The remote Windows host is missing security update 4034672 or cumulative update 4034681. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists when Microsoft     Windows improperly handles NetBIOS packets. An attacker     who successfully exploited this vulnerability could     cause a target computer to become completely     unresponsive. A remote unauthenticated attacker could     exploit this vulnerability by sending a series of TCP     packets to a target system, resulting in a permanent     denial of service condition. The update addresses the     vulnerability by correcting how the Windows network     stack handles NetBIOS traffic. (CVE-2017-0174)

  - A buffer overflow vulnerability exists in the Microsoft     JET Database Engine that could allow remote code     execution on an affected system. An attacker who     successfully exploited this vulnerability could take     complete control of an affected system. An attacker     could then install programs; view, change, or delete     data; or create new accounts with full user rights.
    (CVE-2017-0250)

  - A remote code execution vulnerability exists when     Microsoft Windows PDF Library improperly handles objects     in memory. The vulnerability could corrupt memory in a     way that enables an attacker to execute arbitrary code     in the context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user. (CVE-2017-0293)

  - A remote code execution vulnerability exists in Windows     Input Method Editor (IME) when IME improperly handles     parameters in a method of a DCOM class. The DCOM server     is a Windows component installed regardless of which     languages/IMEs are enabled. An attacker can instantiate     the DCOM class and exploit the system even if IME is not     enabled. (CVE-2017-8591)

  - An elevation of privilege vulnerability exists in     Windows when the Win32k component fails to properly     handle objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights. (CVE-2017-8593)

  - A remote code execution vulnerability exists when     Windows Search handles objects in memory. An attacker     who successfully exploited this vulnerability could take     control of the affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights.To exploit the     vulnerability, the attacker could send specially crafted     messages to the Windows Search service. An attacker with     access to a target computer could exploit this     vulnerability to elevate privileges and take control of     the computer. Additionally, in an enterprise scenario, a     remote unauthenticated attacker could remotely trigger     the vulnerability through an SMB connection and then     take control of a target computer.The security update     addresses the vulnerability by correcting how Windows     Search handles objects in memory. (CVE-2017-8620)

  - An elevation of privilege vulnerability exists when the     Windows Common Log File System (CLFS) driver improperly     handles objects in memory. (CLFS) is a high-performance,     general-purpose log file subsystem that dedicated client     applications can use and multiple clients can share to     optimize log access. (CVE-2017-8624)

  - This security update resolves a vulnerability in Windows     Error Reporting (WER). The vulnerability could allow     elevation of privilege if successfully exploited by an     attacker. An attacker who successfully exploited this     vulnerability could gain greater access to sensitive     information and system functionality. This update     corrects the way the WER handles and executes files.
    (CVE-2017-8633)

  - A remote code execution vulnerability exists in the way     JavaScript engines render when handling objects in     memory in Microsoft browsers. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user. (CVE-2017-8635)

  - A remote code execution vulnerability exists in the way     that Microsoft browser JavaScript engines render content     when handling objects in memory. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. (CVE-2017-8636)

  - A remote code execution vulnerability exists in the way     JavaScript engines render when handling objects in     memory in Microsoft browsers. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user. (CVE-2017-8641)

  - A remote code execution vulnerability exists when     Microsoft browsers improperly access objects in memory.
    The vulnerability could corrupt memory in such a way     that enables an attacker to execute arbitrary code in     the context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user. (CVE-2017-8653)

  - A remote code execution vulnerability exists when     Windows Hyper-V on a host server fails to properly     validate input from an authenticated user on a guest     operating system. (CVE-2017-8664)

  - An information disclosure vulnerability exists when the     win32k component improperly provides kernel information.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system. (CVE-2017-8666)

  - An information disclosure vulnerability exists when the     Volume Manager Extension Driver component improperly     provides kernel information. An attacker who     successfully exploited the vulnerability could obtain     information to further compromise the users system.To     exploit this vulnerability, an attacker would have to     log on to an affected system and run a specially crafted     application.The security update addresses the     vulnerability by correcting how Volume Manager Extension     Driver handles objects in memory. (CVE-2017-8668)

  - A remote code execution vulnerability exists in the way     Microsoft browsers handle objects in memory while     rendering content. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user. If     the current user is logged on with administrative user     rights, an attacker who successfully exploited the     vulnerability could take control of an affected system.
    An attacker could then install programs; view, change,     or delete data; or create new accounts with full user     rights. (CVE-2017-8669)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4110 advisory.

