Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Python vulnerabilities (USN-5767-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5767-1 advisory. Nicky Mouha discovered that Python incorrectly handled certain SHA-3 internals. An attacker could possibly use this issue to caus...

AlmaLinux 9 : nodejs:18 (ALSA-2022:8832)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:8832 advisory. nodejs-minimatch: ReDoS via the braceExpand function CVE-2022-3517 nodejs: DNS rebinding in inspect via invalid octal IP address CVE-2022-43548 Tenable ha...

Amazon Linux 2 : util-linux (ALAS-2022-1878)

The version of util-linux installed on the remote host is prior to 2.30.2-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1878 advisory. A command injection flaw was found in the way util-linux implements umount autocompletion in Bash. An attacker with the ability...

Rocky Linux 8 : varnish:6 (RLSA-2022:8649)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:8649 advisory. - An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce...

Amazon Linux 2 : python3 (ALAS-2022-1897)

The version of python3 installed on the remote host is prior to 3.7.15-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1897 advisory. The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows...

Amazon Linux 2 : libtiff (ALAS-2022-1891)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1891 advisory. A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main function. This flaw allows an attacker to pass a...

Amazon Linux 2 : ant (ALAS-2022-1880)

The version of ant installed on the remote host is prior to 1.9.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1880 advisory. When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memor...

FreeBSD : Python -- multiple vulnerabilities (050eba46-7638-11ed-820d-080027d3a315)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 050eba46-7638-11ed-820d-080027d3a315 advisory. - Python reports: gh-100001: python -m http.server no longer allows terminal control characters sent...

Ubuntu 16.04 ESM : libxml2 vulnerabilities (USN-5760-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5760-2 advisory. USN-5760-1 fixed vulnerabilities in libxml2. This update provides the corresponding updates for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Tenable has...

Amazon Linux 2 : 389-ds-base (ALAS-2022-1879)

The version of 389-ds-base installed on the remote host is prior to 1.3.10.2-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1879 advisory. A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL...

Amazon Linux 2 : golang (ALAS-2022-1887)

The version of golang installed on the remote host is prior to 1.18.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1887 advisory. Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to...

RHEL 8 : grub2 (RHSA-2022:8800)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8800 advisory. The grub2 packages provide version 2 of the Grand Unified Boot Loader GRUB, a highly configurable and customizable boot loader with modular...

Oracle Linux 7 : pki-core (ELSA-2022-8799)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-8799 advisory. - Bugzilla Bug 2107329 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE rhel-7.9.z ckelley, mharmsen Tenable has extracted...

F5 Networks BIG-IP : Java vulnerability (K35253541)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K35253541 advisory. Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supported versions that...

Debian dla-3223 : giflib-tools - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3223 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3223-1 [email protected]...

Debian DSA-5294-1 : jhead - security update

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5294 advisory. Jhead, a tool for manipulating EXIF data embedded in JPEG images, allowed attackers to execute arbitrary OS commands by placing them in a JPEG filename and then...

FreeBSD : chromium -- Type confusion in V8 (2899da38-7300-11ed-92ce-3065ec8fd3ec)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 2899da38-7300-11ed-92ce-3065ec8fd3ec advisory. - Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially...

Fedora 36 : capnproto / fastnetmon / librime / rr / sonic-visualiser (2022-5d37367673)

The remote Fedora 36 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2022-5d37367673 advisory. Update capnproto to version 0.9.2 to address CVE-2022-46149. Dependent packages were rebuilt for both the fix for the security issue and the capnproto SONAME...

Fedora 36 : thunderbird (2022-b83fff8106)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-b83fff8106 advisory. Update to 102.5.1 ; https://www.mozilla.org/en-US/security/advisories/mfsa2022-50/ ; https://www.thunderbird.net/en-US/thunderbird/102.5.1/releasenotes/...

Debian dla-3218 : libpostgresql-jdbc-java - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3218 advisory. - ----------------------------------------------------------------------- Debian LTS Advisory DLA-3218-1 [email protected] https://www.debian.org/lts/security/...