This update for openssl fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641)

Security issues fixed :

  - CVE-2016-7055: The x86_64 optimized montgomery     multiplication may produce incorrect results     (bsc#1009528)

  - CVE-2017-3731: Truncated packet could crash via OOB read     (bsc#1022085)

  - CVE-2017-3732: BN_mod_exp may produce incorrect results     on x86_64 (bsc#1022086)

  - Degrade the 3DES cipher to MEDIUM in SSLv2 (bsc#1001912)

Non-security issues fixed :

  - fix crash in openssl speed (bsc#1000677)

  - fix X509_CERT_FILE path (bsc#1022271)

  - AES XTS key parts must not be identical in FIPS mode     (bsc#1019637)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for nodejs4 fixes the following issues :

  - New upstream LTS release 4.7.3 The embedded openssl     sources were updated to 1.0.2k (CVE-2017-3731,     CVE-2017-3732, CVE-2016-7055, bsc#1022085, bsc#1022086,     bsc#1009528)

  - No changes in LTS version 4.7.2

  - New upstream LTS release 4.7.1

  - build: shared library support is now working for AIX     builds

  - repl: passing options to the repl will no longer     overwrite defaults

  - timers: recanceling a cancelled timers will no longer     throw

  - New upstream LTS version 4.7.0

  - build: introduce the configure --shared option for     embedders

  - debugger: make listen address configurable in debugger     server

  - dgram: generalized send queue to handle close, fixing a     potential throw when dgram socket is closed in the     listening event handler

  - http: introduce the 451 status code 'Unavailable For Legal Reasons'

  - gtest: the test reporter now outputs tap comments as     yamlish

  - tls: introduce secureContext for tls.connect (useful for     caching client certificates, key, and CA certificates)

  - tls: fix memory leak when writing data to TLSWrap     instance during handshake

  - src: node no longer aborts when c-ares initialization     fails

  - ported and updated system CA store for the new node     crypto code

  - New upstream LTS version 4.6.2

  - build :

  + It is now possible to build the documentation from the     release tarball.

  - buffer :

  + Buffer.alloc() will no longer incorrectly return a zero     filled buffer when an encoding is passed.

  - deps :

  + Upgrade npm in LTS to 2.15.11.

  - repl :

  + Enable tab completion for global properties.

  - url :

  + url.format() will now encode all '#' in search.

  - Add missing conflicts to base package. It's not possible     to have concurrent nodejs installations.

  - enable usage of system certificate store on SLE11SP4 by     requiring openssl1 (bsc#1000036)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of MySQL running on the remote host is 5.7.x prior to 5.7.18. It is, therefore, affected by multiple vulnerabilities :

  - A carry propagation error exists in the OpenSSL     component in the Broadwell-specific Montgomery     multiplication procedure when handling input lengths     divisible by but longer than 256 bits. This can result     in transient authentication and key negotiation failures     or reproducible erroneous outcomes of public-key     operations with specially crafted input. A     man-in-the-middle attacker can possibly exploit this     issue to compromise ECDH key negotiations that utilize     Brainpool P-512 curves. (CVE-2016-7055)

  - Multiple unspecified flaws exist in the DML subcomponent     that allow an authenticated, remote attacker to cause a     denial of service condition. (CVE-2017-3308,     CVE-2017-3331, CVE-2017-3456, CVE-2017-3457,     CVE-2017-3458)

  - Multiple unspecified flaws exist in the Optimizer     subcomponent that allow an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2017-3309, CVE-2017-3453, CVE-2017-3459)

  - An unspecified flaw exists in the Thread Pooling     subcomponent that allows an unauthenticated, remote     attacker to cause a denial of service condition.
    (CVE-2017-3329)

  - An unspecified flaw exists in the Memcached subcomponent     that allows an unauthenticated, remote attacker to cause     a denial of service condition. (CVE-2017-3450)

  - An unspecified flaw exists in the InnoDB subcomponent     that allows an authenticated, remote attacker to insert     and delete data contained in the database or cause a     denial of service condition. (CVE-2017-3454)

  - An unspecified flaw exists in the 'Security: Privileges'     subcomponent that allows an authenticated, remote     attacker to insert or delete data contained in the     database or disclose sensitive information.
    (CVE-2017-3455)

  - An unspecified flaw exists in the Audit Plug-in     subcomponent that allows an authenticated, remote     attacker to cause a denial of service condition.
    (CVE-2017-3460)