    - media: imon: Fix null-ptr-deref in imon_probe (Arvind Yadav)  [Orabug: 27208383]  {CVE-2017-16537}
    - Input: gtco - fix potential out-of-bound access (Dmitry Torokhov)  [Orabug: 27215095]  {CVE-2017-16643}
    - usb: usbtest: fix NULL pointer dereference (Alan Stern)  [Orabug: 27602321]  {CVE-2017-16532}
    - netfilter: ebtables: CONFIG_COMPAT: dont trust userland offsets (Florian Westphal)  [Orabug: 27774010]     {CVE-2018-1068}
    - ext4: add validity checks for bitmap block numbers (Theodore Tso)  [Orabug: 27854370]  {CVE-2018-1093}     {CVE-2018-1093}
    - USB: core: prevent malicious bNumInterfaces overflow (Alan Stern)  [Orabug: 27898064]  {CVE-2017-17558}
    - RDS: Heap OOB write in rds_message_alloc_sgs() (Mohamed Ghannam)  [Orabug: 27934081]  {CVE-2018-5332}
    - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen)  [Orabug: 27989490]     {CVE-2018-10323}
    - x86/entry/64: Dont use IST entry for #BP stack (Andy Lutomirski)   {CVE-2018-8897}
    - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds)  [Orabug: 27947612]     {CVE-2018-100199}
    - ALSA: usb-audio: Kill stray URB at exiting (Takashi Iwai)  [Orabug: 27148283]  {CVE-2017-16527}
    - uwb: properly check kthread_run return value (Andrey Konovalov)  [Orabug: 27206900]  {CVE-2017-16526}
    - HID: usbhid: fix out-of-bounds bug (Jaejoong Kim)  [Orabug: 27207935]  {CVE-2017-16533}
    - cx231xx-cards: fix NULL-deref on missing association descriptor (Johan Hovold)  [Orabug: 27208080]     {CVE-2017-16536}
    - net: cdc_ether: fix divide by 0 on bad descriptors (Bjorn Mork)  [Orabug: 27215206]  {CVE-2017-16649}
    - Bluetooth: bnep: bnep_add_connection() should verify that its dealing with l2cap socket (Al Viro)     [Orabug: 27344787]  {CVE-2017-15868}
    - Bluetooth: hidp: verify l2cap sockets (David Herrmann)  [Orabug: 27344787]  {CVE-2017-15868}
    - ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser)  [Orabug: 27344840]  {CVE-2017-0861}     {CVE-2017-0861}
    - x86/cpufeature: Add X86_FEATURE_IA32_ARCH_CAPS and X86_FEATURE_IBRS_ATT (David Woodhouse)  [Orabug:
    27649498]  {CVE-2017-5715}
    - x86/cpufeatures: Clean up Spectre v2 related CPUID flags (David Woodhouse)  [Orabug: 27649510]     {CVE-2017-5715}
    - x86/spectre: Now that we expose 'stbibp' make sure it is correct. (Konrad Rzeszutek Wilk)  [Orabug:
    27649631]  {CVE-2017-5715}
    - x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support (KarimAllah Ahmed)     [Orabug: 27649640]  {CVE-2017-5715}
    - x86: Add STIBP feature enumeration (David Woodhouse)  [Orabug: 27649693]  {CVE-2017-5715}
    - x86/cpu/AMD: Add speculative control support for AMD (Tom Lendacky)  [Orabug: 27649706]  {CVE-2017-5715}
    - x86/spectre_v2: Dont spam the console with these: (Konrad Rzeszutek Wilk)  [Orabug: 27649723]     {CVE-2017-5715}
    - x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (David Woodhouse)  [Orabug:
    27516441]  {CVE-2017-5715}
    - KEYS: Remove key_type::match in favour of overriding default by match_preparse (Tim Tianyang Chen)     [Orabug: 25757946]  {CVE-2017-6951}
    - tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Wei Wang)  [Orabug: 26813391]  {CVE-2017-14106}
    - rxrpc: Fix several cases where a padded len isnt checked in ticket decode (David Howells)  [Orabug:
    26880520]  {CVE-2017-7482} {CVE-2017-7482}
    - USB: serial: console: fix use-after-free after failed setup (Johan Hovold)  [Orabug: 27206839]     {CVE-2017-16525}
    - ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor (Takashi Iwai)  [Orabug:
    27206934]  {CVE-2017-16529}
    - USB: fix out-of-bounds in usb_set_configuration (Greg Kroah-Hartman)  [Orabug: 27207243]     {CVE-2017-16531}
    - dccp: CVE-2017-8824: use-after-free in DCCP code (Mohamed Ghannam)  [Orabug: 27290308]  {CVE-2017-8824}
    - x86: Use PRED_CMD MSR when ibpb is enabled (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/spec: Dont print the Missing arguments for option spectre_v2 (Konrad Rzeszutek Wilk)  [Orabug:
    27369777]  {CVE-2017-5715} {CVE-2017-5753}
