According to its self-reported version number, the remote Junos Space version is prior to 18.3R1. It is, therefore, affected by multiple vulnerabilities:

  - A use after free vulnerability exists in the    do_get_mempolicy function. An local attacker can exploit    this to cause a denial of service condition.
   (CVE-2018-10675)

  - A malicious authenticated user may be able to delete a     device from the Junos Space database without the     privileges through crafted Ajax interactions from     another legitimate delete action performed by an     administrative user. (CVE-2019-0016)

  - A flaw in validity checking of image files uploaded     to Junos Space could allow an attacker to upload     malicious scripts or images. (CVE-2019-0017)

Additionally, Junos Space is affected by several other vulnerabilities exist as noted in the vendor advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1646 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines     that use KVM in environments managed by Red Hat products.

    Security Fix(es):

    * An industry-wide issue was found in the way many modern microprocessor designs have implemented     speculative execution of Load & Store instructions (a commonly used performance optimization). It relies     on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact     that memory read from address to which a recent memory write has occurred may see an older value and     subsequently cause an update into the microprocessor's data cache even for speculatively executed     instructions that never actually commit (retire). As a result, an unprivileged attacker could use this     flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639)

    Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation.

    Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project     Zero) for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1643 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines     that use KVM in environments managed by Red Hat products.

    Security Fix(es):

    * An industry-wide issue was found in the way many modern microprocessor designs have implemented     speculative execution of Load & Store instructions (a commonly used performance optimization). It relies     on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact     that memory read from address to which a recent memory write has occurred may see an older value and     subsequently cause an update into the microprocessor's data cache even for speculatively executed     instructions that never actually commit (retire). As a result, an unprivileged attacker could use this     flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639)

    Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation.

    Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project     Zero) for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3247:04 advisory.

    * An industry-wide issue was found in the way many modern microprocessor designs have implemented     speculative execution of Load

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-1416 advisory.

    [1.5.3-156.el7_5.1]
    - kvm-vga-add-ram_addr_t-cast.patch [bz#1567913]
    - kvm-vga-fix-region-calculation.patch [bz#1567913]
    - Resolves: bz#1567913       (CVE-2018-7858 qemu-kvm: Qemu: cirrus: OOB access when updating vga display [rhel-7] [rhel-7.5.z])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for qemu fixes the following issues :

Security vulnerabilities addressed :

  - CVE-2019-6778: Fixed an out-of-bounds access in slirp     (bsc#1123156)

  - CVE-2018-16872: Fixed a host security vulnerability     related to handling symlinks in usb-mtp (bsc#1119493)

  - CVE-2018-19489: Fixed a Denial-of-Service in virtfs     (bsc#1117275)

  - CVE-2018-19364: Fixed an use-after-free vulnerability if     virtfs interface is deliberately abused (bsc#1116717)

  - CVE-2018-18954: Fixed an out-of-bounds access performing     PowerNV memory operations (bsc#1114957)

  - CVE-2017-13673: Fixed a reachable assert failure during     during display update (bsc#1056386)

  - CVE-2017-13672: Fixed an out-of-bounds read access     during display update (bsc#1056334)

  - CVE-2018-7858: Fixed an out-of-bounds access in cirrus     when updating vga display allowing for Denial-of-Service     (bsc#1084604)

Other bug fixes and changes :

  - Fix pwrite64/pread64/write to return 0 over -1 for a     zero length NULL buffer in qemu (bsc#1121600)

  - Fix bad guest time after migration (bsc#1113231)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
121067	Juniper Junos Space < 18.3R1 Multiple Vulnerabilities (JSA10917)	Nessus	Junos Local Security Checks	2019/1/10	2026/1/9	high
194069	RHEL 7 : qemu-kvm-rhev (RHSA-2018:1646)	Nessus	Red Hat Local Security Checks	2024/4/27	2026/1/9	high
194112	RHEL 7 : qemu-kvm-rhev (RHSA-2018:1643)	Nessus	Red Hat Local Security Checks	2024/4/27	2026/1/9	high
289221	MiracleLinux 4 : qemu-kvm-0.12.1.2-2.506.AXS4.1 (AXSA:2018-3247:04)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/2/10	medium
109811	Oracle Linux 7 : qemu-kvm (ELSA-2018-1416)	Nessus	Oracle Linux Local Security Checks	2018/5/15	2024/10/22	medium
123493	openSUSE Security Update : qemu (openSUSE-2019-1074)	Nessus	SuSE Local Security Checks	2019/3/29	2024/6/7	high

检测

插件搜索

high

high

high

medium

medium

high