Oracle Linux 8 : squashfs-tools (ELSA-2024-3139)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-3139 advisory. 4.3-21 - CVE-2021-41072 squashfs-tools: additional write outside destination directory exploit fix CVE-2021-40153 squashfs-tools: unvalidated filepaths...

Fedora 40 : glycin-loaders / gnome-tour / helix / helvum / libipuz / loupe / etc (2024-ce2936b568)

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-ce2936b568 advisory. This update contains builds from a mini-mass-rebuild for Rust applications and some C-style libraries. Rebuilding with the Rust 1.78 toolchain should fix...

Oracle Linux 8 : perl:5.32 (ELSA-2024-3128)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3128 advisory. - Fix CVE-2023-47038 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not tested for...

Oracle Linux 8 : python3.11 (ELSA-2024-3062)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3062 advisory. 3.11.7-1.0.1 - Update rpm-macros description Orabug: 36024572 3.11.7-1 - Rebase to 3.11.7 Resolves: RHEL-21915 3.11.5-2 - Security fix for CVE-2023-27043...

RHEL 9 : kernel-rt (RHSA-2024:3414)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3414 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirement...

AlmaLinux 9 : tomcat (ALSA-2024:3307)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:3307 advisory. Apache Tomcat: HTTP/2 header handling DoS CVE-2024-24549 Apache Tomcat: WebSocket DoS with incomplete closing handshake CVE-2024-23672 Bug Fixes and...

RHEL 9 : rust (RHSA-2024:3418)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3418 advisory. Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries. Security...

Oracle Linux 8 : frr (ELSA-2024-2981)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2981 advisory. 7.5.1-22.0.1 - Fix POSTIN scriptlet Orabug: 34712485 - Resolves: RHEL-15916 - Flowspec overflow in bgpd/bgpflowspec.c - Resolves: RHEL-15919 - Out of...

Oracle Linux 8 : mutt (ELSA-2024-3058)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-3058 advisory. - Fix for: CVE-2023-4874 CVE-2023-4875 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note tha...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Flask-Security vulnerability (USN-6792-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6792-1 advisory. Naom Moshe discovered that Flask-Security incorrectly validated URLs. An attacker could use this issue to redirect users to arbitrary URLs...

Oracle Linux 8 : libtiff (ELSA-2024-3059)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3059 advisory. - Fix CVE-2022-3599 CVE-2022-4645 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has n...

Amazon Linux 2023 : cni-plugins (ALAS2023-2024-630)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-630 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADE...

RHEL 8 : rust-toolset:rhel8 (RHSA-2024:3428)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3428 advisory. Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries. Security...

Oracle Linux 8 : exempi (ELSA-2024-3066)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3066 advisory. - Fix CVE-2020-18652 - Fix CVE-2020-18651 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

Oracle Linux 8 : pam (ELSA-2024-3163)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3163 advisory. - pamnamespace: protectdir: use ODIRECTORY to prevent local DoS situations. CVE-2024-22365. Resolves: RHEL-21242 Tenable has extracted the preceding description...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2024-634)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-634 advisory. 2024-06-06: CVE-2022-48281 was added to this advisory. 2024-06-06: CVE-2023-41175 was added to this advisory. 2024-06-06: CVE-2023-40745 was added to this advisory. 2024-06-06: CVE-2023-30775 w...

Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS : amavisd-new vulnerability (USN-6790-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6790-1 advisory. It was discovered that amavisd-new incorrectly handled certain MIME email messages with multiple boundary parameters. A remote...

Amazon Linux 2023 : bpftrace (ALAS2023-2024-627)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-627 advisory. If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux...

RHEL 9 : mod_http2 (RHSA-2024:3402)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:3402 advisory. The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: httpd: CONTINUATION...

Atlassian Confluence 5.5 < 7.19.22 / 7.20.x < 8.5.9 / 8.6.x < 8.9.0 MPC (CONFSERVER-95839)

The version of Atlassian Confluence Server running on the remote host is affected by a missing permission check vulnerability as referenced in the CONFSERVER-95839 advisory. - In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through...