    - x86: Move ENABLE_IBRS in the interrupt macro (Konrad Rzeszutek Wilk)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - Add set_ibrs_disabled and set_ibpb_disabled (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/boot: Add early cmdline parsing for options with arguments (Tom Lendacky)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86, boot: Carve out early cmdline parsing function (Borislav Petkov)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86: Fix kABI build breakage (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86: Add command-line options 'spectre_v2' and 'nospectre_v2' (Kanth Ghatraju)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86/mm: Set IBPB upon context switch (Brian Maly)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753}
    - x86: Display correct settings for the SPECTRE_V2 bug (Kanth Ghatraju)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - Set CONFIG_GENERIC_CPU_VULNERABILITIES flag (Kanth Ghatraju)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/cpu: Implement CPU vulnerabilites sysfs functions (Thomas Gleixner)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - sysfs/cpu: Fix typos in vulnerability documentation (David Woodhouse)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - sysfs/cpu: Add vulnerability folder (Thomas Gleixner)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86, cpu: Expand cpufeature facility to include cpu bugs (Borislav Petkov)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] (David Woodhouse)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/cpufeatures: Add X86_BUG_CPU_MELTDOWN (Kanth Ghatraju)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/spec: STUFF_RSB _before_ ENABLE_IBRS (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86: Move STUFF_RSB in to the idt macro (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/IBRS/IBPB: Set sysctl_ibrs/ibpb_enabled properly (Boris Ostrovsky)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86/IBRS: Make sure we restore MSR_IA32_SPEC_CTRL to a valid value (Boris Ostrovsky)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86/spec_ctrl: Add missing 'lfence' when IBRS is not supported (Konrad Rzeszutek Wilk)  [Orabug:
    27369777]  {CVE-2017-5715} {CVE-2017-5753}
    - x86/ia32: Move STUFF_RSB And ENABLE_IBRS (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (Tim Chen)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86: Use IBRS for firmware update path (David Woodhouse)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/spec_ctrl: Disable if running as Xen PV guest (Konrad Rzeszutek Wilk)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86/microcode: Recheck IBRS features on microcode reload (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/idle: Disable IBRS entering idle and enable it on wakeup (Tim Chen)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature (Tim Chen)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86/enter: Use IBRS on syscall and interrupts (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/enter: MACROS to set/clear IBRS and set IBPB (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/feature: Detect the x86 IBRS feature to control Speculation (Tim Chen)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86: fix build breakage (Brian Maly)  [Orabug: 27346425]  {CVE-2017-5753}
    - kaiser: rename X86_FEATURE_KAISER to X86_FEATURE_PTI to match upstream (Mike Kravetz)   {CVE-2017-5754}
    - x86/kaiser: Check boottime cmdline params (Mike Kravetz)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling (Borislav Petkov)  [Orabug: 27333761]     {CVE-2017-5754}
    - KPTI: Report when enabled (Mike Kravetz)  [Orabug: 27333761]  {CVE-2017-5754}
    - PTI: unbreak EFI old_memmap (Jiri Kosina)  [Orabug: 27333761] [Orabug: 27333760]  {CVE-2017-5754}
    - kaiser: Set _PAGE_NX only if supported (Guenter Roeck)  [Orabug: 27333761] [Orabug: 27333760]     {CVE-2017-5754}
    - KPTI: Rename to PAGE_TABLE_ISOLATION (Kees Cook)  [Orabug: 27333761]  {CVE-2017-5754}
    - kaiser: kaiser_flush_tlb_on_return_to_user() check PCID (Hugh Dickins)  [Orabug: 27333761]     {CVE-2017-5754}
    - kaiser: asm/tlbflush.h handle noPGE at lower level (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754}
    - kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush (Hugh Dickins)  [Orabug: 27333761]     {CVE-2017-5754}
    - x86/alternatives: add asm ALTERNATIVE macro (Mike Kravetz)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/kaiser: Reenable PARAVIRT, dynamically disable KAISER if PARAVIRT (Borislav Petkov)  [Orabug:
    27333761]  {CVE-2017-5754}
    - kaiser: add 'nokaiser' boot option, using ALTERNATIVE (Hugh Dickins)  [Orabug: 27333761]     {CVE-2017-5754}
    - x86-32: Fix boot with CONFIG_X86_INVD_BUG (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - kaiser: alloc_ldt_struct() use get_zeroed_page() (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754}
    - kaiser: user_map __kprobes_text too (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm/kaiser: re-enable vsyscalls (Andrea Arcangeli)  [Orabug: 27333761]  {CVE-2017-5754}
    - KAISER: Kernel Address Isolation (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm: fix bad backport to disable PCID on Xen (Borislav Petkov)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm/64: Fix reboot interaction with CR4.PCIDE (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm: Enable CR4.PCIDE on supported systems (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm: Add the 'nopcid' boot option to turn off PCID (Andy Lutomirski)  [Orabug: 27333761]     {CVE-2017-5754}
    - x86/mm: Disable PCID on 32-bit kernels (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code (Andy Lutomirski)     [Orabug: 27333761]  {CVE-2017-5754}
    - sched/core: Idle_task_exit() shouldnt use switch_mm_irqs_off() (Andy Lutomirski)  [Orabug: 27333761]     {CVE-2017-5754}
    - x86/mm, sched/core: Turn off IRQs in switch_mm() (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm, sched/core: Uninline switch_mm() (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm: Build arch/x86/mm/tlb.c even on !SMP (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - sched/core: Add switch_mm_irqs_off() and use it in the scheduler (Andy Lutomirski)  [Orabug: 27333761]     {CVE-2017-5754}
    - mm/mmu_context, sched/core: Fix mmu_context.h assumption (Ingo Molnar)  [Orabug: 27333761]     {CVE-2017-5754}
    - x86/mm: If INVPCID is available, use it to flush global mappings (Andy Lutomirski)  [Orabug: 27333761]     {CVE-2017-5754}
    - x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID (Andy Lutomirski)  [Orabug: 27333761]     {CVE-2017-5754}
    - x86/mm: Fix INVPCID asm constraint (Borislav Petkov)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm: Add INVPCID helpers (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86, cpufeature: Add CPU features from Intel document 319433-012A (H. Peter Anvin)  [Orabug: 27333761]     {CVE-2017-5754}
    - x86/paravirt: Dont patch flush_tlb_single (Thomas Gleixner)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86-64: Map the HPET NX (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/ldt: Make modify_ldt synchronous (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}     {CVE-2015-5157}
    - x86, cpu: Add cpufeature flag for PCIDs (Arun Thomas)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm: Disable preemption during CR3 read+write (Sebastian Andrzej Siewior)  [Orabug: 27333761]     {CVE-2017-5754}
    - locking/barriers: fix compile issue (Brian Maly)  [Orabug: 27346425]  {CVE-2017-5753}
    - x86: Add another set of MSR accessor functions (Borislav Petkov)  [Orabug: 27346425]  {CVE-2017-5753}
    - udf: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753}
    - fs: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753}
    - qla2xxx: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753}
    - p54: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753}
    - carl9170: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753}
    - uvcvideo: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753}
    - locking/barriers: introduce new observable speculation barrier (Elena Reshetova)  [Orabug: 27346425]     {CVE-2017-5753}
    - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Elena Reshetova)  [Orabug: 27346425]     {CVE-2017-5753}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4109 advisory.

