NewStart CGSL MAIN 6.02 : webkit2gtk3 Multiple Vulnerabilities (NS-SA-2024-0053)

The remote NewStart CGSL host, running version MAIN 6.02, has webkit2gtk3 packages installed that are affected by multiple vulnerabilities: - A use-after-free issue was found in the AudioSourceProviderGStreamer class of WebKitGTK and WPE WebKit in versions prior to 2.30.5. Processing maliciously...

Vim < 9.1.0707 Buffer Overflow Vulnerability

According to its version, the version of Vim installed on the remote host is prior to 9.1.0707. It is, therefore affected by a buffer overflow vulnerability. Patch v9.1.0038 optimized how the cursor position is calculated and in doing so introduced the possibility for heap-buffer-overflow when...

FreeBSD : chromium -- multiple security fixes (15d398ea-4f73-11ef-8a0f-a8a1599412c6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 15d398ea-4f73-11ef-8a0f-a8a1599412c6 advisory. Chrome Releases reports: This update includes 3 security fixes: Tenable has extracted the...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-672)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-672 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADE...

Oracle Linux 9 : dotnet8.0 (ELSA-2024-4450)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4450 advisory. 8.0.107-1.0.1 - Add support for Oracle Linux 8.0.107-1 - Update to .NET SDK 8.0.107 and Runtime 8.0.7 - Resolves: RHEL-45324 Tenable has extracted the...

CBL Mariner 2.0 Security Update: reaper (CVE-2024-4068)

The version of reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-4068 advisory. - The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which...

Oracle Linux 9 : python3.11-cryptography (ELSA-2024-2337)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-2337 advisory. - Security fix for CVE-2023-49083 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has n...

Fedora 40 : python2.7 (2024-93fad630de)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-93fad630de advisory. Automatic update for python2.7-2.7.18-37.fc40. Changelog Fri Dec 22 2023 Lumr Balhar - 2.7.18-37 - Security fix for CVE-2023-27043 Resolves: rhbz2196186...

PyMongo < 4.6.3 Out-of-bounds Read

Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the...

Oracle Linux 8 : firefox (ELSA-2024-1484)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-1484 advisory. 115.9.1.0.1 - Add firefox-oracle-default-prefs.js and remove the corresponding OpenELA file 115.9.1 - Add debranding patches Mustafa Gezen - Add OpenEL...

CentOS 9 : dpdk-21.11.2-1.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dpdk-21.11.2-1.el9 build changelog. - A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by...

RHCOS 4 : OpenShift Container Platform 4.12.9 (RHSA-2023:1408)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:1408 advisory. - capnproto: out of bounds read when handling a list of lists. CVE-2022-46149 Note that Nessus has not tested for this issue but has instead...

Juniper Junos OS Vulnerability (JSA73157)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA73157 advisory. - An Improper Release of Memory Before Removing Last Reference vulnerability in Packet Forwarding Engine PFE of Juniper Networks Junos OS allows a local, low privileged...

CBL Mariner 2.0 Security Update: PyYAML (CVE-2020-1747)

The version of PyYAML installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-1747 advisory. - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to...

Rocky Linux 8 : cups (RLSA-2021:4393)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:4393 advisory. - An input validation issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security...

F5 Networks BIG-IP : Apache Struts vulnerabilities (K35226442)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the K35226442 advisory. - An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing...

F5 Networks BIG-IP : Intel CPU vulnerability (K04160444)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K04160444 advisory. - Out of bounds write in BIOS firmware for some IntelR Processors may allow an authenticated user to potentially enable...

Amazon Linux 2 : runc (ALASECS-2023-005)

The version of runc installed on the remote host is prior to 1.1.7-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2023-005 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional...

Ubuntu 18.04 ESM : Linux kernel vulnerabilities (USN-6329-1)

The remote Ubuntu 18.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6329-1 advisory. Daniel Moghimi discovered that some IntelR Processors did not properly clear microarchitectural state after speculative execution of various instructions...

Amazon Linux 2 : python-configobj (ALAS-2023-2188)

The version of python-configobj installed on the remote host is prior to 4.7.2-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2188 advisory. All versions of the package configobj are vulnerable to Regular Expression Denial of Service ReDoS via the validate...