+ volume could use     this to cause a denial of service (crash).

  - CVE-2018-14633     Vincent Pelletier discovered a stack-based buffer     overflow flaw in the chap_server_compute_md5() function     in the iSCSI target code. An unauthenticated remote     attacker can take advantage of this flaw to cause a     denial of service or possibly to get a non-authorized     access to data exported by an iSCSI target.

  - CVE-2018-14678     M. Vefa Bicakci and Andy Lutomirski discovered a flaw in     the kernel exit code used on amd64 systems running as     Xen PV guests. A local user could use this to cause a     denial of service (crash).

  - CVE-2018-14734     A use-after-free bug was discovered in the InfiniBand     communication manager. A local user could use this to     cause a denial of service (crash or memory corruption)     or possible for privilege escalation.

  - CVE-2018-15572     Esmaiel Mohammadian Koruyeh, Khaled Khasawneh, Chengyu     Song, and Nael Abu-Ghazaleh, from University of     California, Riverside, reported a variant of Spectre     variant 2, dubbed SpectreRSB. A local user may be able     to use this to read sensitive information from processes     owned by other users.

  - CVE-2018-15594     Nadav Amit reported that some indirect function calls     used in paravirtualised guests were vulnerable to     Spectre variant 2. A local user may be able to use this     to read sensitive information from the kernel.

  - CVE-2018-16276     Jann Horn discovered that the yurex driver did not     correctly limit the length of copies to user buffers. A     local user with access to a yurex device node could use     this to cause a denial of service (memory corruption or     crash) or possibly for privilege escalation.

  - CVE-2018-16658     It was discovered that the cdrom driver does not     correctly validate the parameter to the     CDROM_DRIVE_STATUS ioctl. A user with access to a cdrom     device could use this to read sensitive information from     the kernel or to cause a denial of service (crash).

  - CVE-2018-17182     Jann Horn discovered that the vmacache_flush_all     function mishandles sequence number overflows. A local     user can take advantage of this flaw to trigger a     use-after-free, causing a denial of service (crash or     memory corruption) or privilege escalation.

This update for the Linux Kernel 4.4.103-92_56 fixes several issues.

The following security issues were fixed :

CVE-2018-5390: Prevent very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming TCP packet which can lead to a denial of service (bsc#1102682).

CVE-2018-1000026: Fixed an insufficient input validation in bnx2x network card driver that can result in DoS via very large, specially crafted packet to the bnx2x card due to a network card firmware assertion that will take the card offline (bsc#1096723).

CVE-2018-10938: Fixed an infinite loop in the cipso_v4_optptr() function leading to a denial-of-service via crafted network packets (bsc#1106191).

CVE-2018-10902: It was found that the raw midi kernel driver did not protect against concurrent access which lead to a double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(), allowing a malicious local attacker to use this for privilege escalation (bsc#1105323).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities:

  - A buffer overflow vulnerability due to a lack of input     filtering of incoming fragmented datagrams was found in     the IP-over-1394 driver [firewire-net] in a fragment     handling code in the Linux kernel. The vulnerability     exists since firewire supported IPv4, i.e. since version     2.6.31 (year 2009) till version v4.9-rc4. A maliciously     formed fragment with a respectively large datagram     offset would cause a memcpy() past the datagram buffer,     which would cause a system panic or possible arbitrary     code execution. The flaw requires [firewire-net] module     to be loaded and is remotely exploitable from connected     firewire devices, but not over a local network.
    (CVE-2016-8633)

  - A bug in the 32-bit compatibility layer of the ioctl     handling code of the v4l2 video driver in the Linux     kernel has been found. A memory protection mechanism     ensuring that user-provided buffers always point to a     userspace memory were disabled, allowing destination     address to be in a kernel space. This flaw could be     exploited by an attacker to overwrite a kernel memory     from an unprivileged userspace process, leading to     privilege escalation. (CVE-2017-13166)

  - The timer_create syscall implementation in     kernel/time/posix-timers.c in the Linux kernel doesn't     properly validate the sigevent->sigev_notify field,     which leads to out-of-bounds access in the show_timer     function. (CVE-2017-18344)

  - A use-after-free vulnerability was found in DCCP socket     code affecting the Linux kernel since 2.6.16. This     vulnerability could allow an attacker to their escalate     privileges. (CVE-2017-8824)