    - media: imon: Fix null-ptr-deref in imon_probe (Arvind Yadav)  [Orabug: 27208380]  {CVE-2017-16537}
    - Input: gtco - fix potential out-of-bound access (Dmitry Torokhov)  [Orabug: 27215090]  {CVE-2017-16643}
    - usb: usbtest: fix NULL pointer dereference (Alan Stern)  [Orabug: 27602324]  {CVE-2017-16532}
    - netfilter: ebtables: CONFIG_COMPAT: dont trust userland offsets (Florian Westphal)  [Orabug: 27774015]     {CVE-2018-1068}
    - ext4: add validity checks for bitmap block numbers (Theodore Tso)  [Orabug: 27854376]  {CVE-2018-1093}     {CVE-2018-1093}
    - USB: core: prevent malicious bNumInterfaces overflow (Alan Stern)  [Orabug: 27898074]  {CVE-2017-17558}
    - netfilter: nfnetlink_cthelper: Add missing permission checks (Kevin Cernekee)  [Orabug: 27898167]     {CVE-2017-17448}
    - KEYS: dont let add_key() update an uninstantiated key (David Howells)  [Orabug: 27913332]     {CVE-2017-15299}
    - RDS: Heap OOB write in rds_message_alloc_sgs() (Mohamed Ghannam)  [Orabug: 27934073]  {CVE-2018-5332}
    - x86/entry/64: Dont use IST entry for #BP stack (Andy Lutomirski)   {CVE-2018-8897}
    - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds)  [Orabug: 27947608]     {CVE-2018-100199}
    - ALSA: usb-audio: Kill stray URB at exiting (Takashi Iwai)  [Orabug: 27148281]  {CVE-2017-16527}
    - HID: usbhid: fix out-of-bounds bug (Jaejoong Kim)  [Orabug: 27207929]  {CVE-2017-16533}
    - [media] cx231xx-cards: fix NULL-deref on missing association descriptor (Johan Hovold)  [Orabug:
    27208072]  {CVE-2017-16536}
    - net: cdc_ether: fix divide by 0 on bad descriptors (Bjorn Mork)  [Orabug: 27215201]  {CVE-2017-16649}
    - Bluetooth: bnep: bnep_add_connection() should verify that its dealing with l2cap socket (Al Viro)     [Orabug: 27344793]  {CVE-2017-15868}
    - Bluetooth: hidp: verify l2cap sockets (David Herrmann)  [Orabug: 27344793]  {CVE-2017-15868}
    - ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser)  [Orabug: 27344843]  {CVE-2017-0861}     {CVE-2017-0861}
    - ptrace: use fsuid, fsgid, effective creds for fs access checks (Jann Horn)  [Orabug: 27364691]     {CVE-2017-14140}
    - sctp: do not peel off an assoc from one netns to another one (Xin Long)  [Orabug: 27387001]     {CVE-2017-15115}
    - Revert 'x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2 mitigation' (Ankur Arora)     [Orabug: 27601787]  {CVE-2017-5715}
    - Revert 'x86/spec: Add 'lfence_enabled' in sysfs' (Ankur Arora)  [Orabug: 27601787]  {CVE-2017-5715}
    - Revert 'x86/mitigation/spectre_v2: Add reporting of 'lfence'' (Ankur Arora)  [Orabug: 27601787]     {CVE-2017-5715}
    - x86/mitigation/spectre_v2: Add reporting of 'lfence' (Konrad Rzeszutek Wilk)   {CVE-2017-5715}
    - x86/spec: Add 'lfence_enabled' in sysfs (Konrad Rzeszutek Wilk)   {CVE-2017-5715}
    - x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2 mitigation (Konrad Rzeszutek Wilk)     {CVE-2017-5715}
    - x86/spectre: bring spec_ctrl management logic closer to UEK4 (Ankur Arora)  [Orabug: 27516512]     {CVE-2017-5715}
    - x86/cpufeatures: Clean up Spectre v2 related CPUID flags (David Woodhouse)  [Orabug: 27516357]     {CVE-2017-5715}
    - x86/spectre_v2: Remove 0xc2 from spectre_bad_microcodes (Darren Kenny)  [Orabug: 27516419]     {CVE-2017-5715}
    - x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (David Woodhouse)  [Orabug:
    27516419]  {CVE-2017-5715}
    - x86/spectre: expose 'stibp' (Konrad Rzeszutek Wilk)  [Orabug: 27516419]  {CVE-2017-5715}
    - x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support (David Woodhouse)  [Orabug:
    27516379]  {CVE-2017-5715}
    - x86/speculation: Use Indirect Branch Prediction Barrier in context switch (Tim Chen)  [Orabug: 27516379]     {CVE-2017-5715}
    - x86/spectre: fix spectre_v1 mitigation indicators (Ankur Arora)  [Orabug: 27509932]  {CVE-2017-5715}
