SUSE SLED15: fwupd / fwupd-devel / fwupd-lang / fwupdtpmevlog / libfwupd2 / etc (SUSE-SU-2023:1999-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:1999-1 advisory. - rebuild the package with the new secure boot key bsc1209188. Tenable has extracted the preceding...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2023-161)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-161 advisory. By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS...

SUSE: Security Advisory (SUSE-SU-2023:1926-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15: dpdk / dpdk-devel / dpdk-doc / dpdk-examples / dpdk-kmp-default / etc (SUSE-SU-2023:1759-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:1759-1 advisory. - rebuild the package with the new secure boot key bsc1209188. Tenable has extracted the preceding description block directly...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-152)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-152 advisory. ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via packet injection or crafted capture file CVE-2023-1161 Tenable has extracted the...

Amazon Linux 2023 : yasm, yasm-devel (ALAS2023-2023-157)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-157 advisory. An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasmexprgetintnum in libyasm/expr.c. CVE-2021-33454 An issue was discovered in yasm version 1.3.0. There is...

SUSE SLES12 Security Update : sudo (SUSE-SU-2023:1659-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1659-1 advisory. This update for sudo fixes the following issue: Security fixes: - CVE-2023-28486: Fixed missing control characters escaping in log...

SUSE: Security Advisory (SUSE-SU-2023:0579-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux 2023 : autotrace, autotrace-devel (ALAS2023-2023-144)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-144 advisory. AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660. CVE-2022-32323 Tenable has extracted the preceding description block directly from the tested...

SUSE SLES15: dpdk / dpdk-devel / dpdk-kmp-default / dpdk-thunderx / etc (SUSE-SU-2023:0841-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0841-1 advisory. - rebuild the package with the new secure boot key bsc1209188. Tenable has extracted the preceding description block directly from the SUSE...

Amazon Linux AMI : xorg-x11-server (ALAS-2023-1702)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1702 advisory. A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo and ProcXkbGetDeviceInfo to read and write into freed...

Amazon Linux 2023 : libXpm, libXpm-devel (ALAS2023-2023-107)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-107 advisory. A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Deni...

Amazon Linux 2023 : tpm2-tss, tpm2-tss-devel (ALAS2023-2023-110)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-110 advisory. tpm2-tss is an open source software implementation of the Trusted Computing Group TCG Trusted Platform Module TPM 2 Software Stack TSS2. In affected versions Tss2RCSetHandler and Tss2RCDecode both index...

Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2023-058)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-058 advisory. In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts function in xmlparse.c can lead to realloc misbehavior e.g., allocating too few bytes, or only freeing...

Amazon Linux 2023 : bash, bash-devel (ALAS2023-2023-091)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-091 advisory. A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parametertransform. This issue may lead to memory problems. CVE-2022-3715 Tenable has extracted the preceding...

Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2023-124)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-124 advisory. firefox-esr , thunderbird and nss only are affected by this package. CVE-2023-0767 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that...

Amazon Linux 2023 : xmlsec1, xmlsec1-devel, xmlsec1-openssl (ALAS2023-2023-097)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-097 advisory. An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, several integer counters can overflow. This results in ...

Amazon Linux 2023 : bind, bind-chroot, bind-devel (ALAS2023-2023-010)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-010 advisory. A cache poisoning vulnerability was found in BIND when using forwarders. Bogus NS records supplied by the forwarders may be cached and used by name if it needs to recurse for any reason. This...

Amazon Linux 2023 : xz, xz-devel, xz-libs (ALAS2023-2023-042)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-042 advisory. An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's...

Amazon Linux 2023 : libinput, libinput-devel, libinput-test (ALAS2023-2023-041)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-041 advisory. A format string vulnerability was found in libinput CVE-2022-1215 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not teste...