SUSE SLES15 Security Update : kernel RT (Live Patch 3 for SLE 15 SP4) (SUSE-SU-2023:2697-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2697-1 advisory. This update for the Linux Kernel 5.14.21-1504001511 fixes several issues. The following security issues were fixed: - CVE-2023-31436: Fixed an...

CBL Mariner 2.0 Security Update: kernel (CVE-2023-0459)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-0459 advisory. - Copyfromuser on 64-bit versions of the Linux kernel does not implement the uaccessbeginnospec allowing a user...

SUSE SLES15 Security Update : kernel (Live Patch 40 for SLE 15 SP1) (SUSE-SU-2023:2687-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2687-1 advisory. This update for the Linux Kernel 4.12.14-150100197145 fixes several issues. The following security issues were fixed: - CVE-2023-31436: Fixed a...

Openfire 3.10 < 4.6.8 / 4.7 < 4.7.5 Authentication Bypass

The remote host is running a version of Openfire that is affected by an authentication bypass vulnerability. Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack...

CBL Mariner 2.0 Security Update: opensc (CVE-2023-2977)

The version of opensc installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-2977 advisory. - A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15...

GitLab 13.6 < 15.11.10 / 16.0 < 16.0.6 / 16.1 < 16.1.1 (CVE-2023-3363)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1, resulted in the...

Liferay DXP 7.4.13.70 < 7.4.13.74 XSS

The detected install of Liferay DXP is between 7.4.13.70 and 7.4.13.73. It is therefore affected by a Cross-site scripting XSS vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.13.70 through 7.4.13.73, which allows remote attackers to inject arbitrary web script or HTML...

Debian dla-3473 : docker-registry - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3473 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3473-1 [email protected] https://www.debian.org/lts/security/...

SUSE SLES15 Security Update : kernel (Live Patch 37 for SLE 15 SP1) (SUSE-SU-2023:2681-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2681-1 advisory. This update for the Linux Kernel 4.12.14-150100197134 fixes several issues. The following security issues were fixed: - CVE-2023-31436: Fixed a...

CBL Mariner 2.0 Security Update: kernel (CVE-2023-2985)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-2985 advisory. - A use after free flaw was found in hfsplusputsuper in fs/hfsplus/super.c in the Linux Kernel. This flaw could...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2023-021 (ALASKERNEL-5.15-2023-021)

The version of kernel installed on the remote host is prior to 5.15.117-72.142. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2023-021 advisory. In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT...

openSUSE 15 Security Update : guile1, lilypond (openSUSE-SU-2023:0137-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0137-1 advisory. - The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other...

Amazon Linux 2023 : libeconf, libeconf-devel, libeconf-utils (ALAS2023-2023-227)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-227 advisory. A Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in openSUSE libeconf leads to DoS via malformed config files.This issue affects libeconf: before 0.5.2...

Amazon Linux 2023 : cups-filters, cups-filters-devel, cups-filters-libs (ALAS2023-2023-223)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-223 advisory. A vulnerability was found in cups-filters. This security flaw occurs if you use beh to create an accessible network printer, possibly resulting in remote code execution. CVE-2023-24805 Tenable has...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2023-230)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-230 advisory. LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, th...

Debian dla-3468 : libhsqldb1.8.0-java - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3468 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3468-1 [email protected] https://www.debian.org/lts/security/...

Fedora 38 : kubernetes (2023-c7f63322b5)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-c7f63322b5 advisory. Upstream security update with additional bugfixes. Resolves CVE-2023-2431. Tenable has extracted the preceding description block directly from the...

Fedora 38 : firefox (2023-af4cfc9c3c)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-af4cfc9c3c advisory. - Updated to latest upstream 114.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessu...

CentOS 8 : ruby:2.7 (CESA-2023:3821)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:3821 advisory. - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that...

FortiNAC - External Control of File Name or Path in keyUpload scriptlet (FG-IR-22-300)

The version of Fortinet FortiNAC installed on the remote host is 8.3.x, 8.5.x, 8.6.x, 8.7.x, 8.8.x, 9.1.x prior to 9.1.8, 9.2.x prior to 9.2.6, or 9.4.x prior to 9.4.1. It is, therefore, affected by an external control of file name or path security issue. An unauthenticated, remote attacker can...