AlmaLinux 9 : httpd (ALSA-2023:0970)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0970 advisory. - A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool heap memory location beyond the header value...

AlmaLinux 9 : python3.9 (ALSA-2023:0953)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:0953 advisory. - An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA RFC 3490 decoder,...

Ubuntu 16.04 ESM / 20.04 ESM / 22.04 ESM : ZoneMinder vulnerabilities (USN-5889-1)

The remote Ubuntu 16.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5889-1 advisory. It was discovered that ZoneMinder was not properly sanitizing URL parameters for certain views. An attacker could possibly use th...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : PHP vulnerabilities (USN-5902-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5902-1 advisory. It was discovered that PHP incorrectly handled certain invalid Blowfish password hashes. An invalid password hash could possibly...

Debian DSA-5361-1 : tiff - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5361 advisory. - LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted tiff file. For users...

Debian DSA-5364-1 : apr-util - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5364 advisory. - Integer Overflow or Wraparound vulnerability in aprbase64 functions of Apache Portable Runtime Utility APR-util allows an attacker to write beyond bounds of a buffer. Th...

Fedora 37 : bluedevil / breeze-gtk / flatpak-kcm / grub2-breeze-theme / etc (2023-e31c3e4b6c)

The remote Fedora 37 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-e31c3e4b6c advisory. Plasma 5.27.1 ---- Add patch to disable global shortcuts at login for the SDDM Plasma Wayland configuration 2171332 Tenable has extracted the preceding...

SUSE SLES12: libpoppler-cpp0 / libpoppler-devel / libpoppler-glib-devel / etc (SUSE-SU-2023:0494-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0494-1 advisory. - CVE-2022-38784: Fixed integer overflow in the JBIG2 decoder bsc1202692. - CVE-2019-13283: Fixed heap-based buffer over-read that...

Amazon Linux 2 : thunderbird (ALAS-2023-1945)

The version of thunderbird installed on the remote host is prior to 68.10.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1945 advisory. The Mozilla Foundation Security Advisory describes this flaw as: Due to confusion about ValueTags on JavaScript...

Debian dla-3337 : libmariadb-dev - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3337 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3337-1 [email protected] https://www.debian.org/lts/security/...

AlmaLinux 9 : thunderbird (ALSA-2023:0824)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:0824 advisory. - Mozilla: User Interface lockup with messages combining S/MIME and OpenPGP CVE-2023-0616 - An attacker could construct a PKCS 12 cert bundle in such a wa...

Apache Tomcat 8.5.x < 8.5.85 Denial Of Service

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.85, 9.0.0-M1 prior to 9.0.71, 10.1.0-M1 prior to 10.1.5 or 11.0.0-M1 prior to 11.0.0-M3. It is, therefore, affected by a denial of service due to a vulnerability in the file upload functionality in the Apache Commons...

Amazon Linux 2 : httpcomponents-client (ALAS-2023-1946)

The version of httpcomponents-client installed on the remote host is prior to 4.2.5-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1946 advisory. Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in reques...

Oracle Linux 8 : tar (ELSA-2023-0842)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-0842 advisory. - Fix CVE-2022-48303 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not tested for...

NewStart CGSL MAIN 6.02 : zlib Vulnerability (NS-SA-2023-0004)

The remote NewStart CGSL host, running version MAIN 6.02, has zlib packages installed that are affected by a vulnerability: - zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches. CVE-2018-25032 Note that Nessus has not tested for...

Fedora 36 : kernel (2023-457955ce13)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-457955ce13 advisory. The 6.1.12 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly from the...

AlmaLinux 8 : httpd:2.4 (ALSA-2023:0852)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0852 advisory. httpd: moddav: out-of-bounds read/write of zero byte CVE-2006-20001 httpd: modproxyajp: Possible request smuggling CVE-2022-36760 httpd: modproxy: HTTP...

Oracle Linux 8 : thunderbird (ELSA-2023-0821)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-0821 advisory. 102.8.0-2.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 102.8.0-2 - Update to 102.8.0 build2 102.8.0-1 -...

Moodle 4.0.x < 4.0.3 Multiple Vulnerabilities

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.16, 3.11.x prior to 3.11.9 or 4.0.x prior to 4.0.3. It is, therefore, affected by multiple vulnerabilities: - A vulnerable version of the Mustache template library included in Moodle. CVE-2022-0323 - A Cross-Site Request...

Fedora 37 : curl (2023-ddf6575695)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ddf6575695 advisory. - fix HTTP multi-header compression denial of service CVE-2023-23916 - share HSTS between handles CVE-2023-23915 CVE-2023-23914 Tenable has extracte...