The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2021:1608 advisory.

  - python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via     timed processing of valid PKCS#1 v1.5 ciphertext. (CVE-2020-25659)

  - In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically     encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the     Fernet class. (CVE-2020-36242)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:2359 advisory.

  - In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases     in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no     longer supported by ISC. From inspection it is clear that the defect is also present in releases from     those series, but they have not been officially tested for the vulnerability), The outcome of encountering     the defect while reading a lease that will trigger it varies, according to: the component being affected     (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler     flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced     the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when     reading an improper lease, which could cause network connectivity problems for an affected system due to     the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd     server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to     the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in     lack of service to clients. Additionally, the offending lease and the lease immediately following it in     the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit     architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not     occur, but it is possible for the offending lease and the lease which immediately followed it to be     improperly deleted. (CVE-2021-25217)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2021:4315 advisory.

  - In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run     system commands without any output or errors. With this, exploits can be injected in a number of     scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd     party .cf files from trusted places. (CVE-2020-1946)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2021:4201 advisory.

  - Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing     serialized Python objects) via directory traversal, leading to code execution. (CVE-2021-42771)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:3075 advisory.

  - Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is     used to convert strings to ASCII. The pointer p is read and increased without checking whether it is     beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information     disclosures or crashes. This function can be triggered via uv_getaddrinfo(). (CVE-2021-22918)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:5393 advisory.

  - In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer     overflow. This could lead to remote code execution if a third party app used this library to process     remote image data with no additional execution privileges needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID:
    A-159625731 (CVE-2020-0452)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2020:4483 advisory.

  - OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in     libopensc/asn1.c. (CVE-2019-15945)

  - OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in     libopensc/asn1.c. (CVE-2019-15946)

  - An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c     has an incorrect read operation during parsing of a SETCOS file attribute. (CVE-2019-19479)

  - An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-cac1.c     mishandles buffer limits for CAC certificates. (CVE-2019-19481)

  - OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in     libopensc/card-coolkey.c lacks a uniqueness check. (CVE-2019-20792)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2021:4404 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:4288 advisory.

  - Libjpeg-turbo all version have a stack-based buffer overflow in the transform component. A remote     attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of     service of the target service. (CVE-2020-17541)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:0558 advisory.

  - A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem     allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate     privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2020-14351)

  - A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw     allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that     relies on UDP source port randomization are indirectly affected as well on the Linux Based Products     (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4,     SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE     W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All     versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7     LTE EU: Version (CVE-2020-25705)

  - A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.
    (CVE-2020-29661)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2021:4181 advisory.

  - Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an     IMAP server's initial server response was invalid. The connection was not properly closed, and the code     could continue attempting to authenticate. This could result in authentication credentials being exposed     on an unencrypted connection, or to a machine-in-the-middle. (CVE-2020-28896)

  - rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox     unavailability) by sending email messages with sequences of semicolon characters in RFC822 address fields     (aka terminators of empty groups). A small email message from the attacker can cause large memory     consumption, and the victim may then be unable to see email messages from other persons. (CVE-2021-3181)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:1989 advisory.

  - In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 ->     9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND     9.17 development branch, when a vulnerable version of named receives a query for a record triggering the     flaw described above, the named process will terminate due to a failed assertion check. The vulnerability     affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other     versions of BIND 9. (CVE-2021-25215)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:4409 advisory.

  - Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent     blinding to address a side-channel attack against mpi_powm, and the window size is not chosen     appropriately. This, for example, affects use of ElGamal in OpenPGP. (CVE-2021-33560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:4387 advisory.

  - libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
    (CVE-2020-16135)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:1616 advisory.

  - Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free     when sending SASL login to the server. (CVE-2019-13045)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2021:1791 advisory.

  - A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the     virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path `/run/spice-     vdagentd/spice-vdagent-sock` could use this flaw to perform a memory denial of service for spice-vdagentd     or even other processes in the VM system. The highest threat from this vulnerability is to system     availability. This flaw affects spice-vdagent versions 0.20 and previous versions. (CVE-2020-25650)

  - A flaw was found in the SPICE file transfer protocol. File data from the host system can end up in full or     in parts in the client connection of an illegitimate local user in the VM system. Active file transfers     from other users could also be interrupted, resulting in a denial of service. The highest threat from this     vulnerability is to data confidentiality as well as system availability. This flaw affects spice-vdagent     versions 0.20 and prior. (CVE-2020-25651)

  - A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that     can be established via the UNIX domain socket in `/run/spice-vdagentd/spice-vdagent-sock`. Any     unprivileged local guest user could use this flaw to prevent legitimate agents from connecting to the     spice-vdagentd daemon, resulting in a denial of service. The highest threat from this vulnerability is to     system availability. This flaw affects spice-vdagent versions 0.20 and prior. (CVE-2020-25652)

  - A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client     connections. This flaw may allow an unprivileged local guest user to become the active agent for spice-     vdagentd, possibly resulting in a denial of service or information leakage from the host. The highest     threat from this vulnerability is to data confidentiality as well as system availability. This flaw     affects spice-vdagent versions 0.20 and prior. (CVE-2020-25653)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:4432 advisory.

