Oracle Linux 7 : bind (ELSA-2023-4152)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-4152 advisory. - Prevent the cache going over the configured limit CVE-2023-2828 - Tighten cache protection against record from forwarders CVE-2021-25220 - Include test of...

Amazon Linux 2 : python3-requests (ALAS-2023-2111)

The version of python3-requests installed on the remote host is prior to 2.14.2-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2111 advisory. A flaw was found in the Python-requests package, where it is vulnerable to potentially leaking Proxy- Authorization heade...

Amazon Linux 2 : libX11 (ALAS-2023-2129)

The version of libX11 installed on the remote host is prior to 1.6.7-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2129 advisory. A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the...

Amazon Linux 2 : open-vm-tools (ALAS-2023-2114)

The version of open-vm-tools installed on the remote host is prior to 12.1.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2114 advisory. VMware Tools 12.0.0, 11.x.y and 10.x.y contains a local privilege escalation vulnerability. A malicious actor with local...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2023-238)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-238 advisory. The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that th...

Ubuntu 22.04 LTS : Linux kernel vulnerabilities (USN-6192-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6192-1 advisory. Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of- bounds write vulnerability. An attacker could us...

Amazon Linux 2 : open-vm-tools (ALAS-2023-2139)

The version of open-vm-tools installed on the remote host is prior to 12.2.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2139 advisory. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the...

Juniper Junos OS Vulnerability (JSA10865)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA10865 advisory. - Receipt of specially crafted UDP/IP packets over MPLS may be able to bypass a stateless firewall filter. The crafted UDP packets must be encapsulated and meet a very...

Oracle Linux 8 : webkit2gtk3 (ELSA-2023-4202)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4202 advisory. 2.38.5-1.5 - Disable JIT CVE-2023-32435, CVE-2023-32439 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Amazon Linux 2023 : jackson-core (ALAS2023-2023-248)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-248 advisory. An issue was discovered jackson-databind thru 2.15.2 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. CVE-2023-35116 Tenable h...

Juniper Junos OS Vulnerability (JSA69878)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA69878 advisory. - An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS Evolved on ACX7000 Series allows an...

RHEL 9 : java-11-openjdk (RHSA-2023:4157)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4157 advisory. The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fixe...

SUSE SLES15: dbus-1 / dbus-1-devel / dbus-1-x11 / libdbus-1-3 / etc (SUSE-SU-2023:2879-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:2879-1 advisory. - CVE-2023-34969: Fixed a possible dbus-daemon crash by an unprivileged users bsc1212126. Tenable has extracted the preceding description block directl...

Amazon Linux AMI : golang (ALAS-2023-1784)

The version of golang installed on the remote host is prior to 1.18.6-1.45. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1784 advisory. The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a g...

Ubuntu 20.04 LTS : Linux kernel (Xilinx ZynqMP) vulnerability (USN-6234-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6234-1 advisory. Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of- bounds write vulnerability. An attacker could use this to...

Amazon Linux 2 : pidgin (ALAS-2023-2115)

The version of pidgin installed on the remote host is prior to 2.10.11-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2115 advisory. An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to...

Ubuntu 23.04 : Linux kernel vulnerabilities (USN-6228-1)

The remote Ubuntu 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6228-1 advisory. It was discovered that the XFS file system implementation in the Linux kernel did not properly perform metadata validation when mounting certain images. An...

Zimbra Collaboration Server 9.0.0 < 9.0.0 Patch 33 Multiple Vulnerabilities

According to its self-reported version number, Zimbra Collaboration Server is affected by multiple vulnerabilities including: - Vulnerability in the sfdcpreauth.jsp component. A remote, unauthenticated attacker can exploit this vulnerability to execute arbitrary code. CVE-2023-29382 - HTTP reques...

Amazon Linux 2 : squashfs-tools (ALAS-2023-2152)

The version of squashfs-tools installed on the remote host is prior to 4.3-0.21.gitaae0aff4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2152 advisory. Integer overflow in the readfragmenttable4 function in unsquash-4.c in Squashfs and sasquatch allows...

Amazon Linux 2 : fribidi (ALAS-2023-2116)

The version of fribidi installed on the remote host is prior to 1.0.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2116 advisory. A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially...