Amazon Linux 2 : libpq (ALASPOSTGRESQL14-2024-009)

The version of libpq installed on the remote host is prior to 14.1-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-009 advisory. A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certifica...

AlmaLinux 9 : edk2 (ALSA-2024:1075)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1075 advisory. - EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability can be exploit...

Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-544)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-544 advisory. 2024-03-13: CVE-2024-22025 was added to this advisory. The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2024-006)

The version of postgresql installed on the remote host is prior to 13.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL13-2024-006 advisory. Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-034)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.27.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-034 advisory. Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happ...

RHEL 8 : postgresql:12 (RHSA-2024:1195)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1195 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: non-owner 'REFRESH MATERIALIZED VIEW...

Oracle Linux 8 : edk2 (ELSA-2024-1063)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1063 advisory. - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch RHEL-21840 RHEL-21842 - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.pat...

Debian dsa-5636 : chromium - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5636 advisory. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5636-1...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-cryptography (SUSE-SU-2024:0763-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0763-1 advisory. - CVE-2024-26130: Fixed NULL pointer dereference in pkcs12.serializekeyandcertificates bsc1220210. Tenabl...

Ubuntu 20.04 LTS : Firefox regressions (USN-6649-2)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6649-2 advisory. USN-6649-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. Tenable has extracted the preceding...

SUSE SLES15 / openSUSE 15 Security Update : apache2-mod_auth_openidc (SUSE-SU-2024:0757-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0757-1 advisory. - CVE-2024-24814: Fixed a denial of service when using OIDCSessionType client-cookie and manipulating cookies bsc1219911...

Amazon Linux 2 : firefox (ALASFIREFOX-2024-022)

The version of firefox installed on the remote host is prior to 115.8.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-022 advisory. When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resultin...

SUSE SLES15: kernel-firmware-nvidia-gspx-G06 / etc (SUSE-SU-2024:0770-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0770-1 advisory. Update to 550.54.14 Added vGPU Host and vGPU Guest support. For vGPU Host, please refer to the README.vgpu packaged in the vGPU Hos...

SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2024:0329-2)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:0329-2 advisory. - CVE-2023-27043: Fixed incorrectly parses e-mail addresses which contain a special character bsc1210638. Tenable has extracted the preceding descripti...

Amazon Linux 2023 : libgit2, libgit2-devel (ALAS2023-2024-541)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-541 advisory. libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted...

Amazon Linux 2023 : python3-unbound, unbound, unbound-anchor (ALAS2023-2024-553)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-553 advisory. Certain DNSSEC aspects of the DNS protocol in RFC 4035 and related RFCs allow remote attackers to cause a denial of service CPU consumption via one or more DNSSEC responses when there is a zone...

SUSE SLES15: ruby2.5-rubygem-rack / ruby2.5-rubygem-rack-doc / etc (SUSE-SU-2024:0765-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0765-1 advisory. - CVE-2024-25126: Fixed a denial-of-service vulnerability in Rack Content-Type parsing bsc1220239. - CVE-2024-26141: Fixed a...

AlmaLinux 8 : edk2 (ALSA-2024:1063)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1063 advisory. - EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in DHCPv6 client. This vulnerability can be exploit...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2024-543)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-543 advisory. Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1...

Amazon Linux 2 : engrampa (ALASMATE-DESKTOP1.X-2024-008)

The version of engrampa installed on the remote host is prior to 1.24.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2MATE-DESKTOP1.X-2024-008 advisory. Engrampa is an archive manager for the MATE environment. Engrampa is found to be vulnerable to a Path Traversal...