  - The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install     command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting     the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
    (CVE-2019-20916)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2020:4453 advisory.

  - In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands     via scripting interfaces (e.g., Python, Ruby, or Lua). (CVE-2019-20807)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4356 advisory.

  - Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor     Graphics may allow an unauthenticated user to potentially enable information disclosure via local access.
    (CVE-2019-14615)

  - In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could     lead to local information disclosure with no additional execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171     (CVE-2020-0427)

  - Improper input validation in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4     and before version 1.4.29.0 for Windows*, may allow an authenticated user to potentially enable a denial     of service via local access. (CVE-2020-24502)

  - Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4     may allow an authenticated user to potentially enable information disclosure via local access.
    (CVE-2020-24503)

  - Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers for Linux before version     1.0.4 may allow an authenticated user to potentially enable denial of service via local access.
    (CVE-2020-24504)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a     network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP,     CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
    (CVE-2020-24586)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary     can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP encryption key is periodically renewed. (CVE-2020-24587)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
    Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an     adversary can abuse this to inject arbitrary network packets. (CVE-2020-24588)

  - An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other     clients even though the sender has not yet successfully authenticated to the AP. This might be abused in     projected Wi-Fi networks to launch denial-of-service attacks against connected clients and makes it easier     to exploit other vulnerabilities in connected clients. (CVE-2020-26139)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and     WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to     inject arbitrary data frames independent of the network configuration. (CVE-2020-26140)

  - An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation     does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can     abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-     confidentiality protocol. (CVE-2020-26141)

  - An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and     WPA3 implementations accept fragmented plaintext frames in a protected Wi-Fi network. An adversary can     abuse this to inject arbitrary data frames independent of the network configuration. (CVE-2020-26143)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042     (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26144)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3     implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process     them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets     independent of the network configuration. (CVE-2020-26145)

  - An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations     reassemble fragments with non-consecutive packet numbers. An adversary can abuse this to exfiltrate     selected fragments. This vulnerability is exploitable when another device sends fragmented frames and the     WEP, CCMP, or GCMP data-confidentiality protocol is used. Note that WEP is vulnerable to this attack by     design. (CVE-2020-26146)

  - An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble     fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject     packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP data-confidentiality protocol is used. (CVE-2020-26147)

  - A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked     down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries     platform) a root like local user could use this flaw to further increase their privileges to that of a     running kernel. (CVE-2020-27777)

  - An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The     copy-on-write implementation can grant unintended write access because of a race condition in a THP     mapcount check, aka CID-c444eb564fb1. (CVE-2020-29368)

  - A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_io.c and drivers/tty/tty_jobctrl.c may allow a read-after-free attack against TIOCGSID,     aka CID-c8bcd9c5be24. (CVE-2020-29660)

  - mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through     5.10.4 might allow remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332.
    (CVE-2020-36158)

  - An issue was discovered in the Linux kernel before 5.8.10. virt/kvm/kvm_main.c has a     kvm_io_bus_unregister_dev memory leak upon a kmalloc failure, aka CID-f65886606c2d. (CVE-2020-36312)

  - An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-     bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf. (CVE-2020-36386)

  - Improper access control in BlueZ may allow an authenticated user to potentially enable information     disclosure via adjacent access. (CVE-2021-0129)

  - nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-     free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a     certain point during device setup, aka CID-b98e762e3d71. (CVE-2021-3348)

  - The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size     was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel     and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee (bpf, ringbuf: Deny     reserve of buffers larger than ringbuf) (v5.13-rc4) and backported to the stable kernels in v5.12.4,     v5.11.21, and v5.10.37. It was introduced via 457f44363a88 (bpf: Implement BPF ring buffer and verifier     support for it) (v5.8-rc1). (CVE-2021-3489)

  - A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. This flaw affects all the Linux kernel versions starting from 3.13. (CVE-2021-3564)

