Oracle Linux 6 : zlib (ELSA-2022-9988)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9988 advisory. 1.2.3-29.0.3 - Fix for CVE-2022-37474 Orabug: 34759428 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2022-022 (ALASKERNEL-5.10-2022-022)

The version of kernel installed on the remote host is prior to 5.10.149-133.644. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-022 advisory. A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function...

RHEL 8 : mingw-expat (RHSA-2022:7811)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7811 advisory. Expat is a C library for parsing XML documents. The mingw-expat packages provide a port of the Expat library for MinGW. The following packag...

FreeBSD : darkhttpd -- DOS vulnerability (9c399521-5f80-11ed-8ac4-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 9c399521-5f80-11ed-8ac4-b42e991fc52e advisory. - A flaw was found in darkhttpd. Invalid error handling allows remote attackers to cause...

Foxit PDF Editor < 12.0.2 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 12.0.2. It is, therefore affected by multiple vulnerabilities: - A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF...

FreeBSD : zeek -- potential DoS vulnerabilities (60d4d31a-a573-41bd-8c1e-5af7513c1ee9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 60d4d31a-a573-41bd-8c1e-5af7513c1ee9 advisory. - Tim Wojtulewicz of Corelight reports: Fix an issue where a specially-crafted FTP packet can cause Zee...

RHEL 8 : php:7.4 (RHSA-2022:7628)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7628 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have been upgraded to a later...

Ubuntu 16.04 ESM : DHCP vulnerabilities (USN-5658-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5658-2 advisory. USN-5658-1 fixed vulnerabilities in DHCP. This update provides the corresponding updates for Ubuntu 16.04 ESM. Tenable has extracted the preceding...

Oracle Linux 8 : ol8addon (ELSA-2022-23681)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-23681 advisory. golang 1.17.13-1.0.1 - Update tarball to 1.17.12 - Add patches between Go 1.17.12 and Go 1.17.13 - Reviewed-by: David Faust 1.17.12-1 - Update Go to...

Debian dla-3181 : sudo - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3181 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3181-1 [email protected] https://www.debian.org/lts/security/...

Amazon Linux 2022 : openssl, openssl-devel, openssl-libs (ALAS2022-2022-195)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-195 advisory. A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passed the file names of certificates being hashed to a command execute...

Amazon Linux 2022 : openjpeg2, openjpeg2-devel, openjpeg2-tools (ALAS2022-2022-184)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-184 advisory. There is a flaw in the opj2compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2compress, could trigger a heap...

Amazon Linux 2022 : bind, bind-chroot, bind-devel (ALAS2022-2022-166)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-166 advisory. A cache poisoning vulnerability was found in BIND when using forwarders. Bogus NS records supplied by the forwarders may be cached and used by name if it needs to recurse for any reason. This...

Amazon Linux 2022 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2022-2022-196)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-196 advisory. A flaw was found in python-pillow. The vulnerability occurs due to improper initialization of image paths, leading to a buffer over-read and improper initialization. This flaw allows an attacke...

Amazon Linux 2022 : sendmail, sendmail-cf, sendmail-milter (ALAS2022-2022-171)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-171 advisory. ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates...

Tableau Server Broken Access Control (CVE-2022-22127)

Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity Store for managing users. The vulnerability allows a malicious site administrator to change passwords for users in different sites hosted on the same Tableau...

Pulse Connect Secure < 9.1R16 Client Side Desync (SA45476)

The Pulse Connect Secure installed on the remote host is prior to 9.1R16. It is, therefore, affected by client-side http request smuggling. When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends u...

Amazon Linux 2022 : lua, lua-devel, lua-libs (ALAS2022-2022-176)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-176 advisory. A stack overflow issue was discovered in Lua in the luaresume function of ldo.c. This flaw allows a local attacker to pass a specially crafted file to the Lua Interpreter, causing a crash that...

Amazon Linux 2022 : autotrace, autotrace-devel (ALAS2022-2022-160)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-160 advisory. A biWidthbiBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an unexpected input value to malloc via a malformed bitmap image. CVE-2019-19004 A bitmap doubl...

Oracle Linux 9 : kernel (ELSA-2022-7318)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7318 advisory. - lockdown: also lock down previous kgdb use Daniel Thompson Orabug: 34290418 CVE-2022-21499 - ptrace: Check PTRACEOSUSPENDSECCOMP permission on...