SUSE SLES12 Security Update : libssh2_org (SUSE-SU-2023:4946-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4946-1 advisory. - CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity Terrapin Attack bsc1218127. Tenable has extracted the preceding...

Debian DSA-5584-1 : bluez - security update

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5584 advisory. It was reported that the BlueZ's HID profile implementation is not inline with the HID specification which mandates the use of Security Mode 4. The HID profile...

AlmaLinux 8 : opensc (ALSA-2023:7876)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:7876 advisory. - A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current proftpd Vulnerability (SSA:2023-354-01)

The version of proftpd installed on the remote host is prior to 1.3.8b. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-354-01 advisory. - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attacker...

FreeBSD : putty -- add protocol extension against 'Terrapin attack' (91955195-9ebb-11ee-bc14-a703705db3a6)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 91955195-9ebb-11ee-bc14-a703705db3a6 advisory. - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : OpenSSH vulnerabilities (USN-6560-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6560-1 advisory. Fabian Bumer, Marcus Brinkmann, Jrg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If...

Debian DSA-5579-1 : freeimage - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5579 advisory. Multiple vulnerabilities were discovered in FreeImage, a support library for graphics image formats, which could result in the execution of arbitrary code if...

Ubuntu 22.04 LTS / 23.04 / 23.10 : Budgie Extras vulnerabilities (USN-6556-1)

The remote Ubuntu 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6556-1 advisory. It was discovered that Budgie Extras incorrectly handled certain temporary file paths. An attacker could possibly use this issue to injec...

AlmaLinux 8 : tracker-miners (ALSA-2023:7732)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:7732 advisory. - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the...

Amazon Linux 2023 : perl, perl-Attribute-Handlers, perl-AutoLoader (ALAS2023-2023-448)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-448 advisory. 2024-02-01: CVE-2023-47100 was added to this advisory. A crafted regular expression when compiled by perl 5.30.0 through 5.38.0 can cause a one-byte attacker controlled buffer overflow in a hea...

AlmaLinux 8 : avahi (ALSA-2023:7836)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:7836 advisory. - A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not...

Debian dla-3689 : bluetooth - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3689 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3689-1 [email protected] https://www.debian.org/lts/security/...

Amazon Linux 2023 : python3-cryptography (ALAS2023-2023-459)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-459 advisory. cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions Cipher.updateinto would accept Python objects which implement the buffer...

Oracle Linux 9 : kernel (ELSA-2023-13047)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-13047 advisory. - cifs: Fix UAF in cifsdemultiplexthread Zhang Xiaoxu Steve French CVE-2023-1192 - fs/smb/client: Reset password pointer to NULL Quang Le Steve French...

FreeBSD : Gitlab -- vulnerabilities (e2fb85ce-9a3c-11ee-af26-001b217b3468)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e2fb85ce-9a3c-11ee-af26-001b217b3468 advisory. - Gitlab reports: Smartcard authentication allows impersonation of arbitrary user using user's...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : GNOME Settings vulnerability (USN-6554-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6554-1 advisory. Zygmunt Krynicki discovered that GNOME Settings did not accurately reflect the SSH remote login status when the system was configured ...

RHEL 9 : buildah (RHSA-2023:7764)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7764 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

Security Updates for Microsoft Dynamics 365 (on-premises) (December 2023)

The Microsoft Dynamics 365 on-premises is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A denial of service DoS vulnerability. An attacker can exploit this issue to cause the affected component to deny system or application services. CVE-2023-35621 - A sessio...

Fedora 38 : libcmis / libreoffice (2023-0d971cd6aa)

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-0d971cd6aa advisory. 7.5.9.2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these...

RHEL 9 : tracker-miners (RHSA-2023:7712)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7712 advisory. Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool. This package contains various miners and...