  - A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way     user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev()     together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(),     hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their     privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5. (CVE-2021-3573)

  - A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. A user with     root (CAP_SYS_ADMIN) access is able to panic the system when issuing netfilter netflow commands.
    (CVE-2021-3635)

  - A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was     found in the way user uses trace ring buffer in a specific way. Only privileged local users (with     CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
    (CVE-2021-3679)

  - There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config     params CONFIG_BPF_SYSCALL=y , CONFIG_BPF=y , CONFIG_CGROUPS=y , CONFIG_CGROUP_BPF=y ,     CONFIG_HARDENED_USERCOPY not set, and BPF hook to getsockopt is registered). As result of BPF execution,     the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap     overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly     privileges escalation. (CVE-2021-20194)

  - A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. This flaw allows an     attacker with a local account to leak information about kernel internal addresses. The highest threat from     this vulnerability is to confidentiality. (CVE-2021-20239)

  - A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel     privilege escalation from the context of a network service or an unprivileged process. If     sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock then an element is removed from the     auto_asconf_splist list without any proper locking. This can be exploited by an attacker with network     service privileges to escalate to root or from the context of an unprivileged user directly if a     BPF_CGROUP_INET_SOCK_CREATE is attached which denies creation of some SCTP socket. (CVE-2021-23133)

  - An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A stall on CPU can occur     because a retry loop continually finds the same bad inode, aka CID-775c5033a0d1. (CVE-2021-28950)

  - In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some     Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS     status in a PEBS record is mishandled, aka CID-d88d05a9e0b6. (CVE-2021-28971)

  - An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable     out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre     mitigations and obtain sensitive information from kernel memory. Specifically, for sequences of pointer     arithmetic operations, the pointer modification performed by the first operation is not correctly     accounted for when restricting subsequent operations. (CVE-2021-29155)

  - An issue was discovered in the Linux kernel before 5.11.11. tipc_nl_retrieve_key in net/tipc/node.c does     not properly validate certain data sizes, aka CID-0217ed2848e8. (CVE-2021-29646)

  - An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to     cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h     lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf.
    (CVE-2021-29650)

  - This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel     5.11.15. An attacker must first obtain the ability to execute low-privileged code on the target system in     order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The     issue results from the lack of proper validation of user-supplied eBPF programs prior to executing them.
    An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the     context of the kernel. Was ZDI-CAN-13661. (CVE-2021-31440)

  - kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading     to disclosure of stack content via side-channel attacks, aka CID-801c6058d14a. The specific concern is not     protecting the BPF stack area against speculative loads. Also, the BPF stack can contain uninitialized     data that might represent sensitive information previously operated on by the kernel. (CVE-2021-31829)

  - An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-     device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with     special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or     a leak of internal kernel information. The highest threat from this vulnerability is to system     availability. (CVE-2021-31916)

  - The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because     the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads     to writing an arbitrary value. (CVE-2021-33033)

  - kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic     operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel     memory, leading to local privilege escalation to root. In particular, there is a corner case where the off     reg causes a masking direction change, which then results in an incorrect final aux->alu_limit.
    (CVE-2021-33200)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2021:4158 advisory.

  - An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling     the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute     allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS     code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
    (CVE-2021-28957)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:0711 advisory.

    * QEMU: virtiofsd: potential privileged host device access from guest (CVE-2020-35517)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:4455 advisory.

  - A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote     attacker could possibly use this issue to install a different revision on a repository. The highest threat     from this vulnerability is to data integrity. This is fixed in python-pip version 21.1. (CVE-2021-3572)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:4382 advisory.

  - json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated     by printbuf_memappend. (CVE-2020-12762)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:1880 advisory.

  - A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and     send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A     local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical     interface, change the input method engine, or modify other input related configurations of the victim     user. (CVE-2019-14822)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2020:5480 advisory.

  - Net-SNMP through 5.7.3 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as root. (CVE-2020-15862)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1647 advisory.

  - An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon     Elevation of Privilege Vulnerability'. (CVE-2020-1472)

  - A flaw was found in the way samba handled file and directory permissions. An authenticated user could use     this flaw to gain access to certain file and directory information which otherwise would be unavailable to     the attacker. (CVE-2020-14318)

  - A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before     4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of     service. (CVE-2020-14323)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:4586 advisory.

  - An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It     permits the visual reordering of characters via control sequences, which can be used to craft source code     that renders different logic than the logical ordering of tokens ingested by compilers and interpreters.
    Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted     vulnerabilities are introduced invisibly to human reviewers. (CVE-2021-42574)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2021:1600 advisory.

