Amazon Linux 2 : ruby (ALAS-2024-2637)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2637 advisory. A flaw was found in the way the Ruby REXML library parsed XML documents. Parsing a specially crafted XML document using...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2024-053 (ALASKERNEL-5.15-2024-053)

The version of kernel installed on the remote host is prior to 5.15.162-107.160. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-053 advisory. A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the functi...

Debian dla-3891 : libmariadb-dev - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3891 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3891-1 [email protected] https://www.debian.org/lts/security/...

Ubuntu 16.04 LTS / 18.04 LTS : Apache HTTP Server vulnerabilities (USN-6885-3)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6885-3 advisory. USN-6885-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2024-085 (ALASKERNEL-5.4-2024-085)

The version of kernel installed on the remote host is prior to 5.4.283-195.378. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-085 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: don't allow mapping the MM...

Amazon Linux 2 : python2-setuptools (ALAS-2024-2632)

The version of python2-setuptools installed on the remote host is prior to 41.2.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2632 advisory. A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code execution vi...

Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2024-4560)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4560 advisory. - CVE-2024-21131 Improve-UTF8-String-supports - CVE-2024-21138 Better-symbol-storage - CVE-2024-21140 Improved-loop-handling - CVE-2024-21144...

FreeBSD : SnappyMail -- multiple mXSS in HTML sanitizer (bd940aba-7467-11ef-a5c4-08002784c58d)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bd940aba-7467-11ef-a5c4-08002784c58d advisory. Oskar reports: SnappyMail uses the cleanHtml function to cleanup HTML and CSS in emails. Research...

openSUSE 15 Security Update : chromium (openSUSE-SU-2024:0302-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0302-1 advisory. Chromium 128.0.6613.137 released 2024-09-10 boo1230391 CVE-2024-8636: Heap buffer overflow in Skia CVE-2024-8637: Use after free in Media Router...

Ubuntu 24.04 LTS : xmltok library vulnerabilities (USN-7001-2)

The remote Ubuntu 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7001-2 advisory. USN-7001-1 fixed vulnerabilities in xmltol library. This update provides the corresponding updates for Ubuntu 24.04 LTS. Tenable has extracted the...

Oracle Linux 8 : pcs (ELSA-2024-6670)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-6670 advisory. 0.10.18-2.0.1.el810.2 - Replace HAM-logo.png with a generic one 0.10.18-2.el810.2 - Updated rubygem rexml Resolves: RHEL-52409, RHEL-52788, RHEL-55997...

Amazon Linux AMI : microcode_ctl (ALAS-2024-1946)

The version of microcodectl installed on the remote host is prior to 2.1-47.43. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1946 advisory. Improper isolation in some IntelR Processors stream cache mechanism may allow an authenticated user to potentially enable...

Ubuntu 20.04 LTS : Quagga vulnerability (USN-7017-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7017-1 advisory. Iggy Frankovic discovered that Quagga incorrectly handled certain BGP messages. A remote attacker could possibly use this issue to cause Quagga to crash, resultin...

RHEL 8 : thunderbird (RHSA-2024:6721)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:6721 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: 115.15/128.2 mozilla: Type confusion when lookin...

openSUSE 15 Security Update : htmldoc (openSUSE-SU-2024:0304-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2024:0304-1 advisory. - CVE-2024-45508: Fixed an out-of-bounds write in parseparagraph in ps-pdf.cxx because of an attempt to strip leading whitespace from a whitespace-only...

AlmaLinux 8 : pcs (ALSA-2024:6670)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:6670 advisory. rexml: rubygem-rexml: DoS when parsing an XML having many specific characters such as whitespace character, and CVE-2024-41123 rexml: DoS vulnerability in...

Ubuntu 16.04 LTS / 18.04 LTS : ClamAV vulnerabilities (USN-7011-2)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7011-2 advisory. USN-7011-1 fixed several vulnerabilities in ClamAV. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS...

openSUSE 15 Security Update : htmldoc (openSUSE-SU-2024:0303-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2024:0303-1 advisory. - CVE-2024-45508: Fixed an out-of-bounds write in parseparagraph in ps-pdf.cxx because of an attempt to strip leading whitespace from a whitespace-only...

Tenable Nessus Agent Multiple Vulnerabilities (TNS-2024-14)

Tenable Nessus Agent is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tenable:nessusagent";...

Google Fixes GCP Composer Flaw That Could've Led to Remote Code Execution

A now-patched critical security flaw impacting Google Cloud Platform GCP Composer could have been exploited to achieve remote code execution on cloud servers by means of a supply chain attack technique called dependency confusion. The vulnerability has been codenamed CloudImposer by Tenable...