Fedora 37 : gh / golang-github-cenkalti-backoff / golang-github-cli-crypto / etc (2023-cb20f08a4e)

The remote Fedora 37 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-cb20f08a4e advisory. Update gh to 2.27.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for thi...

Amazon Linux 2 : golang, --advisory ALAS2-2023-2015 (ALAS-2023-2015)

The version of golang installed on the remote host is prior to 1.18.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2015 advisory. Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparseable...

Amazon Linux 2 : jasper (ALAS-2023-2018)

The version of jasper installed on the remote host is prior to 1.900.1-33. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2018 advisory. A flaw was found in the Jasper tool's jpc encoder. This flaw allows an attacker to craft input provided to Jasper, causi...

Amazon Linux 2 : liblouis (ALAS-2023-2013)

The version of liblouis installed on the remote host is prior to 2.6.2-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2013 advisory. Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the...

Amazon Linux 2 : ImageMagick (ALAS-2023-2014)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2014 advisory. A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation...

Amazon Linux 2 : pki-core (ALAS-2023-2016)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2016 advisory. Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending...

Important: liblouis

Issue Overview: Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the loulogFile function at logginc.c endpoint. CVE-2023-26767 Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of...

Important: jasper

Issue Overview: A flaw was found in the Jasper tool's jpc encoder. This flaw allows an attacker to craft input provided to Jasper, causing an arbitrary out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. CVE-2020-27828 ...

USN-6033-1: Linux kernel (OEM) vulnerabilities

It was discovered that the Traffic-Control Index TCINDEX implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for this CVE, kernel support for the...

Position ownership could be transferred to zero address

Lines of code Vulnerability details Impact Ownership of a Position could be transferred to zero address. This is usually caused by mistake but the consequence is loss of collateral. Proof of Concept The position owner calls transferOwnership but accidentally set newOwner address to 0x0. Tools Use...

Advisory ROSA-SA-2023-2155

Software: modhttp2 1.15.7 OS: ROSA Virtualization 2.1 packageevrstring: 1.15.7 CVE-ID: CVE-2020-11993 BDU-ID: 2021-00779 CVE-Crit: MEDIUM CVE-DESC: A vulnerability in the Apache HTTP Server's implementation of the HTTP/2 web server mechanism is related to inconsistent interpretation of http...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2023-030)

The version of kernel installed on the remote host is prior to 5.10.29-27.126. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.10-2023-030 advisory. An issue was discovered in fs/iouring.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial o...

Ubuntu 18.04 LTS / 20.04 LTS : Firefox regressions (USN-6010-2)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6010-2 advisory. USN-6010-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. We apologize for the...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-016 (ALASKERNEL-5.15-2023-016)

The version of kernel installed on the remote host is prior to 5.15.106-64.140. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-016 advisory. A flaw was found in the Linux kernel Traffic Control TC subsystem. Using a specific networking...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2023-029 (ALASKERNEL-5.10-2023-029)

The version of kernel installed on the remote host is prior to 5.10.177-158.645. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2023-029 advisory. A use-after-free vulnerability was found in nfs42sscopen in fs/nfs/nfs4file.c in the Linux kernel. This...

Security Bulletin: Golang Go vulnerability

Summary Golang Go is vulnerable to a denial of service Vulnerability Details CVEID:CVE-2022-41717 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw when handling HTTP/2 requests in the Go server. By sending a specially-crafted keys, a remote attacker could exploit this...

MAL-2023-1238 Malicious code in mm-docs-v-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e164ce9b5bafc633c26d087af362bfe0ae909af588fc1b193b9c79f3b956c030 The OpenSSF Package Analysis project identified 'mm-docs-v-2' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in mm-docs-v-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e164ce9b5bafc633c26d087af362bfe0ae909af588fc1b193b9c79f3b956c030 The OpenSSF Package Analysis project identified 'mm-docs-v-2' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2023-28984 Junos OS: QFX Series: The PFE may crash when a lot of MAC addresses are being learned and aged

A Use After Free vulnerability in the Layer 2 Address Learning Manager l2alm of Juniper Networks Junos OS on QFX Series allows an adjacent attacker to cause the Packet Forwarding Engine to crash and restart, leading to a Denial of Service DoS. The PFE may crash when a lot of MAC learning and agin...

Important: kernel-livepatch-5.10.173-154.642

Issue Overview: dotlsgetsockopt in net/tls/tlsmain.c in the Linux kernel through 6.2.6 lacks a locksock call, leading to a race condition with a resultant use-after-free or NULL pointer dereference. CVE-2023-28466 Affected Packages: kernel-livepatch-5.10.173-154.642 Issue Correction: Please ensur...