Debian dsa-5641 : fontforge - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5641 advisory. - Splinefont in FontForge through 20230101 allows command injection via crafted filenames. CVE-2024-25081 - Splinefont in FontForge through 20230101 allows...

RHEL 8 : postgresql (RHSA-2024:1422)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1422 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: non-owner 'REFRESH MATERIALIZED VIEW...

RHEL 8 : opencryptoki (RHSA-2024:1411)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1411 advisory. The opencryptoki packages contain version 2.11 of the PKCS11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These...

openSUSE 15 Security Update : chromium (openSUSE-SU-2024:0084-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0084-1 advisory. - Out of bounds memory access in Blink in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to perform out of bounds memory access v...

CVE-2024-2390

As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified and reported. This vulnerability could allow a malicious actor with sufficient permissions on a scan target to place a binary in a specific filesystem location, and abuse the impacted plugin...

CVE-2024-2390 Local Privilege Escalation

As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified and reported. This vulnerability could allow a malicious actor with sufficient permissions on a scan target to place a binary in a specific filesystem location, and abuse the impacted plugin...

CVE-2024-2390 Local Privilege Escalation

As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified and reported. This vulnerability could allow a malicious actor with sufficient permissions on a scan target to place a binary in a specific filesystem location, and abuse the impacted plugin...

CVE-2024-2390

CVE-2024-2390 relates to a Nessus plugin vulnerability where a user with sufficient permissions on a scan target could place a binary in a specific filesystem location and abuse the plugin to escalate privileges. Descriptions from PT-2024-2338 indicate the issue stems from inadequate access contr...

Amazon Linux 2 : libpq (ALASPOSTGRESQL12-2024-010)

The version of libpq installed on the remote host is prior to 12.15-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL12-2024-010 advisory. In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos...

Fedora 38 : mingw-expat (2024-40b98c9ced)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-40b98c9ced advisory. Update to 2.6.1, backport fix for CVE-2024-28757. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Amazon Linux 2 : c-ares (ALAS-2024-2494)

The version of c-ares installed on the remote host is prior to 1.10.0-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2494 advisory. c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as...

Tenable Network Security Nessus Security Vulnerability

Tenable Network Security Nessus is an open source system vulnerability scanner from Tenable Network Security, USA. A security vulnerability exists in Tenable Network Security Nessus Plugin Feed ID, which stems from a vulnerability that allows an attacker with sufficient privileges to the target o...

Amazon Linux 2 : thunderbird (ALAS-2024-2497)

The version of thunderbird installed on the remote host is prior to 115.8.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2497 advisory. The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message i...

Amazon Linux 2 : rust (ALAS-2024-2496)

The version of rust installed on the remote host is prior to 1.68.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2496 advisory. libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to...

Debian dla-3764 : libecpg-compat3 - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3764 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3764-1 [email protected] https://www.debian.org/lts/security/...

Amazon Linux 2 : aws-nitro-enclaves-cli (ALASNITRO-ENCLAVES-2024-039)

The version of aws-nitro-enclaves-cli installed on the remote host is prior to 1.2.3-0. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2024-039 advisory. RUSTSEC-2024-0006 NOTE: https://rustsec.org/advisories/RUSTSEC-2024-0006.html NOTE:...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : Vim vulnerability (USN-6698-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6698-1 advisory. Zhen Zhou discovered that Vim did not properly manage memory. An attacker could possibly use this issue to...

Debian dla-3766 : libnvpair1linux - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3766 advisory. - ----------------------------------------------------------------------- Debian LTS Advisory DLA-3766-1 [email protected]...

AlmaLinux 8 : dnsmasq (ALSA-2024:1335)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1335 advisory. - Certain DNSSEC aspects of the DNS protocol in RFC 4033, 4034, 4035, 6840, and related RFCs allow remote attackers to cause a denial of service CPU...

RHEL 8 / 9 : Red Hat JBoss Web Server 6.0.1 (RHSA-2024:1324)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1324 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the...