RHEL 8 : parfait:0.5 (RHSA-2022:0289)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0289 advisory. Parfait is a Java performance monitoring library that collects metrics and exposes them through a variety of outputs. It provides APIs for...

FreeBSD : Python -- multiple vulnerabilities (80e057e7-2f0a-11ed-978f-fcaa147e860e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 80e057e7-2f0a-11ed-978f-fcaa147e860e advisory. - Python reports: gh-95778: Converting between int and str in bases other than 2 binary, 4, 8 octal, 16...

RHEL 9 : .NET 6.0 (RHSA-2022:4588)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4588 advisory. .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

Oracle Linux 9 : open-vm-tools (ELSA-2022-6358)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-6358 advisory. 11.3.5-1.0.1.el90.1 - Fix spaces in vmware udev rule for scsi devices Orabug: 24461968 - Fix vmware udev rule in 99-vmware-scsi-timeout.rules file. Orabug:...

GLSA-202209-03 : OpenSC: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202209-03 OpenSC: Multiple Vulnerabilities - A heap double free issue was found in Opensc before version 0.22.0 in scpkcs15freetokeninfo. CVE-2021-42778 - A heap use after free issue was found in Opensc before version 0.22.0 in...

OracleVM 3.4 : kernel-uek (OVMSA-2022-0024)

The remote OracleVM system is missing necessary patches to address security updates: - In the Linux kernel before 4.20.14, expanddownwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms...

Amazon Linux 2022 : bsdcat, bsdcpio, bsdtar (ALAS2022-2022-059)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-059 advisory. An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provid...

Slackware Linux 15.0 / current python3 Vulnerability (SSA:2022-250-01)

The version of python3 installed on the remote host is prior to 3.9.14. It is, therefore, affected by a vulnerability as referenced in the SSA:2022-250-01 advisory. - A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using inttext, a system coul...

Amazon Linux 2022 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2022-2022-112)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-112 advisory. Generated code produced by C1 may leak a package-private class to a class from a different package. CVE-2022-21540 MethodHandle.invokeBasic method can be accessed on byte code level from an...

Amazon Linux 2022 : freerdp, freerdp-devel, freerdp-libs (ALAS2022-2022-082)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-082 advisory. A flaw was found in the FreeRDP client when it fails to validate input data when using gateway connections. This flaw could allow a malicious gateway to send a specially crafted input to a clie...

Amazon Linux 2022 : openexr, openexr-devel, openexr-libs (ALAS2022-2022-061)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-061 advisory. An integer overflow could occur when OpenEXR processes a crafted file on systems where sizet is less than 64 bits. This issue could cause an invalid bytesPerLine and maxBytesPerLine value, whic...

Foxit PDF Editor < 12.0 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 12.0. It is, therefore affected by multiple vulnerabilities: - This vulnerability allows remote attackers to disclose sensitive information on affected...

GLSA-202209-04 : OpenJPEG: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202209-04 OpenJPEG: Multiple Vulnerabilities - Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service DoS. This occurs when the attacker uses the command line option -ImgD...

FreeBSD : go -- multiple vulnerabilities (6fea7103-2ea4-11ed-b403-3dae8ac60d3e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6fea7103-2ea4-11ed-b403-3dae8ac60d3e advisory. - JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For...

GLSA-202209-01 : GNU Gzip, XZ Utils: Arbitrary file write

The remote host is affected by the vulnerability described in GLSA-202209-01 GNU Gzip, XZ Utils: Arbitrary file write - An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can...

Wireshark 3.4.x < 3.4.16 A Vulnerability

The version of Wireshark installed on the remote Windows host is prior to 3.4.16. It is, therefore, affected by a vulnerability as referenced in the wireshark-3.4.16 advisory. - Infinite loop in the F5 Ethernet Trailer protocol dissector in Wireshark 3.6.0 to 3.6.7 and 3.4.0 to 3.4.15 allows deni...

Slackware Linux 15.0 mozilla-firefox Multiple Vulnerabilities (SSA:2022-249-01)

The version of mozilla-firefox installed on the remote host is prior to 102.2.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-249-01 advisory. - Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions CVE-2022-38473 - A data ra...

Amazon Linux 2022 : grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot (ALAS2022-2022-109)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-109 advisory. A flaw was found in grub 2, where a crafted 16-bit grayscale PNG image may lead to an out-of-bounds write. This flaw allows an attacker to corrupt the data on the heap portion of the grub2's...

Amazon Linux 2022 : bpftool, kernel, kernel-devel (ALAS2022-2022-127)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-127 advisory. A flaw was found in hw. Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. CVE-2022-2381...

Amazon Linux 2022 : protobuf, protobuf-compiler, protobuf-devel (ALAS2022-2022-098)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-098 advisory. A flaw was found in protobuf. The vulnerability occurs due to incorrect parsing of a NULL character in the proto symbol and leads to a Null pointer dereference. This flaw allows an attacker to execute...