Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Nova vulnerability (USN-6911-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6911-1 advisory. Arnaud Morin discovered that Nova incorrectly handled certain raw format images. An authenticated user could use this issue to access...

Amazon Linux 2 : ecs-init, --advisory ALAS2ECS-2024-039 (ALASECS-2024-039)

The version of ecs-init installed on the remote host is prior to 1.84.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-039 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of...

EulerOS 2.0 SP8 : systemd (EulerOS-SA-2024-2061)

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they ha...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-046)

The version of kernel installed on the remote host is prior to 5.15.162-107.160. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-046 advisory. 2024-08-27: CVE-2024-42096 was added to this advisory. 2024-08-27: CVE-2024-42070 was added to this...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-075)

The version of kernel installed on the remote host is prior to 5.4.278-191.377. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2024-075 advisory. In the Linux kernel, the following vulnerability has been resolved: net: fix dstnegativeadvice race CVE-2024-36971...

Fedora 40 : ghostscript (2024-053b8330a1)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-053b8330a1 advisory. Security fix for CVE-2024-33869 ---- Security fixes for CVE-2024-29509, CVE-2024-29508, CVE-2024-29507, CVE-2024-29506 Tenable has extracted the...

RHEL 8 : nghttp2 (RHSA-2024:4732)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4732 advisory. libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: CONTINUATION frames DoS...

Siemens SIMATIC and SCALANCE Products Inadequate Encryption Strength (CVE-2023-0464)

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of...

Siemens SIMATIC and SCALANCE Products Inadequate Encryption Strength (CVE-2023-0465)

Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-038)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.29.6.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2024-038 advisory. dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context du...

SUSE SLED15: git / git-arch / git-core / git-credential-libsecret / git-cvs / etc (SUSE-SU-2024:2579-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2579-1 advisory. - CVE-2024-24577: Fixed arbitrary code execution due to heap corruption in gitindexadd bsc1219660 Tenable...

Slackware Linux 15.0 mozilla-thunderbird Multiple Vulnerabilities (SSA:2024-205-03)

The version of mozilla-thunderbird installed on the remote host is prior to 115.13.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-205-03 advisory. New mozilla-thunderbird packages are available for Slackware 15.0 to fix security issues. Tenable has extract...

RHEL 9 : python3 (RHSA-2024:4779)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4779 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...

Photon OS 1.0: Apache PHSA-2016-0011

An update of the apache package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2016-0011. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid203069...

Slackware Linux 15.0 / current aaa_glibc-solibs Multiple Vulnerabilities (SSA:2024-205-02)

The version of aaaglibc-solibs installed on the remote host is prior to 2.33 / 2.40. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-205-02 advisory. New glibc packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted...

EulerOS 2.0 SP8 : ncurses (EulerOS-SA-2024-2059)

According to the versions of the ncurses packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component ncwrapentry.CVE-2023-50495 Tenable has extracted the...

Amazon Linux 2 : nano (ALAS-2024-2590)

The version of nano installed on the remote host is prior to 2.9.8-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2590 advisory. nano: running chmod and chown on the filename allows malicious user to replace the emergency file with a malicious symlink to a...

Amazon Linux 2 : libreswan (ALAS-2024-2596)

The version of libreswan installed on the remote host is prior to 3.25-4.8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2596 advisory. The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. Wh...

RHEL 8 : linux-firmware (RHSA-2024:4741)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4741 advisory. The linux-firmware packages contain all of the firmware files that are required by various devices to operate. Security Fixes: kernel: Reserved field...

Amazon Linux 2 : ghostscript (ALAS-2024-2597)

The version of ghostscript installed on the remote host is prior to 9.54.0-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2597 advisory. NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.htmlNOTE: https://cgit.ghostscript.com/cgi-...