SUSE SLES12 Security Update : libssh2_org (SUSE-SU-2023:4946-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4946-1 advisory. - CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity Terrapin Attack bsc1218127. Tenable has extracted the preceding...

FreeBSD : putty -- add protocol extension against 'Terrapin attack' (91955195-9ebb-11ee-bc14-a703705db3a6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 91955195-9ebb-11ee-bc14-a703705db3a6 advisory. - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : OpenSSH vulnerabilities (USN-6560-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6560-1 advisory. Fabian Bumer, Marcus Brinkmann, Jrg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If...

Debian DSA-5579-1 : freeimage - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5579 advisory. Multiple vulnerabilities were discovered in FreeImage, a support library for graphics image formats, which could result in the execution of arbitrary code if...

AlmaLinux 8 : tracker-miners (ALSA-2023:7732)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:7732 advisory. - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the...

Ubuntu 22.04 LTS / 23.04 / 23.10 : Budgie Extras vulnerabilities (USN-6556-1)

The remote Ubuntu 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6556-1 advisory. It was discovered that Budgie Extras incorrectly handled certain temporary file paths. An attacker could possibly use this issue to injec...

Debian dla-3689 : bluetooth - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3689 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3689-1 [email protected] https://www.debian.org/lts/security/...

Amazon Linux 2023 : python3-cryptography (ALAS2023-2023-459)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-459 advisory. cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions Cipher.updateinto would accept Python objects which implement the buffer...

Oracle Linux 9 : kernel (ELSA-2023-13047)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-13047 advisory. - cifs: Fix UAF in cifsdemultiplexthread Zhang Xiaoxu Steve French CVE-2023-1192 - fs/smb/client: Reset password pointer to NULL Quang Le Steve French...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : GNOME Settings vulnerability (USN-6554-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6554-1 advisory. Zygmunt Krynicki discovered that GNOME Settings did not accurately reflect the SSH remote login status when the system was configured ...

Security Updates for Microsoft Dynamics 365 (on-premises) (December 2023)

The Microsoft Dynamics 365 on-premises is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A denial of service DoS vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services. CVE-2023-35621 - A sessio...

Fedora 38 : libcmis / libreoffice (2023-0d971cd6aa)

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-0d971cd6aa advisory. 7.5.9.2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these...

RHEL 9 : buildah (RHSA-2023:7764)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7764 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

RHEL 9 : tracker-miners (RHSA-2023:7712)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7712 advisory. Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool. This package contains various miners and...

SUSE SLES15: libopenvswitch-2_14-0 / libovn-20_06-0 / openvswitch / etc (SUSE-SU-2023:4661-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4661-1 advisory. - CVE-2023-5366: Fixed missing masks on a final stage with ports trie bsc1216002. Tenable has extracted the preceding...

FreeBSD : electron25 -- multiple vulnerabilities (e07a7754-12a4-4661-b852-fd221d68955f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e07a7754-12a4-4661-b852-fd221d68955f advisory. - Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker...

Atlassian Confluence 8.5.x < 8.5.4 Template Injection

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 4.x prior to 7.19.17, 8.x prior to 8.4.5, 8.5.x prior to 8.5.4, 8.6.x prior to 8.6.2 or 8.7.x prior to 8.7.1. It is, therefore, affected by a template injection vulnerability which...

Google Chrome < 120.0.6099.62 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 120.0.6099.62. It is, therefore, affected by multiple vulnerabilities as referenced in the 202312stable-channel-update-for-desktop advisory. - Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowe...

Amazon Linux AMI : xorg-x11-server (ALAS-2023-1892)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1892 advisory. A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration a multi-screen setup with multiple protocol screens, also known as Zaphod...

Amazon Linux 2 : vim (ALAS-2023-2353)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2353 advisory. Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be...