  - A flaw was found in the way the Linux kernel's KVM     hypervisor handled exceptions delivered after a stack     switch operation via Mov SS or Pop SS instructions.
    During the stack switch operation, the processor did not     deliver interrupts and exceptions, rather they are     delivered once the first instruction after the stack     switch is executed. An unprivileged KVM guest user could     use this flaw to crash the guest or, potentially,     escalate their privileges in the guest. (CVE-2018-1087)

  - It was found that the raw midi kernel driver does not     protect against concurrent access which leads to a     double realloc (double free) in     snd_rawmidi_input_params() and     snd_rawmidi_output_status() which are part of     snd_rawmidi_ioctl() handler in rawmidi.c file. A     malicious local attacker could possibly use this for     privilege escalation. (CVE-2018-10902)

  - A vulnerability was found in the     fs/inode.c:inode_init_owner() function logic of the     LInux kernel that allows local users to create files     with an unintended group ownership and with group     execution and SGID permission bits set, in a scenario     where a directory is SGID and belongs to a certain group     and is writable by a user who is not a member of this     group. This can lead to excessive permissions granted in     case when they should not. (CVE-2018-13405)

  - Modern operating systems implement virtualization of     physical memory to efficiently use available system     resources and provide inter-domain protection through     access control and isolation. The L1TF issue was found     in the way the x86 microprocessor designs have     implemented speculative execution of instructions (a     commonly used performance optimization) in combination     with handling of page-faults caused by terminated     virtual to physical address resolving process. As a     result, an unprivileged attacker could use this flaw to     read privileged memory of the kernel or other processes     and/or cross guest/host boundaries to read host memory     by conducting targeted cache side-channel attacks.
    (CVE-2018-3620)

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of Load & Store instructions (a commonly used     performance optimization). It relies on the presence of     a precisely-defined instruction sequence in the     privileged code as well as the fact that memory read     from address to which a recent memory write has occurred     may see an older value and subsequently cause an update     into the microprocessor's data cache even for     speculatively executed instructions that never actually     commit (retire). As a result, an unprivileged attacker     could use this flaw to read privileged memory by     conducting targeted cache side-channel attacks.
    (CVE-2018-3639)

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of instructions past bounds check. The flaw     relies on the presence of a precisely-defined     instruction sequence in the privileged code and the fact     that memory writes occur to an address which depends on     the untrusted value. Such writes cause an update into     the microprocessor's data cache even for speculatively     executed instructions that never actually commit     (retire). As a result, an unprivileged attacker could     use this flaw to influence speculative execution and/or     read privileged memory by conducting targeted cache     side-channel attacks. (CVE-2018-3693)

  - A flaw named FragmentSmack was found in the way the     Linux kernel handled reassembly of fragmented IPv4 and     IPv6 packets. A remote attacker could use this flaw to     trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted     packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

  - A an integer overflow vulnerability was discovered in     the Linux kernel, from version 3.4 through 4.15, in the     drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap() function. An     attacker with access to the udldrmfb driver could     exploit this to obtain full read and write permissions     on kernel physical pages, resulting in a code execution     in kernel space. (CVE-2018-8781)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3217 advisory.

    The kernel-alt packages provide the Linux kernel version 4.x.

    Security Fix(es):

    * kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

    * kernel: Use-after-free in __blk_drain_queue() function in block/blk-core.c (CVE-2018-20856)

    * kernel: brcmfmac heap buffer overflow in brcmf_wowl_nd_results (CVE-2019-9500)

    * hardware: bluetooth: BR/EDR encryption key negotiation attacks (KNOB) (CVE-2019-9506)

    * kernel: a NULL pointer dereference in drivers/scsi/megaraid/megaraid_sas_base.c leading to DoS     (CVE-2019-11810)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel modules pkey and paes_s390 are not available (BZ#1719192)

    * pkey: Indicate old mkvp only if old and curr. mkvp are different (BZ#1720621)

    * System dropped into Mon running softboots Exception: 501 (Hardware Interrupt) at c00000000000a814     replay_interrupt_return+0x0/0x4 (ipmi) (BZ#1737563)

    * kernel: jump label transformation performance (BZ#1739143)

    * Backport i40e MDD detection removal for PFs (BZ#1747618)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3083 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4     and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

    * kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c (CVE-2017-18344)

