New openssl packages are available for Slackware 14.2 and -current to fix security issues.

The version of Oracle Tuxedo installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities:
  - An information disclosure vulnerability exists in OpenSSL     due to the potential for a side-channel timing attack.     An unauthenticated attacker can exploit this to disclose     potentially sensitive information.     (CVE-2018-0734, CVE-2018-0735, CVE-2018-5407)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ovmf packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable     escalation of privilege and/or denial of service via network access. (CVE-2019-0160)

  - Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially     enable an escalation of privilege via local access. (CVE-2017-5731)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA     pool that was not assigned to any issues during 2017. Notes: none (CVE-2017-5732, CVE-2017-5733,     CVE-2017-5735)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn     by its CNA. Notes: none (CVE-2017-5734)

  - Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of     service or elevation of privilege via local access. (CVE-2018-12181)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ovmf packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable     escalation of privilege and/or denial of service via network access. (CVE-2019-0160)

  - Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user to potentially     enable an escalation of privilege via local access. (CVE-2017-5731)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA     pool that was not assigned to any issues during 2017. Notes: none (CVE-2017-5732, CVE-2017-5733,     CVE-2017-5735)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn     by its CNA. Notes: none (CVE-2017-5734)

  - Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of     service or elevation of privilege via local access. (CVE-2018-12181)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for nodejs4 fixes the following issues :

Security issues fixed :

  - CVE-2018-0734: Fixed a timing vulnerability in the DSA     signature generation (bsc#1113652)

  - CVE-2018-5407: Fixed a hyperthread port content side     channel attack (aka 'PortSmash') (bsc#1113534)

  - CVE-2018-12120: Fixed that the debugger listens on any     interface by default (bsc#1117625)

  - CVE-2018-12121: Fixed a denial of Service with large     HTTP headers (bsc#1117626)

  - CVE-2018-12122: Fixed the 'Slowloris' HTTP Denial of     Service (bsc#1117627)

  - CVE-2018-12116: Fixed HTTP request splitting     (bsc#1117630)

  - CVE-2018-12123: Fixed hostname spoofing in URL parser     for JavaScript protocol (bsc#1117629)

This update was imported from the SUSE:SLE-12:Update update project.

According to its self-reported version number, the Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) installation running on the remote web server is 8.4 prior to 8.4.15.10, 15.x prior to 15.2.18.4, 16.x prior to 16.2.17.2, 17.x prior to 17.12.12.0, or 18.x prior to 18.8.8.0. It is, therefore, affected by multiple vulnerabilities:

  - A deserialization vulnerability in Apache Commons     FileUpload allows for remote code execution.
    (CVE-2016-1000031)

  - A denial of service vulnerability in the bundled     third-party component OpenSSL library's DSA signature     algorithm that renders it vulnerable to a timing side     channel attack. An attacker could leverage this     vulnerability to recover the private key.
    (CVE-2018-0734)

  - A deserialization vulnerability in jackson-databind, a     fast and powerful JSON library for Java, allows an     unauthenticated user to perform code execution. The     issue was resolved by extending the blacklist and     blocking more classes from polymorphic deserialization.
    (CVE-2018-19362)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for openssl fixes the following issues :

CVE-2018-0732: Reject excessively large primes in DH key generation (bsc#1097158)

CVE-2018-0734: Timing vulnerability in DSA signature generation (bsc#1113652)

CVE-2018-0737: Cache timing vulnerability in RSA Key Generation (bsc#1089039)

CVE-2018-5407: Elliptic curve scalar multiplication timing attack defenses (fixes 'PortSmash') (bsc#1113534)

CVE-2019-1559: Fix 0-byte record padding oracle via SSL_shutdown (bsc#1127080)

Fix One&Done side-channel attack on RSA (bsc#1104789)

Reject invalid EC point coordinates (bsc#1131291)

The 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS Implementations (bsc#1117951)

Add missing error string to CVE-2016-8610 fix (bsc#1110018#c9)

blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592)

Non security fixes: correct the error detection in the fips patch (bsc#1106197)

Add openssl(cli) Provide so the packages that require the openssl binary can require this instead of the new openssl meta package (bsc#1101470)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in Enterprise Manager Base Platform component:

  - A deserialization vulnerability in Apache Commons     FileUpload allows for remote code execution.
    (CVE-2016-1000031)

  - An information disclosure vulnerability exists in OpenSSL     due to the potential for a side-channel timing attack.
    An unauthenticated attacker can exploit this to disclose     potentially sensitive information. (CVE-2018-0734)

  - A denial of service (DoS) vulnerability exists in Apache     HTTP Server 2.4.17 to 2.4.34, due to a design error. An     unauthenticated, remote attacker can exploit this issue     by sending continuous, large SETTINGS frames to cause a     client to occupy a connection, server thread and CPU     time without any connection timeout coming to effect.
    This affects only HTTP/2 connections. A possible     mitigation is to not enable the h2 protocol.
    (CVE-2018-11763).

  - Networking component of Enterprise Manager Base Platform     (Spring Framework) is easily exploited and may allow an     unauthenticated, remote attacker to takeover the     Enterprise Manager Base Platform. (CVE-2018-1258)

ID	名稱	產品	系列	已發布	已更新	嚴重性
119113	Slackware 14.0 / 14.1 / 14.2 / current : openssl (SSA:2018-325-01)	Nessus	Slackware Local Security Checks	2018/11/23	2024/7/19	medium
124171	Oracle Tuxedo Multiple Vulnerabilities (Apr 2019 CPU)	Nessus	Misc.	2019/4/19	2024/5/31	medium
131425	NewStart CGSL CORE 5.04 / MAIN 5.04 : ovmf Multiple Vulnerabilities (NS-SA-2019-0218)	Nessus	NewStart CGSL Local Security Checks	2019/12/2	2025/8/29	critical
132479	NewStart CGSL CORE 5.05 / MAIN 5.05 : ovmf Multiple Vulnerabilities (NS-SA-2019-0239)	Nessus	NewStart CGSL Local Security Checks	2019/12/31	2025/8/29	critical
154459	NewStart CGSL CORE 5.05 / MAIN 5.05 : ovmf Multiple Vulnerabilities (NS-SA-2021-0180)	Nessus	NewStart CGSL Local Security Checks	2021/10/27	2025/8/29	critical
121415	openSUSE Security Update : nodejs4 (openSUSE-2019-88)	Nessus	SuSE Local Security Checks	2019/1/28	2024/6/25	high
124169	Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) Multiple Vulnerabilities (Apr 2019 CPU)	Nessus	CGI abuses	2019/4/19	2024/5/31	critical
126046	SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)	Nessus	SuSE Local Security Checks	2019/6/19	2022/12/5	medium
125147	Oracle Enterprise Manager Ops Center (Apr 2019 CPU)	Nessus	Misc.	2019/5/15	2023/4/25	critical

偵測

搜尋 Plugin

medium

medium

critical

critical

critical

high

critical

medium

critical