Fedora 39 : python-cramjam / rust-async-compression / rust-brotli / etc (2024-8831059030)

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-8831059030 advisory. Update rust-brotli-decompressor to 4.0.1, rust-brotli to 7.0.0, and rust-async-compression to 0.4.13. Patch dependent packages as needed to avoid compat...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : OpenIPMI (SUSE-SU-2024:3604-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3604-1 advisory. - CVE-2024-42934: Fixed missing check on the authorization type on incoming LAN messages in IPMI simulato...

SUSE SLED15 / SLES15 / openSUSE 15 : Recommended update for python-requests (SUSE-SU-SUSE-RU-2024:3600-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-SUSE-RU-2024:3600-1 advisory. This update for python-requests fixes the following issue: - Update CVE-2024-35195.patch to allow...

Security Update for Microsoft .NET Core SDK (October 2024)

The version of .NET Core SDK installed on the remote host is 6.x prior to 6.0.35 or 8.x prior to 8.0.10. It is, therefore, affected by denial of service vulnerability as referenced in the October 2024 advisory: - .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability...

SUSE SLED12: libreoffice / libreoffice-base / etc (SUSE-SU-2024:3576-1)

The remote SUSE Linux SLED12 / SLEDSAP12 / SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3576-1 advisory. libreoffice was updated to version 24.8.1.2 jscPED-10362: - Release notes:...

AlmaLinux 9 : .NET 6.0 (ALSA-2024:7867)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:7867 advisory. dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList CVE-2024-43484 dotnet: Denial of Service in System.Text.Json CVE-2024-43485 dotnet...

GitLab 11.4 < 17.2.9 / 17.3 < 17.3.5 / 17.4 < 17.4.2 (CVE-2024-5005)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Gitlab reports: Run pipelines on arbitrary branches An attacker can impersonate arbitrary user SSRF in Analytics Dashboard Viewing diffs of MR with conflicts can be slow HTMLi in OAuth page Deploy Key...

CBL Mariner 2.0 Security Update: nvidia-container-toolkit (CVE-2024-0132)

The version of nvidia-container-toolkit installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-0132 advisory. - NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use TOCTOU...

GitLab 11.6 < 17.2.9 / 17.3 < 17.3.5 / 17.4 < 17.4.2 (CVE-2024-8970)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Gitlab reports: Run pipelines on arbitrary branches An attacker can impersonate arbitrary user SSRF in Analytics Dashboard Viewing diffs of MR with conflicts can be slow HTMLi in OAuth page Deploy Key...

Ubuntu 22.04 LTS : Linux kernel vulnerabilities (USN-7020-4)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7020-4 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in...

Security Updates for Microsoft Visual Studio Products (October 2024)

The Microsoft Visual Studio Products are missing security updates. They are, therefore, affected by multiple vulnerabilities, including: - .NET Denial of Service Vulnerability in System.Security.Cryptography.Cose, System.IO.Packaging, System.Runtime.Caching CVE-2024-43483 - .NET Denial of Service...

JetBrains TeamCity < 2024.07.3 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2024.07.3. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API CVE-2024-47161 - In JetBrains TeamCity before 2024.07.3 path...

Progress Telerik UI for WinForms < 2024.3.924 Command Injection

The version of Progress Telerik UI for WinForms installed on the remote host is prior to 2024.3.924. It is, therefore, affected by a vulnerability as referenced in the cve-2024-7679 advisory. - In Progress Telerik UI for WinForms versions prior to 2024 Q3 2024.3.924, a command injection attack is...

Security Update for Microsoft .NET Core SDK (CVE-2024-38229) (October 2024)

The version of .NET Core SDK installed on the remote host is 8.x prior to 8.0.10. It is, therefore, affected by remote code execution vulnerability as referenced in the October 2024 advisory: - .NET and Visual Studio Remote Code Execution Vulnerability CVE-2024-38229 Note that Nessus has not test...

CBL Mariner 2.0 Security Update: unbound (CVE-2024-33655)

The version of unbound installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-33655 advisory. - The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service resource...

CBL Mariner 2.0 Security Update: nvidia-container-toolkit (CVE-2024-0133)

The version of nvidia-container-toolkit installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-0133 advisory. - NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of...

Mozilla Thunderbird < 115.16.0

The version of Thunderbird installed on the remote Windows host is prior to 115.16.0. It is, therefore, affected by a vulnerability as referenced in the mfsa2024-52 advisory. - An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation...

Security Updates for Microsoft Office Products C2R (October 2024)

The Microsoft Office Products are missing a security update. It is, therefore, affected by the following vulnerabilities: - Microsoft Office is affected by a remote code execution vulnerability. CVE-2024-43576 - Microsoft Office is affected by a remote code execution vulnerability. CVE-2024-43616...

CBL Mariner 2.0 Security Update: unbound (CVE-2024-43167)

The version of unbound installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-43167 advisory. - DISPUTE NOTE: this issue does not pose a security risk as it according to analysis by the original software...

Oracle Linux 8 : firefox (ELSA-2024-7977)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-7977 advisory. 128.3.1-2.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 128.3.1 - Add debranding patches Mustafa Gezen - Add OpenELA default preference...