    * kernel: Integer overflow in udl_fb_mmap() can allow attackers to execute code in kernel space     (CVE-2018-8781)

    * kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

    * kernel: Missing check in inode_init_owner() does not clear SGID bit on non-directories for non-members     (CVE-2018-13405)

    * kernel: AIO write triggers integer overflow in some protocols (CVE-2015-8830)

    * kernel: Use-after-free in snd_pcm_info function in ALSA subsystem potentially leads to privilege     escalation (CVE-2017-0861)

    * kernel: Handling of might_cancel queueing is not properly pretected against race (CVE-2017-10661)

    * kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local     attackers to cause denial of service (CVE-2017-17805)

    * kernel: Inifinite loop vulnerability in madvise_willneed() function allows local denial of service     (CVE-2017-18208)

    * kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service (CVE-2018-1120)

    * kernel: a null pointer dereference in dccp_write_xmit() leads to a system crash (CVE-2018-1130)

    * kernel: drivers/block/loop.c mishandles lo_release serialization allowing denial of service     (CVE-2018-5344)

    * kernel: Missing length check of payload in _sctp_make_chunk() function allows denial of service     (CVE-2018-5803)

    * kernel: buffer overflow in drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may lead to memory     corruption (CVE-2018-5848)

    * kernel: out-of-bound write in ext4_init_block_bitmap function with a crafted ext4 image (CVE-2018-10878)

    * kernel: Improper validation in bnx2x network card driver can allow for denial of service attacks via     crafted packet (CVE-2018-1000026)

    * kernel: Information leak when handling NM entries containing NUL (CVE-2016-4913)

    * kernel: Mishandling mutex within libsas allowing local Denial of Service (CVE-2017-18232)

    * kernel: NULL pointer dereference in ext4_process_freed_data() when mounting crafted ext4 image     (CVE-2018-1092)

    * kernel: NULL pointer dereference in ext4_xattr_inode_hash() causes crash with crafted ext4 image     (CVE-2018-1094)

    * kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2018-1118)

    * kernel: Denial of service in resv_map_release function in mm/hugetlb.c (CVE-2018-7740)

    * kernel: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c     (CVE-2018-7757)

    * kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when mounting crafted xfs image     allowing denial of service (CVE-2018-10322)

    * kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file (CVE-2018-10879)

    * kernel: out-of-bound access in ext4_get_group_info() when mounting and operating a crafted ext4 image     (CVE-2018-10881)

    * kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function (CVE-2018-10883)

    * kernel: incorrect memory bounds check in drivers/cdrom/cdrom.c (CVE-2018-10940)

    Red Hat would like to thank Juha-Matti Tilli (Aalto University - Department of Communications and     Networking and Nokia Bell Labs) for reporting CVE-2018-5391; Trend Micro Zero Day Initiative for reporting     CVE-2018-10902; Qualys Research Labs for reporting CVE-2018-1120; Evgenii Shatokhin (Virtuozzo Team) for     reporting CVE-2018-1130; and Wen Xu for reporting CVE-2018-1092 and CVE-2018-1094.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-0415 advisory.

    [2.6.32-754.11.1.OL6]
    - Update genkey [bug 25599697]

    [2.6.32-754.11.1]
    - [x86] mm/fault: Allow stack access below rsp (Waiman Long) [1644401]
    - [sound] alsa: rawmidi: Change resized buffers atomically (Denys Vlasenko) [1593083] {CVE-2018-10902}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - kernel: MIDI driver race condition leads to a     double-free (CVE-2018-10902)

Bug Fix(es) :

  - Previously backported upstream patch caused a change in     the behavior of page fault handler. As a consequence,     applications compiled through GNU Compiler Collection     (GCC) version 4.4.7 sometimes generated stack access     exceeding the 64K limit. Running such applications     subsequently triggered a segmentation fault. With this     update, the 64k limit check in the page fault handler     has been removed. As a result, running the affected     applications no longer triggers the segmentation fault     in the described scenario.