  - The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in     sc_oberthur_read_file. (CVE-2020-26570)

  - The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow     in sc_pkcs15emu_gemsafeGPK_init. (CVE-2020-26571)

  - The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in     tcos_decipher. (CVE-2020-26572)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:1064 advisory.

    * QEMU: Regression of CVE-2020-10756 fix in virt:rhel/qemu-kvm in AlmaLinux (CVE-2021-20295)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:3548 advisory.

  - A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when     processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested     guest (L2). Due to improper validation of the int_ctl field, this issue could allow a malicious L1 to     enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest     would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak     of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to     5.14-rc7. (CVE-2021-3653)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4251 advisory.

  - In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opj_t1_encode_cblks function     (openjp2/t1.c). Remote attackers could leverage this vulnerability to cause a denial of service via a     crafted bmp file. (CVE-2018-5727)

  - In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the     opj_j2k_setup_encoder function (openjp2/j2k.c). Remote attackers could leverage this vulnerability to     cause a denial of service via a crafted bmp file. (CVE-2018-5785)

  - Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in     openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application     crash). (CVE-2018-20845)

  - An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in     openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow. (CVE-2018-20847)

  - In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c.
    Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
    This issue is similar to CVE-2018-6616. (CVE-2019-12973)

  - jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a     mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free     may also be possible. This is related to calling opj_image_destroy twice. (CVE-2020-15389)

  - A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could     use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of     the user running such an application. (CVE-2020-27814)

  - A flaw was found in OpenJPEG's encoder. This flaw allows an attacker to pass specially crafted x,y offset     input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2020-27823)

  - A flaw was found in OpenJPEG's encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows     an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest     threat from this vulnerability is to system availability. (CVE-2020-27824)

  - There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide     crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of     this flaw is to application availability. (CVE-2020-27842)

  - A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially     crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest     threat from this vulnerability is system availability. (CVE-2020-27843)

  - There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to     provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an out-of-bounds     read. The highest impact of this flaw is to application availability. (CVE-2020-27845)

  - Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of     Service (DoS). This occurs when the attacker uses the command line option -ImgDir on a directory that     contains 1048576 files. (CVE-2021-29338)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:3152 advisory.

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-29457. Reason: This candidate is a     duplicate of CVE-2021-29457. Notes: All CVE users should reference CVE-2021-29457 instead of this     candidate. All references and descriptions in this candidate have been removed to prevent accidental     usage. (CVE-2021-31291)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1887 advisory.

  - An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can     trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages     (and path disclosure). (CVE-2020-24386)

  - Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application     crash via a crafted email message with certain choices for ten thousand MIME parts. (CVE-2020-25275)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:1972 advisory.

  - The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse     certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to     process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has     been fixed in version 0.29.0.gfm.1. (CVE-2020-5238)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:3891 advisory.

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise     Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of     this vulnerability can result in unauthorized access to critical data or complete access to all Java SE,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through     a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). (CVE-2021-35550)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM     Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that     load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3     (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2021-35556)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM     Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2021-35559)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Utility). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM     Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2021-35561)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Keytool). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM     Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2021-35564)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise     Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying     data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted     Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2021-35565)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Libraries). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM     Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows low privileged attacker     with network access via Kerberos to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful     attacks require human interaction from a person other than the attacker and while the vulnerability is in     Java SE, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies     to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 6.8 (Confidentiality     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N). (CVE-2021-35567)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    JSSE). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise     Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying     data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted     Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2021-35578)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    ImageIO). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM     Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2021-35586)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM     Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks     of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service     which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). (CVE-2021-35603)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:4489 advisory.

  - A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the     rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system     availability. (CVE-2021-20266)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4364 advisory.

  - An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU     Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because     sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c. (CVE-2020-35448)

  - There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted     file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system     availability by way of excessive memory consumption. (CVE-2021-3487)

  - There is an open race window when writing output in the following utilities in GNU binutils version 2.35     and earlier:ar, objcopy, strip, ranlib. When these utilities are run as a privileged user (presumably as     part of a script updating binaries across different users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a symlink. (CVE-2021-20197)

  - A flaw was found in GNU Binutils 2.35.1, where there is a heap-based buffer overflow in
    _bfd_elf_slurp_secondary_reloc_section in elf.c due to the number of symbols not calculated correctly. The     highest threat from this vulnerability is to system availability. (CVE-2021-20284)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2021:1686 advisory.

