Photon OS 4.0: Dhcp PHSA-2022-4.0-0259

An update of the dhcp package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2022-4.0-0259. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Nova vulnerability (USN-6911-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6911-1 advisory. Arnaud Morin discovered that Nova incorrectly handled certain raw format images. An authenticated user could use this issue to access...

Amazon Linux 2 : ecs-init, --advisory ALAS2ECS-2024-039 (ALASECS-2024-039)

The version of ecs-init installed on the remote host is prior to 1.84.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-039 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-046)

The version of kernel installed on the remote host is prior to 5.15.162-107.160. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-046 advisory. 2024-08-27: CVE-2024-42096 was added to this advisory. 2024-08-27: CVE-2024-42070 was added to this...

Oracle Linux 8 : httpd:2.4 (ELSA-2024-4720)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4720 advisory. - Resolves: RHEL-45812 - httpd:2.4/httpd: Substitution encoding issue in modrewrite CVE-2024-38474 - Resolves: RHEL-45785 - httpd:2.4/httpd: Encoding...

RHEL 8 : nghttp2 (RHSA-2024:4732)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4732 advisory. libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: CONTINUATION frames DoS...

Siemens SIMATIC and SCALANCE Products Inadequate Encryption Strength (CVE-2023-0465)

Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : Rack vulnerabilities (USN-6905-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6905-1 advisory. It was discovered that Rack incorrectly handled certain regular expressions. A remote attacker could...

SUSE SLED15: gnome-extensions / gnome-shell / gnome-shell-calendar / etc (SUSE-SU-2024:2576-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2576-1 advisory. - CVE-2024-36472: Fixed portal helper automatically launched without user confirmation bsc122556...

Siemens SIMATIC and SCALANCE Products Inadequate Encryption Strength (CVE-2023-0464)

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-075)

The version of kernel installed on the remote host is prior to 5.4.278-191.377. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2024-075 advisory. In the Linux kernel, the following vulnerability has been resolved: net: fix dstnegativeadvice race CVE-2024-36971...

Fedora 40 : ghostscript (2024-053b8330a1)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-053b8330a1 advisory. Security fix for CVE-2024-33869 ---- Security fixes for CVE-2024-29509, CVE-2024-29508, CVE-2024-29507, CVE-2024-29506 Tenable has extracted the...

EulerOS 2.0 SP8 : systemd (EulerOS-SA-2024-2061)

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they ha...

Slackware Linux 15.0 mozilla-thunderbird Multiple Vulnerabilities (SSA:2024-205-03)

The version of mozilla-thunderbird installed on the remote host is prior to 115.13.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-205-03 advisory. New mozilla-thunderbird packages are available for Slackware 15.0 to fix security issues. Tenable has extract...

Slackware Linux 15.0 / current aaa_glibc-solibs Multiple Vulnerabilities (SSA:2024-205-02)

The version of aaaglibc-solibs installed on the remote host is prior to 2.33 / 2.40. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-205-02 advisory. New glibc packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted...

RHEL 9 : python3 (RHSA-2024:4779)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4779 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...

Photon OS 1.0: Apache PHSA-2016-0011

An update of the apache package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2016-0011. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid203069...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-038)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.29.6.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ECS-2024-038 advisory. dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context du...

Amazon Linux 2 : nano (ALAS-2024-2590)

The version of nano installed on the remote host is prior to 2.9.8-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2590 advisory. nano: running chmod and chown on the filename allows malicious user to replace the emergency file with a malicious symlink to a...

Amazon Linux 2 : libreswan (ALAS-2024-2596)

The version of libreswan installed on the remote host is prior to 3.25-4.8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2596 advisory. The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. Wh...