Ubuntu 18.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-5630-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5630-1 advisory. It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of-...

ISC BIND 9.9.4-S1 < 9.16.33-S1 / 9.8.4 < 9.16.33 / 9.16.8-S1 < 9.16.33-S1 Memory Exhaustion (cve-2022-38177)

The version of ISC BIND installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cve-2022-38177 advisory. - By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memo...

Oracle Linux 8 : webkit2gtk3 (ELSA-2022-6540)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-6540 advisory. 2.36.7-1 - Update to 2.36.7 Related: 2123429 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerability (USN-5634-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5634-1 advisory. Domingo Dirutigliano and Nicola Guerrera discovered that the netfilter subsystem in the Linux kernel did not properly handle rules that truncated packets below th...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel-container (ELSA-2022-9829)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9829 advisory. - netfilter: nftables: do not allow RULEID to refer to another chain Thadeu Lima de Souza Cascardo Orabug: 34495567 CVE-2022-2586 - netfilter:...

Ubuntu 22.04 LTS : OAuthLib vulnerability (USN-5632-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5632-1 advisory. Sebastian Chnelik discovered that OAuthLib incorrectly handled certain redirect uris. A remote attacker could possibly use this issue to cause OAuthLib to crash,...

Oracle Linux 9 : kernel (ELSA-2022-6610)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-6610 advisory. - lockdown: also lock down previous kgdb use Daniel Thompson Orabug: 34290418 CVE-2022-21499 - netfilter: nftables: sanitize nftsetdescconcatparse...

Ubuntu 20.04 LTS / 22.04 LTS : PCRE vulnerabilities (USN-5627-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5627-1 advisory. It was discovered that PCRE incorrectly handled memory when handling certain regular expressions. An attacker could possibly use this issue t...

FreeBSD : redis -- Potential remote code execution vulnerability (f1f637d1-39eb-11ed-ab44-080027f5fec9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f1f637d1-39eb-11ed-ab44-080027f5fec9 advisory. - The Redis core team reports: Executing a XAUTOCLAIM command on a stream key in a specific state, with...

ISC BIND 9.9.12 < 9.16.33 / 9.10.7 < 9.16.33 / 9.11.4-S1 < 9.16.33-S1 / 9.11.3 < 9.16.33 / 9.16.8-S1 < 9.16.33-S1 / 9.18.0 < 9.18.7 / 9.19.0 < 9.19.5 Memory Exhaustion (cve-2022-38178)

The version of ISC BIND installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cve-2022-38178 advisory. - By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memo...

Ubuntu 16.04 ESM : Python vulnerability (USN-5629-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5629-1 advisory. It was discovered that the Python http.server module incorrectly handled certain URIs. An attacker could potentially use this to redirect web traffic. Tenable has...

Oracle Linux 9 : dbus-broker (ELSA-2022-6608)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2022-6608 advisory. 28-5.1 - Fix a stack buffer over-read in the c-shquote library - Fix null pointer reference when supplying a malformed XML config file - Add gating.yam...

Debian DSA-5232-1 : tinygltf - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5232 advisory. It was discovered that the wordexp function of tinygltf, a library to load/save glTF GL Transmission Format files was susceptible to command execution when processing...

Ubuntu 16.04 ESM / 18.04 LTS : Linux kernel vulnerabilities (USN-5621-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5621-1 advisory. It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an...

Oracle Linux 9 : ruby (ELSA-2022-6585)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-6585 advisory. - Fix double free in Regexp compilation. Resolves: CVE-2022-28738 Tenable has extracted the preceding description block directly from the Oracle Linux...

Mozilla Firefox ESR < 102.3

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 102.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-41 advisory. - Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla...

openSUSE 15 Security Update : mupdf (openSUSE-SU-2022:10126-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10126-1 advisory. - zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches. CVE-2018-25032 ...

Fortinet Fortigate Flaws over keytab encryption scheme (FG-IR-22-158)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-158 advisory. - A missing cryptographic steps vulnerability CWE-325 in the functions that encrypt the keytab files in FortiOS version 7.2.0...

openSUSE 15 Security Update : chromium (openSUSE-SU-2022:10123-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10123-1 advisory. - Out of bounds write in Storage. CVE-2022-3195 - Use after free in PDF. CVE-2022-3196, CVE-2022-3197, CVE-2022-3198 - Use after free in...

openSUSE 15 Security Update : virtualbox (openSUSE-SU-2022:10122-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10122-1 advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is...