  - In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check.
    This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no     additional execution privileges needed. User interaction is not needed for exploitation.Product:
    AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525 (CVE-2021-0326)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:4568 advisory.

  - A NULL pointer dereference, or possible use-after-free flaw was found in Samba AD LDAP server in versions     before 4.10.17, before 4.11.11 and before 4.12.4. Although some versions of Samba shipped with Red Hat     Enterprise Linux do not support Samba in AD mode, the affected code is shipped with the libldb package.
    This flaw allows an authenticated user to possibly trigger a use-after-free or NULL pointer dereference.
    The highest threat from this vulnerability is to system availability. (CVE-2020-10730)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2019:3705 advisory.

  - get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to     cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in     which one or more of the color indices is out of range for the number of palette entries. (CVE-2018-14498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1852 advisory.

  - A use after free was found in igc_reloc_struct_ptr() of psi/igc.c of ghostscript-9.25. A local attacker     could supply a specially crafted PDF file to cause a denial of service. (CVE-2020-14373)

  - A buffer overflow vulnerability in lprn_is_black() in contrib/lips4/gdevlprn.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is     fixed in v9.51. (CVE-2020-16287)

  - A buffer overflow vulnerability in pj_common_print_page() in devices/gdevpjet.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is     fixed in v9.51. (CVE-2020-16288)

  - A buffer overflow vulnerability in cif_print_page() in devices/gdevcif.c of Artifex Software GhostScript     v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in     v9.51. (CVE-2020-16289)

  - A buffer overflow vulnerability in jetp3852_print_page() in devices/gdev3852.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is     fixed in v9.51. (CVE-2020-16290)

  - A buffer overflow vulnerability in contrib/gdevdj9.c of Artifex Software GhostScript v9.50 allows a remote     attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51. (CVE-2020-16291)

  - A buffer overflow vulnerability in mj_raster_cmd() in contrib/japanese/gdevmjc.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is     fixed in v9.51. (CVE-2020-16292)

  - A null pointer dereference vulnerability in compose_group_nonknockout_nonblend_isolated_allmask_common()     in base/gxblend.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of     service via a crafted PDF file. This is fixed in v9.51. (CVE-2020-16293)

  - A buffer overflow vulnerability in epsc_print_page() in devices/gdevepsc.c of Artifex Software GhostScript     v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in     v9.51. (CVE-2020-16294)

  - A null pointer dereference vulnerability in clj_media_size() in devices/gdevclj.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is     fixed in v9.51. (CVE-2020-16295)

  - A buffer overflow vulnerability in GetNumWrongData() in contrib/lips4/gdevlips.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is     fixed in v9.51. (CVE-2020-16296)

  - A buffer overflow vulnerability in FloydSteinbergDitheringC() in contrib/gdevbjca.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is     fixed in v9.51. (CVE-2020-16297)

  - A buffer overflow vulnerability in mj_color_correct() in contrib/japanese/gdevmjc.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is     fixed in v9.51. (CVE-2020-16298)

  - A Division by Zero vulnerability in bj10v_print_page() in contrib/japanese/gdev10v.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is     fixed in v9.51. (CVE-2020-16299)

  - A buffer overflow vulnerability in tiff12_print_page() in devices/gdevtfnx.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is     fixed in v9.51. (CVE-2020-16300)

  - A buffer overflow vulnerability in okiibm_print_page1() in devices/gdevokii.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is     fixed in v9.51. (CVE-2020-16301)

  - A buffer overflow vulnerability in jetp3852_print_page() in devices/gdev3852.c of Artifex Software     GhostScript v9.50 allows a remote attacker to escalate privileges via a crafted PDF file. This is fixed in     v9.51. (CVE-2020-16302)

  - A use-after-free vulnerability in xps_finish_image_path() in devices/vector/gdevxps.c of Artifex Software     GhostScript v9.50 allows a remote attacker to escalate privileges via a crafted PDF file. This is fixed in     v9.51. (CVE-2020-16303)

  - A buffer overflow vulnerability in image_render_color_thresh() in base/gxicolor.c of Artifex Software     GhostScript v9.50 allows a remote attacker to escalate privileges via a crafted eps file. This is fixed in     v9.51. (CVE-2020-16304)

  - A buffer overflow vulnerability in pcx_write_rle() in contrib/japanese/gdev10v.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is     fixed in v9.51. (CVE-2020-16305)

  - A null pointer dereference vulnerability in devices/gdevtsep.c of Artifex Software GhostScript v9.50     allows a remote attacker to cause a denial of service via a crafted postscript file. This is fixed in     v9.51. (CVE-2020-16306)

