Amazon Linux 2 : libarchive (ALAS-2023-2279)

The version of libarchive installed on the remote host is prior to 3.1.2-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2279 advisory. In libarchive 3.6.1, the software does not check for an error after calling calloc function that can return with a NULL pointer...

Amazon Linux 2 : python-reportlab (ALAS-2023-2285)

The version of python-reportlab installed on the remote host is prior to 2.5-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2285 advisory. paraparser in ReportLab before 3.5.31 allows remote code execution because startunichar in paraparser.py evaluates untruste...

Oracle Linux 9 : thunderbird (ELSA-2023-5435)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-5435 advisory. 115.3.1-1.0.1 - Update to 115.3.1 build1 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

Rocky Linux 8 : libtiff (RLSA-2023:5353)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:5353 advisory. - LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted tiff file...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : jQuery UI vulnerabilities (USN-6419-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6419-1 advisory. Hong Phat Ly discovered that jQuery UI did not properly manage parameters from untrusted sources, which could lead to arbitrary w...

Oracle Linux 9 : glibc (ELSA-2023-12850)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-12850 advisory. 2.34-60.0.3 - CVE-2023-4911: tunables: Terminate immediately if end of input is reached Reviewed by: Jose E. Marchesi Tenable has extracted the preceding...

Progress WS_FTP Server < 8.8.2 Multiple Vulnerabilities

The remote host is running a version of WSFTP earlier than to 8.8.2. Such versions are reportedly affected by multiple vulnerabilities : - A stored cross-site scripting XSS vulnerability exists in WSFTP Server's Management module. An attacker with administrative privileges could import a SSL...

Fedora 37 : ckeditor (2023-983ff03630)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-983ff03630 advisory. - 4.22.0/4.22.1 - 4.21.0 - GHSA-vh5c-xwqv-cv9g / CVE-2023-28439 - 4.20.2 - 4.20.1 Tenable has extracted the preceding description block directly from the...

Cisco Adaptive Security Appliance Software Remote Access VPN Unauthorized Access - Brute Force Attack (cisco-sa-asaftd-ravpn-auth-8LyfCkeC)

A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations. This vulnerability is due to improper separation o...

Oracle Linux 9 : nodejs:18 (ELSA-2023-5363)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-5363 advisory. - Rebase to version 18.17.1 Resolves: rhbz2228940 Resolves: CVE-2023-32002 CVE-2023-32006 CVE-2023-32559 Tenable has extracted the preceding descriptio...

RHEL 8 : thunderbird (RHSA-2023:5432)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5432 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.3.1. Security Fixes: firefox:...

SUSE SLES15: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2023:3941-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3941-1 advisory. Mozilla Firefox ESR 115.3.1 ESR was released to fix a security issue: - MFSA 2023-44 bsc1215814 CVE-2023-5217: Fixed a heap buffer overflow ...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libvpx (SUSE-SU-2023:3948-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3948-1 advisory. - CVE-2023-5217: Fixed a heap buffer overflow bsc1215778. Tenable has extracted the preceding description...

SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2023:3950-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3950-1 advisory. Mozilla Firefox was updated to 115.3.1 ESR, fixing a security issue: MFSA 2023-44 bsc1215814 CVE-2023-5217: Fixed heap buffer overflow in...

SAP BusinessObjects Business Intelligence Platform Authentication Bypass (3320702)

The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is affected by an authentication bypass vulnerability. SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to ...

SUSE SLES15: bind / bind-chrootenv / bind-devel / bind-doc / bind-utils / etc (SUSE-SU-2023:3934-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3934-1 advisory. Security fixes: - CVE-2023-3341: Fixed stack exhaustion flaw in control channel code may cause named to terminate unexpectedly bsc1215472...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : vim (SUSE-SU-2023:3955-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3955-1 advisory. Security fixes: - CVE-2023-4733: Fixed use-after-free in function buflistaltfpos bsc1215004. -...

FreeBSD : FreeBSD -- msdosfs data disclosure (fefcd340-624f-11ee-8e38-002590c1f29c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fefcd340-624f-11ee-8e38-002590c1f29c advisory. - On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libvpx (SUSE-SU-2023:3946-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3946-1 advisory. - CVE-2023-5217: Fixed a heap buffer overflow bsc1215778. Tenable has extracted the preceding description...

SUSE SLED15: MozillaFirefox / MozillaFirefox-branding-upstream / etc (SUSE-SU-2023:3949-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3949-1 advisory. Mozilla Firefox was updated to 115.3.1 ESR, fixing a security issue: MFSA 2023-44 bsc1215814 CVE-2023-521...