qh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.

This update for nagios to version 4.4.5 fixes the following issues :

  - CVE-2019-3698: Symbolic link following vulnerability in     the cronjob allows local attackers to cause cause DoS or     potentially escalate privileges. (boo#1156309)

  - CVE-2018-18245: Fixed XSS vulnerability in Alert Summary     report (boo#1119832)

  - CVE-2018-13441, CVE-2018-13458, CVE-2018-13457: Fixed a     few denial of service vulnerabilities caused by NULL     pointer dereference (boo#1101293, boo#1101289,     boo#1101290).

Incorporate many fixes from Justin Paulsen <petaris@gmail.com> THANKS!!!

----

Updates to nagios-4.4.2 which is a major update. Fixes CVE's CVE-2018-13441 CVE-2016-8641

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Incorporate many fixes from Justin Paulsen <petaris@gmail.com> THANKS!!!

----

Updates to nagios-4.4.2 which is a major update. Fixes CVE's CVE-2018-13441 CVE-2016-8641

----

Remove section which unset nagios Fix BZ#1568273

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
135448	openSUSE Security Update : nagios (openSUSE-2020-500)	Nessus	SuSE Local Security Checks	high
121443	Fedora 29 : nagios (2019-376ecc221c)	Nessus	Fedora Local Security Checks	high
121442	Fedora 28 : nagios (2019-0b44528ff1)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-13458

medium

Tenable Plugins

high

high

high