Note that removing the limit check does not impact the integrity of the kernel itself.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0641 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

    * kernel: net/rxrpc: overflow in decoding of krb5 principal (CVE-2017-7482)

    * kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows     denial of service (CVE-2018-5803)

    * kernel: use-after-free in ntfs_read_locked_inode in the ntfs.ko (CVE-2018-12929)

    * kernel: stack-based out-of-bounds write in ntfs_end_buffer_async_read in the ntfs.ko (CVE-2018-12930)

    * kernel: stack-based out-of-bounds write in ntfs_attr_find in the ntfs.ko (CVE-2018-12931)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Remove the NTFS module from the MRG 2.5.x realtime kernel (BZ#1674523)

    * update the MRG 2.5.z 3.10 kernel-rt sources (BZ#1674935)

    Users of kernel-rt are advised to upgrade to these updated packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - xfs: don't call xfs_da_shrink_inode with NULL bp (Eric     Sandeen) [Orabug: 28898616] (CVE-2018-13094)

  - ALSA: rawmidi: Change resized buffers atomically     (Takashi Iwai) [Orabug: 28898636] (CVE-2018-10902)

  - md/raid5: fix a race condition in stripe batch (Shaohua     Li) [Orabug: 28917012]

  - xfs: don't fail when converting shortform attr to long     form during ATTR_REPLACE (Darrick J. Wong) [Orabug:
    28924091] (CVE-2018-18690)

  - certs: Add Oracle's new X509 cert into the kernel     keyring (Eric Snowberg) [Orabug: 28926203]

  - block: fix bdi vs gendisk lifetime mismatch (Shan Hai)     [Orabug: 28945039]

  - Add the following entries to     'uek-rpm/ol[67]/nano_modules.list':
    kernel/drivers/net/net_failover.ko     kernel/net/core/failover.ko Fixes: b3bc7c163fc9 ('net:
    Introduce generic failover module') (Vijay Balakrishna)     [Orabug: 28953351]

  - floppy: Do not copy a kernel pointer to user memory in     FDGETPRM ioctl (Andy Whitcroft) [Orabug: 28956547]     (CVE-2018-7755) (CVE-2018-7755)

  - iov_iter: don't revert iov buffer if csum error (Ding     Tianhong) [Orabug: 28960296]

  - crypto: salsa20 - fix blkcipher_walk API usage (Eric     Biggers) [Orabug: 28976583] (CVE-2017-17805)

  - crypto: hmac - require that the underlying hash     algorithm is unkeyed (Eric Biggers) [Orabug: 28976653]     (CVE-2017-17806)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4300 advisory.

    - udf: Check component length before reading it (Jan Kara)  [Orabug: 21193696]  {CVE-2014-9728}
    - udf: Verify i_size when loading inode (Shan Hai)  [Orabug: 21193696]  {CVE-2014-9728}
    - scsi: libsas: defer ata device eh commands to libata (Jason Yan)  [Orabug: 28459689]  {CVE-2018-10021}
    - nfsd: silence sparse warning about accessing credentials (Jeff Layton)  [Orabug: 28824742]     {CVE-2017-13168}
    - scsi: sg: mitigate read/write abuse (Jann Horn)  [Orabug: 28824742]  {CVE-2017-13168}
    - scsi: sg: allocate with __GFP_ZERO in sg_build_indirect() (Alexander Potapenko)  [Orabug: 28892683]     {CVE-2018-1000204}
    - ALSA: rawmidi: Change resized buffers atomically (Takashi Iwai)  [Orabug: 28898650]  {CVE-2018-10902}
    - KVM: MTRR: remove MSR 0x2f8 (Andy Honig)  [Orabug: 28901657]  {CVE-2016-3713} {CVE-2016-3713}
    - cdrom: fix improper type cast, which can leat to information leak. (Young_X)  [Orabug: 28929777]     {CVE-2018-16658} {CVE-2018-10940} {CVE-2018-18710}
    - floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl (Andy Whitcroft)   {CVE-2018-7755}     {CVE-2018-7755}
    - crypto: salsa20 - fix blkcipher_walk API usage (Eric Biggers)  [Orabug: 28976585]  {CVE-2017-17805}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3967 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Memory corruption due to incorrect socket cloning (CVE-2018-9568)

    * kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

    * kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559)

    * Kernel: vhost_net: infinite loop while receiving packets leads to DoS (CVE-2019-3900)

    * Kernel: page cache side channel attacks (CVE-2019-5489)

    * Kernel: KVM: potential use-after-free via kvm_ioctl_create_device() (CVE-2019-6974)

    * Kernel: KVM: nVMX: use-after-free of the hrtimer for emulation of the preemption timer (CVE-2019-7221)