    - x86/ia32/syscall: Clear extended registers %r8-%r15 (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715}
    - x86/ia32/syscall: Save full stack frame throughout the entry code (Ankur Arora)  [Orabug: 27452028]     {CVE-2017-5715}
    - x86/ia32/syscall: cleanup trailing whitespace (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715}
    - x86/syscall: Clear callee saved registers (%r12-%r15, %rbp, %rbx) (Ankur Arora)  [Orabug: 27452028]     {CVE-2017-5715}
    - x86/syscall: Save callee saved registers on syscall entrance (Ankur Arora)  [Orabug: 27452028]     {CVE-2017-5715}
    - gre: fix a possible skb leak (Eric Dumazet)  [Orabug: 26403972]  {CVE-2017-9074}
    - ipv6: Fix leak in ipv6_gso_segment(). (David S. Miller)  [Orabug: 26403972]  {CVE-2017-9074}
    - ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() (Ben Hutchings)  [Orabug: 26403972]     {CVE-2017-9074}
    - ipv6: Check ip6_find_1stfragopt() return value properly. (David S. Miller)  [Orabug: 26403972]     {CVE-2017-9074}
    - ipv6: Prevent overrun when parsing v6 header options (Craig Gallek)  [Orabug: 26403972]  {CVE-2017-9074}
    - tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Wei Wang)  [Orabug: 26813390]  {CVE-2017-14106}
    - rxrpc: Fix several cases where a padded len isnt checked in ticket decode (David Howells)  [Orabug:
    26880517]  {CVE-2017-7482} {CVE-2017-7482}
    - USB: serial: console: fix use-after-free after failed setup (Johan Hovold)  [Orabug: 27206837]     {CVE-2017-16525}
    - uwb: properly check kthread_run return value (Andrey Konovalov)  [Orabug: 27206897]  {CVE-2017-16526}
    - ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor (Takashi Iwai)  [Orabug:
    27206928]  {CVE-2017-16529}
    - USB: fix out-of-bounds in usb_set_configuration (Greg Kroah-Hartman)  [Orabug: 27207240]     {CVE-2017-16531}
    - USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor() (Alan Stern)  [Orabug: 27207983]     {CVE-2017-16535}
    - dccp: CVE-2017-8824: use-after-free in DCCP code (Mohamed Ghannam)  [Orabug: 27290301]  {CVE-2017-8824}
    - x86: Add another set of MSR accessor functions (Borislav Petkov)  [Orabug: 27444923]  {CVE-2017-5753}
    - userns: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753}
    - udf: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753}
    - fs: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753}
    - qla2xxx: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753}
    - p54: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753}
    - carl9170: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753}
    - uvcvideo: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753}
    - locking/barriers: introduce new observable speculation barrier (Elena Reshetova)  [Orabug: 27444923]     {CVE-2017-5753}
    - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Elena Reshetova)  [Orabug: 27444923]     {CVE-2017-5753}
    - x86/cpu/AMD: Make the LFENCE instruction serialized (Elena Reshetova)  [Orabug: 27444923]     {CVE-2017-5753}
    - x86/rsb: add comment specifying why we skip STUFF_RSB (Ankur Arora)  [Orabug: 27451658]  {CVE-2017-5715}
    - x86/rsb: make STUFF_RSB jmp labels more robust (Ankur Arora)  [Orabug: 27451658]  {CVE-2017-5715}
    - x86/spec: Also print IBRS if IBPB is disabled. (Konrad Rzeszutek Wilk)   {CVE-2017-5715}
    - x86/spectre: Drop the warning about ibrs being obsolete. (Konrad Rzeszutek Wilk)   {CVE-2017-5715}
    - Add set_ibrs_disabled and set_ibpb_disabled (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715}
    - x86/spec: Dont print the Missing arguments for option spectre_v2 (Konrad Rzeszutek Wilk)  [Orabug:
    27376697]  {CVE-2017-5715}
    - x86/boot: Add early cmdline parsing for options with arguments (Tom Lendacky)  [Orabug: 27376697]     {CVE-2017-5715}
