This update for the Linux Kernel 4.4.121-92_125 fixes several issues.

The following security issues were fixed :

CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).

CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).

CVE-2019-9458: Fixed a use-after-free in media/v4l (bsc#1173963).

CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).

CVE-2019-19447: Fixed a use-after-free in ext4_put_super (bsc#1173869).

CVE-2019-14901: Fixed a heap overflow in the Marvell WiFi driver (bsc#1173661).

CVE-2019-14895: Fixed a heap-based buffer overflow in the Marvell WiFi driver (bsc#1173100).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 4.4.180-94_116 fixes several issues.

The following security issues were fixed :

CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).

CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).

CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).

CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).

CVE-2020-14356: Fixed a NULL pointer dereference in cgroupv2 subsystem which could have led to privilege escalation (bsc#1175213).

CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).

CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).

CVE-2020-24394: Fixed an issue which could set incorrect permissions on new filesystem objects when the filesystem lacks ACL support (bsc#1175518).

CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP2 kernel was updated to to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).

CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).

CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).

CVE-2019-16746: Fixed an improper check of the length of variable elements in a beacon head, leading to a buffer overflow (bsc#1152107).

CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).

CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).

CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).

CVE-2019-16746: Fixed an improper check of the length of variable elements in a beacon head, leading to a buffer overflow (bsc#1152107).

CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5841 advisory.

    - sunrpc: use SVC_NET() in svcauth_gss_* functions (Vasily Averin)  [Orabug: 31351996]  {CVE-2018-16884}
    - sunrpc: use-after-free in svc_process_common() (Vasily Averin)  [Orabug: 31351996]  {CVE-2018-16884}
    - af_packet: set defaule value for tmo (Mao Wenan)  [Orabug: 31439108]  {CVE-2019-20812}
    - vgacon: Fix for missing check in scrollback handling (Yunhai Zhang)  [Orabug: 31705122]     {CVE-2020-14331} {CVE-2020-14331}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 15 SP1 realtime kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).

CVE-2020-14356: Fixed a NULL pointer dereference in cgroupv2 subsystem which could have led to privilege escalation (bsc#1175213).

CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).

CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).

CVE-2020-24394: Fixed an issue which could set incorrect permissions on new filesystem objects when the filesystem lacks ACL support (bsc#1175518).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4286 advisory.

    - [net] Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel (Gopal Tiwari) [1888256     1888258] {CVE-2020-12351}
    - [net] Bluetooth: A2MP: Fix not initializing all members (Gopal Tiwari) [1888906 1888807]     {CVE-2020-12352}
    - [video] vgacon: Fix for missing check in scrollback handling (Lyude Paul) [1859471 1859472]     {CVE-2020-14331}
    - [fs] xfs: fix boundary test in xfs_attr_shortform_verify (Eric Sandeen) [1881085 1875316]     {CVE-2020-14385}
    - [net] packet: fix overflow in tpacket_rcv (Hangbin Liu) [1876223 1876224] {CVE-2020-14386}
    - [net] packet: make tp_drops atomic (Hangbin Liu) [1876223 1876224] {CVE-2020-14386}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5026 advisory.

  - An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and     netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.
    (CVE-2019-20811)

  - A flaw was found in the Linux kernel's implementation of the invert video code on VGA consoles when a     local attacker attempts to resize the console, calling an ioctl VT_RESIZE, which causes an out-of-bounds     write to occur. This flaw allows a local user with access to the VGA console to crash the system,     potentially escalating their privileges on the system. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2020-14331)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).

CVE-2020-14314: Fixed a potential negative array index in do_split() (bsc#1173798).

CVE-2020-14356: Fixed a NULL pointer dereference in cgroupv2 subsystem which could have led to privilege escalation (bsc#1175213).

CVE-2020-14331: Fixed a missing check in vgacon scrollback handling (bsc#1174205).

