SUSE SLES15 Security Update : kernel (Live Patch 1 for SLE 15 SP5) (SUSE-SU-2024:2488-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2488-1 advisory. This update for the Linux Kernel 5.14.21-150500557 fixes several issues. The following security issues were fixed: - CVE-2024-26923: Fixed...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : GTK vulnerability (USN-6899-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6899-1 advisory. It was discovered that GTK would attempt to load modules from the current directory, contrary to expectations. If users started GTK...

EulerOS 2.0 SP9 : sudo (EulerOS-SA-2024-1973)

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Sudo before 1.9.13 does not escape control characters in log messages.CVE-2023-28486 Sudo before 1.9.13 does not escape control characters in...

SUSE SLED15: libpython3_6m1_0 / libpython3_6m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2024:2479-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2479-1 advisory. - CVE-2023-52425: Fixed backport so it uses features sniffing, not just comparing version number...

CVE-2024-3232: Improper Neutralization of Formula Elements in a CSV File

A formula injection vulnerability exists in Tenable Identity Exposure where an authenticated remote attacker with administrative privileges could manipulate application form fields in order to trick another administrator into executing CSV payloads. - CVE-2024-3232...

EulerOS 2.0 SP9 : less (EulerOS-SA-2024-1938)

According to the versions of the less package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE.CVE-2022-48624 less through 653 allows OS command execution via a...

EulerOS 2.0 SP9 : libtiff (EulerOS-SA-2024-1966)

According to the versions of the libtiff package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libtiff 4.5.0 is vulnerable to Buffer Overflow in uvencode when libtiff reads a corrupted little-endian TIFF file and specifies the output to be...

SUSE SLES15 Security Update : kernel (Live Patch 0 for SLE 15 SP5) (SUSE-SU-2024:2487-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2487-1 advisory. This update for the Linux Kernel 5.14.21-15050053 fixes several issues. The following security issues were fixed: - CVE-2024-26923: Fixed...

SUSE SLES15 Security Update : kernel (Live Patch 14 for SLE 15 SP5) (SUSE-SU-2024:2480-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2480-1 advisory. This update for the Linux Kernel 5.14.21-1505005565 fixes several issues. The following security issues were fixed: - CVE-2024-26923: Fixed...

EulerOS 2.0 SP9 : systemd (EulerOS-SA-2024-1974)

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The Closest Encloser Proof aspect of the DNS protocol in RFC 5155 when RFC 9276 guidance is skipped allows remote attackers to cause a denial of...

EulerOS 2.0 SP9 : golang (EulerOS-SA-2024-1934)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward...

EulerOS 2.0 SP9 : dnsmasq (EulerOS-SA-2024-1927)

According to the versions of the dnsmasq package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The Closest Encloser Proof aspect of the DNS protocol in RFC 5155 when RFC 9276 guidance is skipped allows remote attackers to cause a denial of...

EulerOS 2.0 SP10 : nghttp2 (EulerOS-SA-2024-1916)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the...

EulerOS 2.0 SP10 : expat (EulerOS-SA-2024-1905)

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libexpat through 2.5.0 allows a denial of service resource consumption because many full reparsings are required in the case of a large token for...

EulerOS 2.0 SP10 : llvm (EulerOS-SA-2024-1914)

According to the versions of the llvm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata function via a crafted pdflatex.fmt file or perhaps a crafted .o file to llvm-lto...

EulerOS 2.0 SP10 : httpd (EulerOS-SA-2024-1886)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.CVE-2023-38709 HTT...

EulerOS 2.0 SP10 : mod_http2 (EulerOS-SA-2024-1891)

According to the versions of the modhttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a clien...

Rocky Linux 9 : golang (RLSA-2024:4212)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:4212 advisory. golang: archive/zip: Incorrect handling of certain ZIP files CVE-2024-24789 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6...

EulerOS 2.0 SP10 : gnutls (EulerOS-SA-2024-1884)

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leadi...

EulerOS 2.0 SP10 : python-idna (EulerOS-SA-2024-1918)

According to the versions of the python-idna package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was identified in the kjd/idna library, specifically within the idna.encode function, affecting version 3.6. The issue arises...