Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : HAProxy vulnerability (USN-6530-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6530-1 advisory. It was discovered that HAProxy incorrectly handled URI components containing the hash character . A remote attacker could possibly use this...

Fedora 38 : clevis-pin-tpm2 / keyring-ima-signer / libkrun / rust-bodhi-cli / etc (2023-6215ea423b)

The remote Fedora 38 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-6215ea423b advisory. Affected applications were rebuilt against version 0.10.60 of the the openssl crate the Rust bindings for OpenSSL to address two security advisories: -...

Fedora 37 : motif (2023-25329c196b)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-25329c196b advisory. Security fix for CVE-2023-43788 and CVE-2023-43789 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Amazon Linux AMI : libXpm (ALAS-2023-1894)

The version of libXpm installed on the remote host is prior to 3.5.10-2.13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1894 advisory. libXpm: out of bounds read in XpmCreateXpmImageFromBuffer NOTE: https://www.openwall.com/lists/oss-security/2023/10/03/1NOTE: Fix...

Ubuntu 16.04 ESM : Linux kernel vulnerabilities (USN-6532-1)

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6532-1 advisory. Tavis Ormandy discovered that some AMD processors did not properly handle speculative execution of certain vector register instructions. A local attacker...

Amazon Linux AMI : libX11 (ALAS-2023-1895)

The version of libX11 installed on the remote host is prior to 1.6.0-2.2.17. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1895 advisory. A vulnerability was found in libX11 due to an infinite loop within the PutSubImage function. This flaw allows a local user to...

Fedora 39 : motif (2023-e1c7fae02e)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-e1c7fae02e advisory. Security fix for CVE-2023-43788 and CVE-2023-43789 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Amazon Linux 2 : xorg-x11-server (ALAS-2023-2352)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2352 advisory. A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration a multi-screen setup with multiple protocol screens, also known as Zaphod...

Amazon Linux 2 : virtuoso-opensource (ALAS-2023-2360)

The version of virtuoso-opensource installed on the remote host is prior to 7.2.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2360 advisory. 2024-03-13: CVE-2023-31618 was added to this advisory. 2024-03-13: CVE-2023-31627 was added to this advisory...

Amazon Linux 2 : vim (ALAS-2023-2353)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2353 advisory. Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be...

Amazon Linux 2 : compat-libtiff3 (ALAS-2023-2346)

The version of compat-libtiff3 installed on the remote host is prior to 3.9.4-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2346 advisory. An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen API may allow a remote attacker to cau...

Amazon Linux 2 : libX11 (ALAS-2023-2356)

The version of libX11 installed on the remote host is prior to 1.6.7-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2356 advisory. A vulnerability was found in libX11 due to an infinite loop within the PutSubImage function. This flaw allows a local user to consum...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-031 (ALASKERNEL-5.15-2023-031)

The version of kernel installed on the remote host is prior to 5.15.139-93.147. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-031 advisory. In the Linux kernel, the following vulnerability has been resolved: llc: verify mac len before reading ma...

Amazon Linux 2 : php (ALAS-2023-2375)

The version of php installed on the remote host is prior to 5.4.16-46. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2375 advisory. An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5...

AlmaLinux 8 : postgresql:13 (ALSA-2023:7581)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:7581 advisory. postgresql: Buffer overrun from integer overflow in array modification CVE-2023-5869 postgresql: Memory disclosure in aggregate function calls CVE-2023-58...

FreeBSD : Gitlab -- Vulnerabilities (3b14b2b4-9014-11ee-98b3-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3b14b2b4-9014-11ee-98b3-001b217b3468 advisory. - An issue has been discovered in GitLab EE affecting all versions starting from X.Y before...

Fedora 37 : golang-github-openprinting-ipp-usb (2023-ce2836acfa)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ce2836acfa advisory. Security fix for CVE-2022-41717 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Apache Superset < 2.1.0 Secure Session Key

The version of Apache Superset installed on the remote host is affected a potential unsecure session key vulnerability. Installations that have not altered the default configured SECRETKEY according to the installation instructions, or that use a predictable key phrase, would allow for an...

Oracle Linux 8 : postgresql:13 (ELSA-2023-7581)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7581 advisory. - Fixes: CVE-2023-5868 CVE-2023-5869 CVE-2023-5870 CVE-2023-39417 Tenable has extracted the preceding description block directly from the Oracle Linux...

Debian DSA-5571-1 : rabbitmq-server - security update

The remote Debian 11 / 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5571 advisory. - RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service DoS...