SUSE SLED15 / SLES15 / openSUSE 15 Security Update : sudo (SUSE-SU-2022:4077-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:4077-1 advisory. - CVE-2022-43995: Fixed a potential heap-based buffer over-read when entering a passwor dof seven...

MGASA-2022-0426 Updated sudo packages fix security vulnerability

Sudo 1.8.0 through 1.9.12, with the crypt password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer...

Rocky Linux 8 : zlib (RLSA-2022:7106)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:7106 advisory. - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications...

SUSE-SU-2022:4001-1 Security update for sudo

This update for sudo fixes the following issues: - CVE-2022-43995: Fixed a potential heap-based buffer over-read when entering a password of seven characters or fewer and using the crypt password backend bsc1204986...

rsync security and enhancement update

3.1.3-19 - Resolves: 2116668 - zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field 3.1.3-18 - Resolves: 2111175 - remote arbitrary files write inside the directories of connecting peers 3.1.3-17 - Related: 2043753 - New option should...

Oracle Linux 8 : rsync (ELSA-2022-7793)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-7793 advisory. 3.1.3-19 - Resolves: 2116668 - zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field 3.1.3-18 -...

NewStart CGSL MAIN 6.02 : jasper Multiple Vulnerabilities (NS-SA-2022-0083)

The remote NewStart CGSL host, running version MAIN 6.02, has jasper packages installed that are affected by multiple vulnerabilities: - There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write...

NewStart CGSL MAIN 6.02 : binutils Multiple Vulnerabilities (NS-SA-2022-0087)

The remote NewStart CGSL host, running version MAIN 6.02, has binutils packages installed that are affected by multiple vulnerabilities: - An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control...

SUSE SLES15 Security Update : sudo (SUSE-SU-2022:3938-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3938-1 advisory. - CVE-2022-43995: Fixed a potential heap-based buffer over-read when entering a password of seven characters or fewer and using the crypt...

Oracle Linux 7 : zlib (ELSA-2022-9987)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9987 advisory. 1.2.7-20.0.1 - Resolves: CVE-2022-37434 Orabug: 34752508 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

Oracle Linux 6 : zlib (ELSA-2022-9988)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9988 advisory. 1.2.3-29.0.3 - Fix for CVE-2022-37474 Orabug: 34759428 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

Denial Of Service (DoS)

upx is vulnerable to denial of service. The vulnerability exists because the heap-based buffer over-read in accuagetbe32 function of miniacc.h, allowing an attacker to cause an application crash through the maliciously crafted Mach-O file...

FreeBSD : sudo -- Potential out-of-bounds write for small passwords (3310014a-5ef9-11ed-812b-206a8a720317)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3310014a-5ef9-11ed-812b-206a8a720317 advisory. - Sudo 1.8.0 through 1.9.12, with the crypt password backend, contains a plugins/sudoers/auth/passwd.c...

Denial Of Service (DoS)

upx is vulnerable to denial of service. The vulnerability exists due to the heap-based buffer over-read in the getle32 function of bele.h, allowing an attacker to crash the application through the maliciously crafted Mach-O file...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current sudo Vulnerability (SSA:2022-309-01)

The version of sudo installed on the remote host is prior to 1.9.12p1. It is, therefore, affected by a vulnerability as referenced in the SSA:2022-309-01 advisory. - Sudo 1.8.0 through 1.9.12, with the crypt password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that...

Oracle Linux 9 : zlib (ELSA-2022-7314)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-7314 advisory. 1.2.11-32 - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c - Resolves: CVE-2022-37434 Tenable has extracted the preceding descriptio...

CVE-2022-43995

Sudo 1.8.0 through 1.9.12, with the crypt password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer...

CVE-2022-43995: Out-of-bounds Read

Sudo 1.8.0 through 1.9.12, with the crypt password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-based buffer over-read. This can be triggered by arbitrary local users with access to Sudo by entering a password of seven characters or fewer...

EulerOS 2.0 SP10 : sudo (EulerOS-SA-2022-2669)

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parsetagandwiretype in protobuf-c/protobuf-c.c. This...

Moderate: zlib security update

The zlib packages provide a general-purpose lossless data compression library that is used by many different programs. Security Fixes: zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field CVE-2022-37434 For more details about the...