GLSA-202402-27 : Glade: Denial of Service

The remote host is affected by the vulnerability described in GLSA-202402-27 Glade: Denial of Service - plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service application crash. CVE-2020-36774...

Zoom VDI Meeting Client < 5.17.5 Vulnerability (ZSB-24002)

The version of Zoom VDI Meeting Client installed on the remote host is prior to 5.17.5. It is, therefore, affected by a vulnerability as referenced in the ZSB-24002 advisory. - Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for...

Oracle Linux 8 : edk2 (ELSA-2024-0888)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-0888 advisory. 20220126gitbb1bba3d77-6.el89.3 - edk2-Bumped-openssl-submodule-version-to-cf317b2bb227.patch RHEL-7560 - Resolves: RHEL-7560 CVE-2023-3446 edk2: openssl:...

CentOS 8 : python-pillow (CESA-2024:0893)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:0893 advisory. - Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 which wa...

Mozilla Firefox < 123.0

The version of Firefox installed on the remote Windows host is prior to 123.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-05 advisory. - Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior. Note: Thi...

Amazon Linux 2023 : GraphicsMagick, GraphicsMagick-c++, GraphicsMagick-c++-devel (ALAS2023-2024-532)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-532 advisory. Buffer Overflow vulnerability in WritePCXImage function in pcx.c in GraphicsMagick 1.4 allows remote attackers to cause a denial of service via converting of crafted image file to pcx format...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-038)

The version of kernel installed on the remote host is prior to 5.15.148-97.161. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-038 advisory. A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to...

Zoom VDI Meeting Client < 5.16.0 Vulnerability (ZSB-23059)

The version of Zoom VDI Meeting Client installed on the remote host is prior to 5.16.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-23059 advisory. - Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2024-526)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-526 advisory. 2024-02-29: CVE-2023-39326 was added to this advisory. 2024-02-29: CVE-2023-39325 was added to this advisory. 2024-02-29: CVE-2023-49568 was added to this advisory. The HTTP/2 protocol allows a...

RHEL 8 : go-toolset:rhel8 (RHSA-2024:0887)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0887 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: golang:...

Amazon Linux 2023 : nspr, nspr-devel, nss (ALAS2023-2024-523)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-523 advisory. Multiple NSS NIST curves were susceptible to a side-channel attack known as Minerva. This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox 121...

Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel vulnerabilities (USN-6646-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6646-1 advisory. It was discovered that a race condition existed in the ATM Asynchronous Transfer Mode subsystem of the Linux kernel, leading to a...

Joomla 1.5.x < 3.10.15 / 4.0.x < 4.4.3 / 5.0.x < 5.0.3 Multiple Vulnerabilities (5904-joomla-5-0-3-and-4-4-3-security-and-bug-fix-release)

According to its self-reported version, the instance of Joomla! running on the remote web server is 1.5.x prior to 3.10.15, 4.0.x prior to 4.4.3, or 5.0.x prior to 5.0.3. It is, therefore, affected by multiple vulnerabilities. - The MFA management features did not properly terminate existing user...

Amazon Linux 2 : atril (ALASMATE-DESKTOP1.X-2024-006)

The version of atril installed on the remote host is prior to 1.20.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2MATE-DESKTOP1.X-2024-006 advisory. Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and...

Amazon Linux 2023 : runc (ALAS2023-2024-531)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-531 advisory. runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where runc exec --cap created processes with non-empty...

Amazon Linux 2023 : gnutls, gnutls-c++, gnutls-dane (ALAS2023-2024-521)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-521 advisory. A vulnerability was found in GnuTLS, where a cockpit which uses gnuTLS rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-537)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-537 advisory. A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. The nftsetelemcatchalldeactivate function checks whether the...

Amazon Linux 2023 : lua, lua-devel, lua-libs (ALAS2023-2024-533)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-533 advisory. 2024-05-09: CVE-2022-33099 was added to this advisory. In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. CVE-2021-45985 An issue in the...

Amazon Linux 2 : atril (ALASMATE-DESKTOP1.X-2024-007)

The version of atril installed on the remote host is prior to 1.20.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2MATE-DESKTOP1.X-2024-007 advisory. Atril is a simple multi-page document viewer. Atril is vulnerable to a critical Command Injection Vulnerability. This...

Oracle Linux 8 : python-pillow (ELSA-2024-0893)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-0893 advisory. 5.1.1-18.1 - Security fix for CVE-2023-50447 Resolves: RHEL-22240 Tenable has extracted the preceding description block directly from the Oracle Linux security...