Amazon Linux 2 : unbound (ALAS-2024-2467)

The version of unbound installed on the remote host is prior to 1.7.3-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2467 advisory. A vulnerability named 'Non-Responsive Delegation Attack' NRDelegation Attack has been discovered in various DNS resolving software...

Amazon Linux 2 : edk2 (ALAS-2024-2465)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2465 advisory. EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable function, allowing a user to trigger a heap buffer overflow via a local network. Successful exploitation of this vulnerability ma...

Amazon Linux 2 : python-pillow (ALAS-2024-2472)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2472 advisory. Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote...

Amazon Linux 2 : woodstox-core (ALAS-2024-2463)

The version of woodstox-core installed on the remote host is prior to 4.1.2-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2463 advisory. Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks DOS if DTD support is enabled. If the...

Amazon Linux 2 : jsoup (ALAS-2024-2466)

The version of jsoup installed on the remote host is prior to 1.6.1-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2466 advisory. jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting XSS safety. jsoup may incorrectly...

Amazon Linux 2 : ipa (ALAS-2024-2457)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2457 advisory. A Cross-site request forgery vulnerability exists in ipa/session/loginpassword in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform...

Fedora 39 : freeglut (2024-b69a4d75a1)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b69a4d75a1 advisory. Patch for CVE-2024-24258 and CVE-2024-24259 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

Amazon Linux 2 : nss-util (ALAS-2024-2470)

The version of nss-util installed on the remote host is prior to 3.44.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2470 advisory. Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before...

nginx 1.25.x < 1.25.4 DoS

The installed version of nginx is 1.25.x prior to 1.25.4. It may, therefore, affected by the following vulnerabilities: - When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is...

Amazon Linux 2 : xstream (ALAS-2024-2464)

The version of xstream installed on the remote host is prior to 1.3.1-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2464 advisory. Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user...

Ubuntu 20.04 LTS : Bind vulnerabilities (USN-6642-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6642-1 advisory. Shoham Danino, Anat Bremler-Barr, Yehuda Afek, and Yuval Shavitt discovered that Bind incorrectly handled parsing large DNS messages. A remote attacker...

Amazon Linux 2 : jetty (ALAS-2024-2460)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2460 advisory. Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the + character proceeding the content-length value in a HTTP/1 header field. Thi...

Amazon Linux 2 : webkitgtk4 (ALAS-2024-2459)

The version of webkitgtk4 installed on the remote host is prior to 2.42.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2459 advisory. 2024-04-11: CVE-2024-23252 was added to this advisory. A use-after-free issue was addressed with improved memory...

RHEL 8 : gimp:2.8 (RHSA-2024:0863)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0863 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox,...

Fedora 39 : caddy (2024-22b915e51a)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-22b915e51a advisory. Update to the latest upstream version, which includes a fix for CVE-2023-45142. https://github.com/caddyserver/caddy/releases/tag/v2.7.6 Tenable has extracte...

Amazon Linux 2 : gstreamer1-plugins-bad-free (ALAS-2024-2454)

The version of gstreamer1-plugins-bad-free installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2454 advisory. GStreamer-SA-2024-0001: AV1 codec parser potential buffer overflow during tile list parsing NOTE:...

Amazon Linux 2 : amazon-ssm-agent (ALAS-2024-2458)

The version of amazon-ssm-agent installed on the remote host is prior to 3.2.2222.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2458 advisory. 2024-04-24: CVE-2023-49568 was added to this advisory. 2024-02-29: CVE-2023-39326 was added to this advisory...

QNAP QTS / QuTS hero Multiple Vulnerabilities in QTS, QuTS hero (QSA-23-38)

The version of QNAP QTS / QuTS hero installed on the remote host is affected by multiple vulnerabilities as referenced in the QSA-23-38 advisory: - A heap-based buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could...

Amazon Linux AMI : kernel (ALAS-2024-1919)

The version of kernel installed on the remote host is prior to 4.14.336-179.559. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1919 advisory. A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privile...

RHEL 8 : gimp:2.8 (RHSA-2024:0862)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0862 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox,...