AlmaLinux 9 : libXpm (ALSA-2023:0383)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0383 advisory. - libXpm: compression commands depend on $PATH CVE-2022-4883 - libXpm: Runaway loop on width of 0 and enormous height CVE-2022-44617 - libXpm: Infinite lo...

AlmaLinux 9 : kernel (ALSA-2023:0334)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0334 advisory. - A race condition was found in the Linux kernel's watch queue due to a missing lock in piperesizering. The specific flaw exists within the handling of pi...

AlmaLinux 9 : kernel-rt (ALSA-2023:0300)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0300 advisory. - A race condition was found in the Linux kernel's watch queue due to a missing lock in piperesizering. The specific flaw exists within the handling of pi...

AlmaLinux 9 : java-17-openjdk (ALSA-2023:0194)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0194 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected a...

AlmaLinux 9 : expat (ALSA-2023:0337)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:0337 advisory. - In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XMLExternalEntityParserCreate in out-of-memory situations...

AlmaLinux 9 : curl (ALSA-2023:0333)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:0333 advisory. - When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option h...

AlmaLinux 9 : sqlite (ALSA-2023:0339)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:0339 advisory. - SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. CVE-2022-3573...

AlmaLinux 9 : firefox (ALSA-2023:0285)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:0285 advisory. - An out of date library libusrsctp contained vulnerabilities that could potentially be exploited. This vulnerability affects Firefox DataTransfer.setData...

AlmaLinux 9 : libtasn1 (ALSA-2023:0343)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:0343 advisory. - GNU Libtasn1 before 4.19.0 has an ETYPEOK off-by-one array size check that affects asn1encodesimpleder. CVE-2021-46848 Note that Nessus has not tested for this...

AlmaLinux 9 : libxml2 (ALSA-2023:0338)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0338 advisory. - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, several intege...

AlmaLinux 9 : dbus (ALSA-2023:0335)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0335 advisory. - An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause...

AlmaLinux 8 : firefox (ALSA-2023:0288)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:0288 advisory. - An out of date library libusrsctp contained vulnerabilities that could potentially be exploited. This vulnerability affects Firefox DataTransfer.setData...

CVE-2023-0266

A use-after-free flaw was found in sndctlelemread in sound/core/control.c in Advanced Linux Sound Architecture ALSA subsystem in the Linux kernel. In this flaw a normal privileged, local attacker may impact the system due to a locking issue in the compat path, leading to a kernel information leak...

GSD-2023-1001620 ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt

ALSA: mts64: fix possible null-ptr-defer in sndmts64interrupt This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.337 by commit...

GSD-2023-1001538 ALSA: line6: fix stack overflow in line6_midi_transmit

ALSA: line6: fix stack overflow in line6miditransmit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.337 by commit...

GSD-2023-1001275 ALSA: line6: fix stack overflow in line6_midi_transmit

ALSA: line6: fix stack overflow in line6miditransmit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001230 ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF

ALSA: pcm: Move rwsem lock inside sndctlelemread to prevent UAF This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001145 ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt

ALSA: mts64: fix possible null-ptr-defer in sndmts64interrupt This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2023-1000914 ALSA: line6: fix stack overflow in line6_midi_transmit

ALSA: line6: fix stack overflow in line6miditransmit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.87 by commit...

GSD-2023-1000859 ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF

ALSA: pcm: Move rwsem lock inside sndctlelemread to prevent UAF This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.88 by commit...