SUSE SLED12: Mesa / Mesa-32bit / Mesa-KHR-devel / Mesa-devel / Mesa-dri / etc (SUSE-SU-2024:3526-1)

The remote SUSE Linux SLED12 / SLEDSAP12 / SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3526-1 advisory. - CVE-2023-45919: Fixed buffer over-read in glXQueryServerString bsc1222041. - CVE-2023-45913: Fixed NULL...

SUSE SLES15 Security Update : openssl-3 (SUSE-SU-2024:3525-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3525-1 advisory. - CVE-2024-41996: Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used,...

AlmaLinux 9 : linux-firmware (ALSA-2024:7484)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:7484 advisory. kernel: hw:amd:IOMMU improperly handles certain special address leading to a loss of guest integrity CVE-2023-20584 kernel: hw: amd:Incomplete system memo...

Oracle Linux 7 : e2fsprogs (ELSA-2024-12704)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-12704 advisory. 1.45.4-3.0.7 - libext2fs: add sanity check to extent manipulation Srivathsa Dara Orabug: 37095032 CVE-2022-1304 Tenable has extracted the preceding description...

SUSE SLED15: MozillaFirefox / MozillaFirefox-branding-upstream / etc (SUSE-SU-2024:3519-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3519-1 advisory. Update to Firefox Extended Support Release 128.3.0 ESR MFSA-2024-47, bsc1230979: - CVE-2024-8900...

Amazon Linux AMI : kernel (ALAS-2024-1947)

The version of kernel installed on the remote host is prior to 4.14.352-190.568. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1947 advisory. In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name...

SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2024:3518-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3518-1 advisory. Update to Firefox Extended Support Release 128.3.0 ESR MFSA-2024-47, bsc1230979: - CVE-2024-8900: Clipboard write permission bypass...

AIM Detection

An AIM Python library is installed on the remote host. Note that Nessus has relied upon on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. include'xcompat.inc'; if description scriptid208127; scriptversion"1.5";...

Ubuntu 24.04 LTS : unzip vulnerability (USN-7054-1)

The remote Ubuntu 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-7054-1 advisory. It was discovered that unzip did not properly handle unicode strings under certain circumstances. If a user were tricked into opening a specially crafted zip file...

Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-7021-4)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7021-4 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in...

Amazon Linux 2 : c-ares (ALAS-2024-2646)

The version of c-ares installed on the remote host is prior to 1.19.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2646 advisory. Insufficient randomness in generation of DNS query IDs When /dev/urandom or RtlGenRandom are unavailable, c-ares uses rand to...

Amazon Linux 2023 : cups-filters, cups-filters-devel, cups-filters-libs (ALAS2023-2024-718)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-718 advisory. A flaw in cups-filters allows a remote unauthenticated client to create a PPD configuration file with code injection. If a job is sent to the compromised printer, the code is executed allowing for remot...

Amazon Linux 2 : python-pillow (ALAS-2024-2648)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2648 advisory. Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c. CVE-2020-10177 Tenable has...

Amazon Linux 2 : amazon-ssm-agent (ALAS-2024-2645)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.859.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2645 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive...

Amazon Linux 2 : xerces-j2 (ALAS-2024-2649)

The version of xerces-j2 installed on the remote host is prior to 2.11.0-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2649 advisory. Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service CPU consumption via a crafted...

Amazon Linux 2 : python-setuptools (ALAS-2024-2641)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2641 advisory. A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from...

Amazon Linux 2 : golang (ALAS-2024-2643)

The version of golang installed on the remote host is prior to 1.22.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2643 advisory. Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack...

Amazon Linux 2 : python-dns (ALAS-2024-2647)

The version of python-dns installed on the remote host is prior to 1.12.0-4.20150617git465785f. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2647 advisory. eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS nam...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2024-717)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-717 advisory. Denial-of-service due to unbounded pattern matching CVE-2024-31228 Lua library commands may be exploited by an authenticated user to achieve remote-code-execution CVE-2024-31449 Tenable has...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASECS-2024-043)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.9.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2024-043 advisory. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses,...