Azure Linux 3.0 Security Update: kernel (CVE-2024-53171)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-53171 advisory. - In the Linux kernel, the following vulnerability has been resolved: ubifs: authentication: Fix use-after- fr...

Medium: openjpeg2

Issue Overview: openjpeg: heap buffer overflow in lib/openjp2/j2k.c CVE-2024-56827 Affected Packages: openjpeg2 Issue Correction: Run dnf update openjpeg2 --releasever 2023.6.20250303 or dnf update --advisory ALAS2023-2025-875 --releasever 2023.6.20250303 to update your system. More information o...

Important: libxml2

Issue Overview: xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. CVE-2022-49043 Affected Packages: libxml2 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories...

openSUSE Security Advisory (SUSE-SU-2024:1943-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Medium: apache-commons-compress

Issue Overview: When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package...

Google Chrome Security Update (stable-channel-update-for-desktop_18-2025-02) - Linux

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

SUSE SLES12 Security Update : python36 (SUSE-SU-2025:0434-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:0434-1 advisory. - CVE-2025-0938: domain names containing square brackets are not identified as incorrect by urlparse. bsc1236705 Tenable has extracted the preceding...

SUSE SLES15 Security Update : kernel (Live Patch 22 for SLE 15 SP4) (SUSE-SU-2025:0455-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0455-1 advisory. This update for the Linux Kernel 5.14.21-15040024103 fixes several issues. The following security issues were fixed: - CVE-2024-45016: netem: f...

Azure Linux 3.0 Security Update: avahi (CVE-2023-38469)

The version of avahi installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-38469 advisory. - A vulnerability was found in Avahi, where a reachable assertion exists in avahidnspacketappendrecord...

Azure Linux 3.0 Security Update: python-jinja2 (CVE-2024-56326)

The version of python-jinja2 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-56326 advisory. - Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed...

Azure Linux 3.0 Security Update: rust (CVE-2024-32884)

The version of rust installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-32884 advisory. - gitoxide is a pure Rust implementation of Git. gix-transport does not check the username part of a URL for tex...

Azure Linux 3.0 Security Update: kernel (CVE-2024-42082)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42082 advisory. - In the Linux kernel, the following vulnerability has been resolved: xdp: Remove WARN from xdpregmemmodel...

SUSE SLES15: tomcat10 / tomcat10-admin-webapps / tomcat10-doc / etc (SUSE-SU-2025:0033-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0033-1 advisory. Update to Tomcat 10.1.34 - Fixed CVEs: - CVE-2024-54677: DoS in examples web application bsc1234664 - CVE-2024-50379:...

python-requests security update

An update is available for python-requests. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

DLA-4008-1 linux-6.1 - security update

Bulletin has no description...

Important: ruby

Issue Overview: An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's...

Medium: python-requests

Issue Overview: Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to th...

Medium: python-idna

Issue Overview: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Affected Packages: python-idna Issue Correction: Run dnf update python-idna --releasever 2023.6.20241111 or dnf update --advisory ALAS2023-2024-763 --releasever...

Medium: python-pip

Issue Overview: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Affected Packages: python-pip Issue Correction: Run dnf update python-pip --releasever 2023.6.20241111 or dnf update --advisory ALAS2023-2024-764 --releasever...

Important: ruby3.2

Issue Overview: An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's...