CVE-2020-16166: Fixed a potential issue which could have allowed remote attackers to make observations that help to obtain sensitive information about the internal state of the network RNG (bsc#1174757).

CVE-2020-24394: Fixed an issue which could set incorrect permissions on new filesystem objects when the filesystem lacks ACL support (bsc#1175518).

CVE-2020-10135: Legacy pairing and secure-connections pairing authentication Bluetooth might have allowed an unauthenticated user to complete authentication without pairing credentials via adjacent access (bsc#1171988).

CVE-2020-14386: Fixed a potential local privilege escalation via memory corruption (bsc#1176069).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 4.4.121-92_120 fixes several issues.

The following security issues were fixed :

CVE-2020-14331: Fixed a buffer over-write in vgacon_scroll (bsc#1174247).

CVE-2019-0155: Fixed a privilege escalation in the i915 graphics driver (bsc#1173663).

CVE-2019-16746: Fixed a buffer overflow in net/wireless/nl80211.c (bsc#1173659).

CVE-2019-9458: Fixed a use-after-free in media/v4l (bsc#1173963).

CVE-2020-11668: Fixed a memory corruption issue in the Xirlink camera USB driver (bsc#1173942).

CVE-2019-19447: Fixed a use-after-free in ext4_put_super (bsc#1173869).

CVE-2019-18680: Fixed a NULL pointer dereference in rds_tcp_kill_sock() in net/rds/tcp.c (bsc#1173867).

CVE-2019-14816: Fixed a heap-based buffer overflow in the Marvell WiFi driver (bsc#1173666).

CVE-2019-14814: Fixed a heap-based buffer overflow in the Marvell WiFi driver (bsc#1173664).

CVE-2019-14815: Fixed a heap-based buffer overflow in the Marvell WiFi driver (bsc#1173665).

CVE-2019-14901: Fixed a heap overflow in the Marvell WiFi driver (bsc#1173661).

CVE-2019-14895: Fixed a heap-based buffer overflow in the Marvell WiFi driver (bsc#1173100).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of AOS installed on the remote host is prior to 5.19.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.1 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons     could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be     usable for denial-of-service attacks). (CVE-2018-20843)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
140380	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:2492-1)	Nessus	SuSE Local Security Checks	9/8/2020	2/21/2024	critical
140383	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:2499-1)	Nessus	SuSE Local Security Checks	9/8/2020	2/21/2024	critical
140449	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:2574-1)	Nessus	SuSE Local Security Checks	9/9/2020	2/21/2024	high
140476	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:2576-1)	Nessus	SuSE Local Security Checks	9/10/2020	2/21/2024	critical
140480	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:2582-1)	Nessus	SuSE Local Security Checks	9/10/2020	2/21/2024	critical
140496	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5841)	Nessus	Oracle Linux Local Security Checks	9/11/2020	10/22/2024	high
143833	SUSE SLES15 Security Update : kernel (SUSE-SU-2020:2631-1)	Nessus	SuSE Local Security Checks	12/9/2020	2/5/2024	high
141777	Oracle Linux 8 : kernel (ELSA-2020-4286)	Nessus	Oracle Linux Local Security Checks	10/21/2020	11/1/2024	high
208502	CentOS 7 : kernel-rt (RHSA-2020:5026)	Nessus	CentOS Local Security Checks	10/9/2024	10/9/2024	medium
143840	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:2623-1)	Nessus	SuSE Local Security Checks	12/9/2020	2/5/2024	high
140365	openSUSE Security Update : the Linux Kernel (openSUSE-2020-1325) (Spectre)	Nessus	SuSE Local Security Checks	9/8/2020	2/21/2024	high
140379	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:2491-1)	Nessus	SuSE Local Security Checks	9/8/2020	2/21/2024	critical
164584	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.1)	Nessus	Misc.	9/1/2022	2/17/2025	medium

Detections

Analytics

Plugins Search

critical

critical

high

critical

critical

high

high

high

medium

high

high

critical

medium