Fedora 35 : keylime (2022-5a6ed3607d)

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-5a6ed3607d advisory. Security fix for CVE-2022-3500 Proper exception handling in tornadorequests Tenable has extracted the preceding description block directly from the...

Debian dla-3234 : hsqldb-utils - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3234 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3234-1 [email protected] https://www.debian.org/lts/security/...

Amazon Linux AMI : zlib (ALAS-2022-1650)

The version of zlib installed on the remote host is prior to 1.2.8-7.20. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1650 advisory. A security vulnerability was found in zlib. The flaw triggered a heap-based buffer in inflate in the inflate.c function via a large...

Amazon Linux 2022 : maven-shared-utils (ALAS2022-2022-242)

The version of maven-shared-utils installed on the remote host is prior to 3.3.4-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-242 advisory. - In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings...

Amazon Linux AMI : libtiff (ALAS-2022-1644)

The version of libtiff installed on the remote host is prior to 4.0.3-35.42. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1644 advisory. A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main function. This flaw allows an attacker to pass a...

Amazon Linux AMI : python36 (ALAS-2022-1652)

The version of python36 installed on the remote host is prior to 3.6.12-1.23. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1652 advisory. The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows...

Amazon Linux AMI : libtiff (ALAS-2022-1647)

The version of libtiff installed on the remote host is prior to 4.0.3-35.40. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1647 advisory. A flaw was found in libtiffs tiffcrop utility that has a uint32t underflow that can lead to an out-of- bounds read and write. Th...

Amazon Linux 2022 : docker (ALAS2022-2022-237)

The version of docker installed on the remote host is prior to 20.10.17-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-237 advisory. - Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby...

Amazon Linux 2022 : dnsmasq (ALAS2022-2022-227)

The version of dnsmasq installed on the remote host is prior to 2.86-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-227 advisory. - A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted...

Amazon Linux 2022 : mariadb105 (ALAS2022-2022-245)

The version of mariadb105 installed on the remote host is prior to 10.5.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-245 advisory. - MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepareinplaceaddvirtual at...

Amazon Linux 2022 : xmlsec1 (ALAS2022-2022-257)

The version of xmlsec1 installed on the remote host is prior to 1.2.33-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-257 advisory. - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE...

Amazon Linux 2022 : openexr (ALAS2022-2022-216)

The version of openexr installed on the remote host is prior to 3.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-216 advisory. - An integer overflow could occur when OpenEXR processes a crafted file on systems where sizet 64 bits. This could cause...

Amazon Linux 2022 : ncurses (ALAS2022-2022-217)

The version of ncurses installed on the remote host is prior to 6.2-4.20200222. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-217 advisory. - An issue was discovered in ncurses through v6.2-1. nccaptoinfo in captoinfo.c has a heap-based buffer overflow...

Amazon Linux 2022 : python-jwt (ALAS2022-2022-241)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-241 advisory. - PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an attacker submitting the JWT token can choose the used signing algorithm. The PyJWT...

Amazon Linux 2022 : python3.10 (ALAS2022-2022-212)

The version of python3.10 installed on the remote host is prior to 3.10.8-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-212 advisory. - A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using inttext, a syst...

Amazon Linux 2022 : xorg-x11-server (ALAS2022-2022-250)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-250 advisory. - A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : Heimdal vulnerability (USN-5766-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5766-1 advisory. It was discovered that Heimdal did not properly manage memory when normalizing Unicode. An attacker could possibly use this issue to cause...

Ubuntu 16.04 ESM : Python vulnerability (USN-5767-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5767-2 advisory. USN-5767-1 fixed a vulnerability in Python. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Tenable has extracted the...

SUSE SLES15 / openSUSE 15 Security Update : buildah (SUSE-SU-2022:4350-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4350-1 advisory. Version update to 1.28.2. - CVE-2022-2990: Fixed a possible information disclosure and modification vulnerability...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Python vulnerabilities (USN-5767-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5767-1 advisory. Nicky Mouha discovered that Python incorrectly handled certain SHA-3 internals. An attacker could possibly use this issue to caus...