    * kernel: Inifinite loop vulnerability in mm/madvise.c:madvise_willneed() function allows local denial of     service (CVE-2017-18208)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * A cluster node has multiple hung mv processes that are accessing a gfs2 filesystem. (BZ#1716321)

    * Growing unreclaimable slab memory (BZ#1741918)

    * [LLNL 7.5 Bug] slab leak causing a crash when using kmem control group (BZ#1748236)

    * kernel build: parallelize redhat/mod-sign.sh (BZ#1755328)

    * kernel build: speed up module compression step (BZ#1755337)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.06, has kernel packages installed that are affected by multiple vulnerabilities:

  - A vulnerability was found in the     fs/inode.c:inode_init_owner() function logic of the     LInux kernel that allows local users to create files     with an unintended group ownership and with group     execution and SGID permission bits set, in a scenario     where a directory is SGID and belongs to a certain group     and is writable by a user who is not a member of this     group. This can lead to excessive permissions granted in     case when they should not. (CVE-2018-13405)

  - It was found that the raw midi kernel driver does not     protect against concurrent access which leads to a     double realloc (double free) in     snd_rawmidi_input_params() and     snd_rawmidi_output_status() which are part of     snd_rawmidi_ioctl() handler in rawmidi.c file. A     malicious local attacker could possibly use this for     privilege escalation. (CVE-2018-10902)

  - Modern Intel microprocessors implement hardware-level     micro-optimizations to improve the performance of     writing data back to CPU caches. The write operation is     split into STA (STore Address) and STD (STore Data) sub-     operations. These sub-operations allow the processor to     hand-off address generation logic into these sub-     operations for optimized writes. Both of these sub-     operations write to a shared distributed processor     structure called the 'processor store buffer'. As a     result, an unprivileged attacker could use this flaw to     read private data resident within the CPU's processor     store buffer. (CVE-2018-12126)

  - A flaw was found in the implementation of the fill     buffer, a mechanism used by modern CPUs when a cache-     miss is made on L1 CPU cache. If an attacker can     generate a load operation that would create a page     fault, the execution will continue speculatively with     incorrect data from the fill buffer while the data is     fetched from higher level caches. This response time can     be measured to infer data in the fill buffer.
    (CVE-2018-12130)

  - Uncacheable memory on some microprocessors utilizing     speculative execution may allow an authenticated user to     potentially enable information disclosure via a side     channel with local access. (CVE-2019-11091)

  - Microprocessors use a load port subcomponent to     perform load operations from memory or IO. During a load     operation, the load port receives data from the memory     or IO subsystem and then provides the data to the CPU     registers and operations in the CPUs pipelines. Stale     load operations results are stored in the 'load port'     table until overwritten by newer operations. Certain     load-port operations triggered by an attacker can be     used to reveal data about previous stale requests     leaking data back to the attacker via a timing side-     channel. (CVE-2018-12127)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - A flaw named FragmentSmack was found in the way the     Linux kernel handled reassembly of fragmented IPv4 and     IPv6 packets. A remote attacker could use this flaw to     trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted     packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

  - kernel: out-of-bounds access in the show_timer function     in kernel/time /posix-timers.c (CVE-2017-18344)

  - kernel: Integer overflow in udl_fb_mmap() can allow     attackers to execute code in kernel space     (CVE-2018-8781)

  - kernel: MIDI driver race condition leads to a     double-free (CVE-2018-10902)

  - kernel: Missing check in inode_init_owner() does not     clear SGID bit on non-directories for non-members     (CVE-2018-13405)

  - kernel: AIO write triggers integer overflow in some     protocols (CVE-2015-8830)

  - kernel: Use-after-free in snd_pcm_info function in ALSA     subsystem potentially leads to privilege escalation     (CVE-2017-0861)

  - kernel: Handling of might_cancel queueing is not     properly pretected against race (CVE-2017-10661)

  - kernel: Salsa20 encryption algorithm does not correctly     handle zero- length inputs allowing local attackers to     cause denial of service (CVE-2017-17805)

  - kernel: Inifinite loop vulnerability in     madvise_willneed() function allows local denial of     service (CVE-2017-18208)

  - kernel: fuse-backed file mmap-ed onto process cmdline     arguments causes denial of service (CVE-2018-1120)

  - kernel: a NULL pointer dereference in dccp_write_xmit()     leads to a system crash (CVE-2018-1130)