  - Multiple unspecified flaws exist in the     'Security: Privileges' subcomponent that allow an     authenticated, remote attacker to cause a denial of     service condition. (CVE-2017-3461, CVE-2017-3462,     CVE-2017-3463)

  - An unspecified flaw exists in the DDL subcomponent that     allows an authenticated, remote attacker to update,     insert, or delete data contained in the database.
    (CVE-2017-3464)

  - An unspecified flaw exists in the 'Security: Privileges'     subcomponent that allows an authenticated, remote     attacker to update, insert, or delete data contained in     the database. (CVE-2017-3465)

  - An unspecified flaw exists in the C API subcomponent     that allows an unauthenticated, remote attacker to     disclose sensitive information. (CVE-2017-3467)

  - An unspecified flaw exists in the 'Security: Encryption'     subcomponent that allows an authenticated, remote     attacker to update, insert, or delete data contained in     the database. (CVE-2017-3468)

  - An unspecified flaw exists in the Pluggable Auth     subcomponent that allows an unauthenticated, remote     attacker to cause a denial of service condition.
    (CVE-2017-3599)

  - An unspecified flaw exists in the 'Client mysqldump'     subcomponent that allows an authenticated, remote     attacker to execute arbitrary code. (CVE-2017-3600)

  - An out-of-bounds read error exists in the OpenSSL     component when handling packets using the     CHACHA20/POLY1305 or RC4-MD5 ciphers. An     unauthenticated, remote attacker can exploit this, via     specially crafted truncated packets, to cause a denial     of service condition. (CVE-2017-3731)

  - A carry propagating error exists in the OpenSSL     component in the x86_64 Montgomery squaring     implementation that may cause the BN_mod_exp() function     to produce incorrect results. An unauthenticated, remote     attacker with sufficient resources can exploit this to     obtain sensitive information regarding private keys.
    (CVE-2017-3732)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the remote VMware ESXi 6.0 host is prior to build 5224529. It is, therefore, affected by multiple vulnerabilities in VMWare Tools and the bundled OpenSSL and Python packages, as well as a NULL pointer dereference vulnerability related to handling RPC requests that could allow an attacker to crash a virtual machine.

The version of Oracle Access Manager installed on the remote host is 10.1.4.3.x prior to 10.1.4.3.13 or 11.1.2.3.x prior to 11.1.2.3.180116. It is, therefore, affected by multiple vulnerabilities as noted in the October 2018 Critical Patch Update advisory:

  - A Vulnerability in the Oracle Access Manager component     of Oracle Fusion Middleware (subcomponent: Web Server     Plugin (OpenSSL)). The affected version is 10.1.4.3.0.     This is a difficult to exploit vulnerability that allows     unauthenticated attacker with network access via HTTPS     to compromise Oracle Access Manager. A successful attack     of this vulnerability may result in unauthorized access     to critical data or complete access to all Oracle Access     Manager accessible data. (CVE-2017-3732)

  - A vulnerability in the Oracle Access Manager component     of Oracle Fusion Middleware (subcomponent: Web Server     Plugin). The affected version is 11.1.2.3.0. This is a     difficult to exploit vulnerability that allows an     unauthenticated attacker with network access via HTTPS     to compromise Oracle Access Manager. A successful     attack of this vulnerability may result in unauthorized     access to critical data or complete access to all Oracle     Access Manager accessible data. (CVE-2017-10262)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
97276	openSUSE Security Update : openssl (openSUSE-2017-256)	Nessus	SuSE Local Security Checks	2017/2/21	2025/12/31	medium
119996	SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2017:0855-1)	Nessus	SuSE Local Security Checks	2019/1/2	2021/1/6	medium
99513	MySQL 5.7.x < 5.7.18 Multiple Vulnerabilities (April 2017 CPU) (July 2017 CPU)	Nessus	Databases	2017/4/20	2020/6/3	medium
102698	ESXi 6.0 < Build 5485776 Multiple Vulnerabilities (VMSA-2017-0015) (remote check)	Nessus	Misc.	2017/9/20	2025/11/20	high
124059	Oracle Access Manager Multiple Vulnerabilities (Jan 2018 CPU)	Nessus	Misc.	2019/4/15	2022/4/11	critical

检测

插件搜索

medium

medium

medium

high

critical