GLSA-202401-28 : GOCR: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202401-28 GOCR: Multiple Vulnerabilities - A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in measurepitch in pgm2asc.c. CVE-2021-33479 - An use-after-free vulnerability was discovered in...

RHCOS 4 : OpenShift Container Platform 4.9.54 (RHSA-2022:9110)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:9110 advisory. - jenkins-plugin: Arbitrary file write vulnerability in Pipeline Input Step Plugin CVE-2022-34177 Note that Nessus has not tested for this...

RHCOS 4 : OpenShift Container Platform 4.11.53 (RHSA-2023:6274)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6274 advisory. - ovn: service monitor MAC flow is not rate limited CVE-2023-3153 Note that Nessus has not tested for this issue but has instead relied only ...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : Apache::Session::LDAP vulnerability (USN-6596-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6596-1 advisory. It was discovered that Apache::Session::LDAP incorrectly handled invalid X.509 certificates. If a user or an automated system were tricked...

RHCOS 4 : OpenShift Container Platform 4.12.45 (RHSA-2023:7610)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7610 advisory. - HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 - python-werkzeug:...

RHCOS 4 : OpenShift Container Platform 4.11.54 (RHSA-2023:7481)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7481 advisory. - HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Note that Nessus has not test...

Amazon Linux 2 : postfix (ALAS-2024-2420)

The version of postfix installed on the remote host is prior to 2.10.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2420 advisory. Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpddatarestrictions=rejectunauthpipelining and...

FreeBSD : zeek -- potential DoS vulnerability (fedf7e71-61bd-49ec-aaf0-6da14bdbb319)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fedf7e71-61bd-49ec-aaf0-6da14bdbb319 advisory. - Tim Wojtulewicz of Corelight reports: A specially-crafted series of packets containing nested MIME...

Debian dla-3712 : kodi - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3712 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3712-1 [email protected]...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-493)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-493 advisory. When a router encounters an IPv6 packet too big to transmit to the next-hop, it returns an ICMP6 Packet Too Big PTB message to the sender. The sender caches this updated Maximum Transmission Unit MTU so...

Amazon Linux 2 : thunderbird (ALAS-2024-2417)

The version of thunderbird installed on the remote host is prior to 115.6.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2417 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function...

Mozilla Firefox ESR < 115.7

The version of Firefox ESR installed on the remote Windows host is prior to 115.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-02 advisory. - Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed...

Amazon Linux 2023 : perl-Spreadsheet-ParseExcel (ALAS2023-2024-491)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-491 advisory. Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution ACE vulnerability due to passing unvalidated inpu...

Amazon Linux AMI : perl-Spreadsheet-ParseExcel (ALAS-2024-1905)

The version of perl-Spreadsheet-ParseExcel installed on the remote host is prior to 0.5900-5.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1905 advisory. Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel i...

Amazon Linux AMI : exim (ALAS-2024-1908)

The version of exim installed on the remote host is prior to 4.92-1.40. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1908 advisory. Exim through 4.97 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to...

Debian dsa-5603 : xdmx - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5603 advisory. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5603...

Fedora 39 : systemd (2024-b8312ca5b3)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-b8312ca5b3 advisory. - A bunch of fixes for various components: systemd, systemctl, systemd-firstboot, systemd-repart, bootctl, systemd-networkd, systemd-network-generator,...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-488)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-488 advisory. In the Linux kernel, the following vulnerability has been resolved: iouring/afunix: disable sending iouring over sockets CVE-2023-52654 In the Linux kernel, the following vulnerability has been...

Amazon Linux 2 : webkitgtk4 (ALAS-2024-2425)

The version of webkitgtk4 installed on the remote host is prior to 2.42.4-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2425 advisory. The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, iOS 17.2...

Foxit PDF Editor < 11.2.8 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 11.2.8. It is, therefore affected by multiple vulnerabilities: - A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles 3D...