Vulnerable postgresql component found in SANnav RPM package

pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either PreparedStatement.setTextint, InputStream or PreparedStatemet.setByteaint, InputStream will create a temporary file if the InputStream is larger than 2k. This will create a temporary file which...

SUSE: Security Advisory (SUSE-SU-2023:3443-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Exploit for CVE-2023-21939

JDK CVE-2023-21939 文章链接https://mp.weixin.qq.com/s?biz=M...

Code injection

An issue was discovered in function ciMethodBlocks::makeblockat in Oracle JDK HotSpot VM 11, 17 and OpenJDK HotSpot VM 8, 11, 17, allows attackers to cause a denial of service. Note: Vendor states that this to is Defense in Depth at most due to the nature of the issue and the special circumstance...

CVE-2022-40433

DISPUTED An issue was discovered in function ciMethodBlocks::makeblockat in Oracle JDK HotSpot VM 11, 17 and OpenJDK HotSpot VM 8, 11, 17, allows attackers to cause a denial of service. Note: Vendor states that this to is Defense in Depth at most due to the nature of the issue and the special...

CVE-2022-40433

CVE-2022-40433 is rejected by its CNA as not a security issue.

Fedora 37 : java-latest-openjdk-portable (2023-020d609edb)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-020d609edb advisory. Update to jdk-20.0.2+9 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2023-2189)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.382.b05-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2189 advisory. Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Jav...

Fedora 38 : java-11-openjdk-portable (2023-9a3ecf4fcf)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-9a3ecf4fcf advisory. Update to jdk-11.0.20.0+8 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

SUSE SLED15: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc (SUSE-SU-2023:3287-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3287-1 advisory. Updated to jdk-11.0.20+8 July 2023 CPU: - CVE-2023-22006: Fixed vulnerability in the network...

Fedora 38 : java-17-openjdk-portable (2023-b55ba9ed7a)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-b55ba9ed7a advisory. Update to jdk-17.0.8.0+7 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...

Rocky Linux 8 : java-1.8.0-openjdk (RLSA-2023:4176)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:4176 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE component: Hotspot. Supported...

RHEL 9 : Red Hat JBoss Enterprise Application Platform (RHSA-2023:4507)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4507 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

CLSA-2023-1691081846 java-1.8.0-openjdk: Fix of 2 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u382-b05. That fixes following CVEs: - CVE-2023-22045: Array indexing integer overflow issue. 8304468 - CVE-2023-22049: Improper handling of slash characters in URI-to-path conversion 8305312 - Remove patch for pkcs11 cause issue was fixed in...

Ubuntu 23.04 : OpenJDK 20 vulnerabilities (USN-6272-1)

The remote Ubuntu 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6272-1 advisory. Motoyasu Saburi discovered that OpenJDK 20 incorrectly handled special characters in file name parameters. An attacker could possibly use this issue to inser...

CVE-2023-26438

External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use TOCTOU weakness, involving the JDK DNS cache. Attackers that were timing DNS cache expiry correctly were able to inject configuration that would bypass existing network deny-lists. Attackers could...

Authorization

External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use TOCTOU weakness, involving the JDK DNS cache. Attackers that were timing DNS cache expiry correctly were able to inject configuration that would bypass existing network deny-lists. Attackers could...

CVE-2023-26438

CVE-2023-26438 describes a time-of-check/time-of-use (TOCTOU) weakness in external service lookups tied to the JDK DNS cache. Attackers timing DNS cache expiry could inject configurations to bypass existing network deny-lists and discover restricted infrastructure or service availability. The cor...

The vulnerability of the Utility component of the Java SE software platform and the Oracle GraalVM Enterprise Edition and Oracle GraalVM for JDK virtual machines allows attackers to cause partial service interruptions.

The vulnerability of the Utility component of the Java SE software platform and the Oracle GraalVM Enterprise Edition and Oracle GraalVM for JDK virtual machines is related to errors in processing input data. Exploiting this vulnerability can allow an attacker to cause partial service disruption...

Oracle Linux 9 : java-17-openjdk (ELSA-2023-4177)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4177 advisory. - OpenJDK: ZIP file parsing infinite loop 8302483 CVE-2023-22036 - OpenJDK: weakness in AES implementation 8308682 CVE-2023-22041 - OpenJDK: improper...