The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2594 advisory.

    - Security fix for CVE-2015-7981 and CVE-2015-8126

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

new upstream release 1.5.25 (#1288265) ---- Security fix CVE-2015-8126 (#1281756, #1282902) ---- new upstream release 1.5.24 (#1281632)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

java-1_7_0-openjdk was updated to version 7u95 to fix 9 security issues. (bsc#962743)

  - CVE-2015-4871: Rebinding of the receiver of a     DirectMethodHandle may allow a protected method to be     accessed

  - CVE-2015-7575: Further reduce use of MD5 (SLOTH)     (bsc#960996)

  - CVE-2015-8126: Vulnerability in the AWT component     related to splashscreen displays

  - CVE-2015-8472: Vulnerability in the AWT component,     addressed by same fix

  - CVE-2016-0402: Vulnerability in the Networking component     related to URL processing

  - CVE-2016-0448: Vulnerability in the JMX comonent related     to attribute processing

  - CVE-2016-0466: Vulnerability in the JAXP component,     related to limits

  - CVE-2016-0483: Vulnerability in the AWT component     related to image decoding

  - CVE-2016-0494: Vulnerability in 2D component related to     font actions

The following bugs were fixed :

  - bsc#939523: java-1_7_0-openjdk-headless had X     dependencies, move libjavagtk to full package

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The fix for CVE-8126 was incomplete in the previous 1.0.64 update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libpng packages that fix one security issue are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libpng packages contain a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

It was discovered that the png_get_PLTE() and png_set_PLTE() functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer overflow or out-of-bounds reads. An attacker could exploit this to cause a crash or potentially execute arbitrary code by tricking an unsuspecting user into processing a specially crafted PNG image. However, the exact impact is dependent on the application using the library. (CVE-2015-8126, CVE-2015-8472)

All libpng users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

It was discovered that the png_get_PLTE() and png_set_PLTE() functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer overflow or out-of-bounds reads. An attacker could exploit this to cause a crash or potentially execute arbitrary code by tricking an unsuspecting user into processing a specially crafted PNG image. However, the exact impact is dependent on the application using the library. (CVE-2015-7981)

An array-indexing error was discovered in the png_convert_to_rfc1123() function of libpng. An attacker could possibly use this flaw to cause an out-of-bounds read by tricking an unsuspecting user into processing a specially crafted PNG image. (CVE-2015-8472)

Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in breakouts of the Java sandbox, information disclosure, denial of service and insecure cryptography.

CVE-2015-7575   A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake.

CVE-2015-8126   Multiple buffer overflows in the (1) png_set_PLTE and (2)   png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x   before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before   1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause   a denial of service (application crash) or possibly have   unspecified other impact via a small bit-depth value in an IHDR   (aka image header) chunk in a PNG image.

CVE-2015-8472   Buffer overflow in the png_set_PLTE function in libpng before   1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before   1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows   remote attackers to cause a denial of service (application   crash) or possibly have unspecified other impact via a small   bit-depth value in an IHDR (aka image header) chunk in a PNG   image. NOTE: this vulnerability exists because of an incomplete   fix for CVE-2015-8126.

CVE-2016-0402   Unspecified vulnerability in the Java SE and Java SE Embedded   components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE   Embedded 8u65 allows remote attackers to affect integrity via   unknown vectors related to Networking.

CVE-2016-0448   Unspecified vulnerability in the Java SE and Java SE Embedded   components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE   Embedded 8u65 allows remote authenticated users to affect   confidentiality via vectors related to JMX.

CVE-2016-0466   It was discovered that the JAXP component in OpenJDK did not properly enforce the totalEntitySizeLimit limit. An attacker able to make a Java application process a specially crafted XML file could use this flaw to make the application consume an excessive amount of memory.

CVE-2016-0483   Unspecified vulnerability in the Java SE, Java SE Embedded, and   JRockit components in Oracle Java SE 6u105, 7u91, and 8u66;   Java SE Embedded 8u65; and JRockit R28.3.8 allows remote   attackers to affect confidentiality, integrity, and   availability via vectors related to AWT.

CVE-2016-0494   Unspecified vulnerability in the Java SE and Java SE Embedded   components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE   Embedded 8u65 allows remote attackers to affect     confidentiality, integrity, and availability via   unknown vectors related to 2D.

For Debian 6 'Squeeze', these problems have been fixed in version 6b38-1.13.10-1~deb6u1.

We recommend that you upgrade your openjdk-6 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_0-ibm fixes the following issues by updating to 7.0-9.30 (bsc#963937) :

  - CVE-2015-5041: Could could have invoked non-public     interface methods under certain circumstances

  - CVE-2015-7575: The TLS protocol could allow weaker than     expected security caused by a collision attack when     using the MD5 hash function for signing a     ServerKeyExchange message during a TLS handshake. An     attacker could exploit this vulnerability using     man-in-the-middle techniques to impersonate a TLS server     and obtain credentials

  - CVE-2015-7981: libpng could allow a remote attacker to     obtain sensitive information, caused by an out-of-bounds     read in the png_convert_to_rfc1123 function. An attacker     could exploit this vulnerability to obtain sensitive     information

  - CVE-2015-8126: buffer overflow in libpng caused by     improper bounds checking by the png_set_PLTE() and     png_get_PLTE() functions

  - CVE-2015-8472: buffer overflow in libpng caused by     improper bounds checking by the png_set_PLTE() and     png_get_PLTE() functions

  - CVE-2015-8540: libpng is vulnerable to a buffer     overflow, caused by a read underflow in     png_check_keyword in pngwutil.c. By sending an overly     long argument, a remote attacker could overflow a buffer     and execute arbitrary code on the system or cause the     application to crash.