    - x86: Add command-line options 'spectre_v2' and 'nospectre_v2' (Kanth Ghatraju)  [Orabug: 27376697]     {CVE-2017-5715}
    - x86: Fix kABI build breakage (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715}
    - x86/mm: Only set IBPB when the new thread cannot ptrace current thread (Konrad Rzeszutek Wilk)  [Orabug:
    27376697]  {CVE-2017-5715}
    - x86: Use PRED_CMD MSR when ibpb is enabled (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715}
    - x86/mm: Set IBPB upon context switch (Brian Maly)  [Orabug: 27376697]  {CVE-2017-5715}
    - x86: Display correct settings for the SPECTRE_V[12] bug (Kanth Ghatraju)  [Orabug: 27376697]     {CVE-2017-5715} {CVE-2017-5753}
    - x86/cpu: Implement CPU vulnerabilites sysfs functions (Thomas Gleixner)  [Orabug: 27376697]     {CVE-2017-5715} {CVE-2017-5753}
    - x86/IBRS/IBPB: Set sysctl_ibrs/ibpb_enabled properly (Boris Ostrovsky)  [Orabug: 27376697]     {CVE-2017-5715}
    - x86/spec_ctrl: Disable if running as Xen PV guest (Konrad Rzeszutek Wilk)  [Orabug: 27376697]     {CVE-2017-5715}
    - sysfs/cpu: Add vulnerability folder (Thomas Gleixner)  [Orabug: 27376697]  {CVE-2017-5715}     {CVE-2017-5754}
    - x86, cpu: Expand cpufeature facility to include cpu bugs (Borislav Petkov)  [Orabug: 27376697]     {CVE-2017-5715}
    - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5715}
    - x86/cpufeatures: Add X86_BUG_CPU_MELTDOWN (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5754}
    - x86/entry: STUFF_RSB only after switching to kernel CR3 (Ankur Arora)  [Orabug: 27376697]     {CVE-2017-5715}
    - x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (Tim Chen)  [Orabug: 27376697]     {CVE-2017-5715}
    - x86/IBRS: Make sure we restore MSR_IA32_SPEC_CTRL to a valid value (Boris Ostrovsky)  [Orabug: 27376697]     {CVE-2017-5715}
    - x86: Use IBRS for firmware update path (David Woodhouse)  [Orabug: 27376697]  {CVE-2017-5715}
    - x86/microcode: Recheck IBRS features on microcode reload (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715}
    - x86/idle: Disable IBRS entering idle and enable it on wakeup (Tim Chen)  [Orabug: 27376697]     {CVE-2017-5715}
    - x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature (Tim Chen)  [Orabug: 27376697]     {CVE-2017-5715}
    - x86/enter: Use IBRS on syscall and interrupts (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715}
    - x86/enter: MACROS to set/clear IBRS (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715}
    - x86/feature: Detect the x86 IBRS feature to control Speculation (Tim Chen)  [Orabug: 27376697]     {CVE-2017-5715}
    - x86/pti/efi: broken conversion from efi to kernel page table (Pavel Tatashin)  [Orabug: 27333764]     {CVE-2017-5754}
    - PTI: unbreak EFI old_memmap (Jiri Kosina)  [Orabug: 27333764] [Orabug: 27333760]  {CVE-2017-5754}     {CVE-2017-5754}
    - kaiser: Set _PAGE_NX only if supported (Lepton Wu)  [Orabug: 27333764]  {CVE-2017-5754}
    - kaiser: rename X86_FEATURE_KAISER to X86_FEATURE_PTI (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754}
    - KPTI: Rename to PAGE_TABLE_ISOLATION (Kees Cook)  [Orabug: 27333764]  {CVE-2017-5754}
    - x86/kaiser: Check boottime cmdline params (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754}
    - kaiser: x86: Fix NMI handling (Jiri Kosina)  [Orabug: 27333764]  {CVE-2017-5754}
    - kaiser: move paravirt clock vsyscall mapping out of kaiser_init (Mike Kravetz)  [Orabug: 27333764]     {CVE-2017-5754}
    - kaiser: disable if xen PARAVIRT (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754}
    - x86/kaiser: Reenable PARAVIRT (Borislav Petkov)  [Orabug: 27333764]  {CVE-2017-5754}
    - kaiser: kaiser_flush_tlb_on_return_to_user() check PCID (Hugh Dickins)  [Orabug: 27333764]     {CVE-2017-5754}