  - kernel: drivers/block/loop.c mishandles lo_release     serialization allowing denial of service (CVE-2018-5344)

  - kernel: Missing length check of payload in
    _sctp_make_chunk() function allows denial of service     (CVE-2018-5803)

  - kernel: buffer overflow in     drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may     lead to memory corruption (CVE-2018-5848)

  - kernel: out-of-bound write in ext4_init_block_bitmap     function with a crafted ext4 image (CVE-2018-10878)

  - kernel: Improper validation in bnx2x network card driver     can allow for denial of service attacks via crafted     packet (CVE-2018-1000026)

  - kernel: Information leak when handling NM entries     containing NUL (CVE-2016-4913)

  - kernel: Mishandling mutex within libsas allowing local     Denial of Service (CVE-2017-18232)

  - kernel: NULL pointer dereference in     ext4_process_freed_data() when mounting crafted ext4     image (CVE-2018-1092)

  - kernel: NULL pointer dereference in     ext4_xattr_inode_hash() causes crash with crafted ext4     image (CVE-2018-1094)

  - kernel: vhost: Information disclosure in     vhost/vhost.c:vhost_new_msg() (CVE-2018-1118)

  - kernel: Denial of service in resv_map_release function     in mm/hugetlb.c (CVE-2018-7740)

  - kernel: Memory leak in the sas_smp_get_phy_events     function in drivers/scsi/libsas/sas_expander.c     (CVE-2018-7757)

  - kernel: Invalid pointer dereference in     xfs_ilock_attr_map_shared() when mounting crafted xfs     image allowing denial of service (CVE-2018-10322)

  - kernel: use-after-free detected in ext4_xattr_set_entry     with a crafted file (CVE-2018-10879)

  - kernel: out-of-bound access in ext4_get_group_info()     when mounting and operating a crafted ext4 image     (CVE-2018-10881)

  - kernel: stack-out-of-bounds write in     jbd2_journal_dirty_metadata function (CVE-2018-10883)

  - kernel: incorrect memory bounds check in     drivers/cdrom/cdrom.c (CVE-2018-10940)

ID	名稱	產品	系列	已發布	已更新	嚴重性
117988	openSUSE Security Update : the Linux Kernel (openSUSE-2018-1140)	Nessus	SuSE Local Security Checks	2018/10/9	2024/7/31	high
131701	Juniper Junos Space < 19.2R1 Multiple Vulnerabilities (JSA10951)	Nessus	Junos Local Security Checks	2019/12/4	2024/4/5	critical
117629	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:2776-1)	Nessus	SuSE Local Security Checks	2018/9/21	2024/8/6	high
117862	Debian DSA-4308-1 : linux - security update	Nessus	Debian Local Security Checks	2018/10/2	2024/8/1	high
117801	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2860-1)	Nessus	SuSE Local Security Checks	2018/9/27	2022/2/22	high
127222	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0044)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2026/1/9	high
130373	RHEL 7 : kernel-alt (RHSA-2019:3217)	Nessus	Red Hat Local Security Checks	2019/10/30	2024/11/6	high
118525	RHEL 7 : kernel (RHSA-2018:3083)	Nessus	Red Hat Local Security Checks	2018/10/31	2025/3/16	high
122460	Oracle Linux 6 : kernel (ELSA-2019-0415)	Nessus	Oracle Linux Local Security Checks	2019/2/27	2026/2/9	high
122467	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20190226)	Nessus	Scientific Linux Local Security Checks	2019/2/27	2024/6/18	high
123432	RHEL 6 : kernel-rt (RHSA-2019:0641)	Nessus	Red Hat Local Security Checks	2019/3/28	2024/11/6	high
119566	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0286)	Nessus	OracleVM Local Security Checks	2018/12/11	2024/7/16	high
119535	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4300)	Nessus	Oracle Linux Local Security Checks	2018/12/10	2026/2/9	high
131375	RHEL 7 : kernel (RHSA-2019:3967)	Nessus	Red Hat Local Security Checks	2019/11/27	2024/11/7	high
127312	NewStart CGSL MAIN 4.06 : kernel Multiple Vulnerabilities (NS-SA-2019-0092)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2022/12/6	high
119187	Scientific Linux Security Update : kernel on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	2018/11/27	2024/7/18	high

偵測

搜尋 Plugin

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high