  - CVE-2016-0402: An unspecified vulnerability related to     the Networking component has no confidentiality impact,     partial integrity impact, and no availability impact

  - CVE-2016-0448: An unspecified vulnerability related to     the JMX component could allow a remote attacker to     obtain sensitive information

  - CVE-2016-0466: An unspecified vulnerability related to     the JAXP component could allow a remote attacker to     cause a denial of service

  - CVE-2016-0483: An unspecified vulnerability related to     the AWT component has complete confidentiality impact,     complete integrity impact, and complete availability     impact

  - CVE-2016-0494: An unspecified vulnerability related to     the 2D component has complete confidentiality impact,     complete integrity impact, and complete availability     impact

The following bugs were fixed :

  - bsc#960402: resolve package conflicts in devel package

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.4 and is affected by multiple vulnerabilities in the following components :

 - apache_mod_php
 - AppleRAID
 - AppleUSBNetworking
 - Bluetooth
 - Carbon
 - dyld
 - FontParser
 - HTTPProtocol
 - Intel Graphics Driver
 - IOFireWireFamily
 - IOGraphics
 - IOHIDFamily
 - IOUSBFamily
 - Kernel
 - libxml2
 - Messages
 - NVIDIA Graphics Drivers
 - OpenSSH
 - OpenSSL
 - Python
 - QuickTime
 - Reminders
 - Ruby
 - Security
 - Tcl
 - TrueTypeScaler
 - Wi-Fi

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running VLC 2.x prior to 2.0.2 and is affected by multiple vulnerabilities :

 - An invalid pointer dereference flaw exists in the 3GP file format parser. With a specially crafted 3GP file, a context-dependent attacker can potentially execute arbitrary code.
 - The libpng library used by VLC contains an out-of-bounds read flaw in the 'png_convert_to_rfc1123()' function in 'png.c' that may allow a context-dependent attacker to crash an application linked against the library or disclose memory contents.
 - The libEBML library used by VLC contains a use-after-free error in the 'EblMaster::Read()' function in 'EbmlMaster.cpp' that is triggered when handling deeply nested elements with an infinite size. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 - The libEBML library used by VLC contains an out-of-bounds read condition in the 'UTFstring::UpdateFromUTF8()' function in 'EbmlUnicodeString.cpp' that is triggered when reading UTF-8 strings. This may allow a context-dependent attacker to crash an application linked against the library or potentially disclose memory contents.
 - The libpng library contains overflow conditions in the 'png_set_PLTE()' function in 'pngset.c' and 'png_get_PLTE()' function in 'pngget.c' that are triggered when handling bit depths less than 8. With a specially crafted PNG image, a context-dependent attacker can cause a buffer overflow, crashing an application linked against the library or potentially execute arbtirary code.
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the web interface does not validate files' title metadata before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
 - A flaw exists that is triggered as user-supplied input is not properly validated when handling a specially crafted MP4 file. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code.
 - An unspecified double-free flaw exists in the ADPCM decoder, which may allow an attacker to have an unspecified impact.
 - Multiple unspecified double-frees, integer overflows, infinite loops, read overflows, invalid frees, and division-by-zero flaws exist. No further details have been provided by the vendor.
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the HTTP interface does not validate input before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
 - An off-by-one overflow condition exists in the RealRtsp module. The issue is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to cause a buffer overflow, resulting in an unspecified impact.

ID	Name	Product	Family	Published	Updated	Severity
87300	Oracle Linux 6 : libpng (ELSA-2015-2594)	Nessus	Oracle Linux Local Security Checks	12/10/2015	10/23/2024	high
89405	Fedora 23 : libpng15-1.5.25-1.fc23 (2015-c80ec85542)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	high
88485	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2016:0265-1) (SLOTH)	Nessus	SuSE Local Security Checks	1/29/2016	1/6/2021	high
89203	Fedora 22 : libpng10-1.0.65-1.fc22 (2015-3461e976cb)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	high
87307	RHEL 7 : libpng (RHSA-2015:2596)	Nessus	Red Hat Local Security Checks	12/10/2015	10/24/2019	high
87341	Amazon Linux AMI : libpng (ALAS-2015-615)	Nessus	Amazon Linux Local Security Checks	12/15/2015	4/18/2018	high
88580	Debian DLA-410-1 : openjdk-6 security update (SLOTH)	Nessus	Debian Local Security Checks	2/5/2016	1/11/2021	high
89317	Fedora 23 : libpng10-1.0.65-1.fc23 (2015-8c475f7169)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	high
89657	SUSE SLES11 Security Update : java-1_7_0-ibm (SUSE-SU-2016:0636-1) (SLOTH)	Nessus	SuSE Local Security Checks	3/4/2016	1/19/2021	critical
9327	Mac OS X 10.11.x < 10.11.4 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	5/27/2016	3/6/2019	critical
9267	VLC Media Player < 2.2.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	4/22/2016	3/6/2019	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

critical

critical

critical