    - kaiser: asm/tlbflush.h handle noPGE at lower level (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754}
    - kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush (Hugh Dickins)  [Orabug: 27333764]     {CVE-2017-5754}
    - x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling (Borislav Petkov)  [Orabug: 27333764]     {CVE-2017-5754}
    - kaiser: add 'nokaiser' boot option, using ALTERNATIVE (Hugh Dickins)  [Orabug: 27333764]     {CVE-2017-5754}
    - x86/alternatives: add asm ALTERNATIVE macro (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754}
    - kaiser: alloc_ldt_struct() use get_zeroed_page() (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754}
    - x86: kvmclock: Disable use from vDSO if KPTI is enabled (Ben Hutchings)  [Orabug: 27333764]     {CVE-2017-5754}
    - kaiser: Fix build with CONFIG_FUNCTION_GRAPH_TRACER (Kees Cook)  [Orabug: 27333764]  {CVE-2017-5754}
    - x86/mm/kaiser: re-enable vsyscalls (Andrea Arcangeli)  [Orabug: 27333764]  {CVE-2017-5754}
    - KAISER: Kernel Address Isolation (Richard Fellner)  [Orabug: 27333764]  {CVE-2017-5754}
    - kprobes: Prohibit probing on .entry.text code (Masami Hiramatsu)  [Orabug: 27333764]  {CVE-2017-5754}
    - x86/mm/64: Fix reboot interaction with CR4.PCIDE (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754}
    - x86/mm: Enable CR4.PCIDE on supported systems (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754}
    - x86/mm: Add the 'nopcid' boot option to turn off PCID (Andy Lutomirski)  [Orabug: 27333764]     {CVE-2017-5754}
    - x86/mm: Disable PCID on 32-bit kernels (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754}
    - x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code (Andy Lutomirski)     [Orabug: 27333764]  {CVE-2017-5754}
    - x86/mm: Fix flush_tlb_page() on Xen (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754}
    - x86/mm: Disable preemption during CR3 read+write (Sebastian Andrzej Siewior)  [Orabug: 27333764]     {CVE-2017-5754}
    - sched/core: Idle_task_exit() shouldnt use switch_mm_irqs_off() (Andy Lutomirski)  [Orabug: 27333764]     {CVE-2017-5754}
    - x86/mm, sched/core: Turn off IRQs in switch_mm() (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754}
    - x86/mm, sched/core: Uninline switch_mm() (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754}
    - x86/mm: Build arch/x86/mm/tlb.c even on !SMP (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754}
    - sched/core: Add switch_mm_irqs_off() and use it in the scheduler (Andy Lutomirski)  [Orabug: 27333764]     {CVE-2017-5754}
    - mm/mmu_context, sched/core: Fix mmu_context.h assumption (Ingo Molnar)  [Orabug: 27333764]     {CVE-2017-5754}
    - x86/mm: If INVPCID is available, use it to flush global mappings (Andy Lutomirski)  [Orabug: 27333764]     {CVE-2017-5754}
    - x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID (Andy Lutomirski)  [Orabug: 27333764]     {CVE-2017-5754}
    - x86/mm: Fix INVPCID asm constraint (Borislav Petkov)  [Orabug: 27333764]  {CVE-2017-5754}
    - x86/mm: Add INVPCID helpers (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754}
    - x86: Clean up cr4 manipulation (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754}
    - x86/paravirt: Dont patch flush_tlb_single (Thomas Gleixner)  [Orabug: 27333764]  {CVE-2017-5754}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
102270	Windows 8.1 and Windows Server 2012 R2 August 2017 Security Updates	Nessus	Windows : Microsoft Bulletins	8/8/2017	2/18/2025	critical
109881	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2018-4110)	Nessus	Oracle Linux Local Security Checks	5/17/2018	11/1/2024	high
109829	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4109)	Nessus	Oracle Linux Local Security Checks	5/16/2018	10/23/2024	high

Detections

Analytics

Plugins Search

critical

high

high