  - A null pointer dereference vulnerability in devices/vector/gdevtxtw.c and psi/zbfont.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted postscript file.
    This is fixed in v9.51. (CVE-2020-16307)

  - A buffer overflow vulnerability in p_print_image() in devices/gdevcdj.c of Artifex Software GhostScript     v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in     v9.51. (CVE-2020-16308)

  - A buffer overflow vulnerability in lxm5700m_print_page() in devices/gdevlxm.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted eps file. This is     fixed in v9.51. (CVE-2020-16309)

  - A division by zero vulnerability in dot24_print_page() in devices/gdevdm24.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is     fixed in v9.51. (CVE-2020-16310)

  - A buffer overflow vulnerability in GetNumSameData() in contrib/lips4/gdevlips.c of Artifex Software     GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is     fixed in v9.51. (CVE-2020-17538)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:4537 advisory.

    * httpd: Regression of CVE-2021-40438 and CVE-2021-26691 fixes in AlmaLinux (CVE-2021-20325)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:2570 advisory.

  - The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database     (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c.
    (CVE-2020-26541)

  - In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an     hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value. (CVE-2021-33034)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:4408 advisory.

  - Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp,     const char *testcase, Queue *job, char **resultp, int *resultflagsp function at src/testcase.c: line 2334,     which could cause a denial of service (CVE-2021-3200)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:3576 advisory.

  - ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before     1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon     crash. This occurs because a return value is not properly managed in a certain situation. (CVE-2021-36222)

  - The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has     a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.
    (CVE-2021-37750)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1968 advisory.

  - In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application     because of missing validation of a sqlite_stat1 sz field, aka a severe division by zero in the query     planner. (CVE-2019-16168)

  - SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. (CVE-2020-13434)

  - ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet     feature. (CVE-2020-13630)

  - SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related     to alter.c and build.c. (CVE-2020-13631)

  - ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo()     query. (CVE-2020-13632)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2021:4413 advisory.

  - A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key     for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key     being imported. The highest threat from this vulnerability is to data confidentiality. (CVE-2021-3565)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
157515	AlmaLinux 8 : python-cryptography (ALSA-2021:1608)	critical
157514	AlmaLinux 8 : dhcp (ALSA-2021:2359)	high
157513	AlmaLinux 8 : spamassassin (ALSA-2021:4315)	critical
157512	AlmaLinux 8 : babel (ALSA-2021:4201)	high
157511	AlmaLinux 8 : libuv (ALSA-2021:3075)	medium
157510	AlmaLinux 8 : libexif (ALSA-2020:5393)	critical
157509	AlmaLinux 8 : opensc (ALSA-2020:4483)	medium
157508	AlmaLinux 8 : kexec-tools (ALSA-2021:4404)	medium
157507	AlmaLinux 8 : libjpeg-turbo (ALSA-2021:4288)	high
157506	AlmaLinux 8 : kernel (ALSA-2021:0558)	high
157505	AlmaLinux 8 : mutt (ALSA-2021:4181)	medium
157504	AlmaLinux 8 : bind (ALSA-2021:1989)	high
157503	AlmaLinux 8 : libgcrypt (ALSA-2021:4409)	high
157502	AlmaLinux 8 : libssh (ALSA-2021:4387)	medium
157501	AlmaLinux 8 : irssi (ALSA-2020:1616)	high
157500	AlmaLinux 8 : spice-vdagent (ALSA-2021:1791)	medium
157499	AlmaLinux 8 : python-pip (ALSA-2020:4432)	high
157498	AlmaLinux 8 : vim (ALSA-2020:4453)	medium
157497	AlmaLinux 8 : kernel (ALSA-2021:4356)	high
157496	AlmaLinux 8 : python-lxml (ALSA-2021:4158)	medium
157495	AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2021:0711)	high
157494	AlmaLinux 8 : python-pip (ALSA-2021:4455)	medium
157493	AlmaLinux 8 : json-c (ALSA-2021:4382)	high
157492	AlmaLinux 8 : ibus and glib2 (ALSA-2020:1880)	high
157491	AlmaLinux 8 : net-snmp (ALSA-2020:5480)	high
157490	AlmaLinux 8 : samba (ALSA-2021:1647)	medium
157489	AlmaLinux 8 : gcc-toolset-11-gcc (ALSA-2021:4586)	high
157488	AlmaLinux 8 : opensc (ALSA-2021:1600)	medium
157487	AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2021:1064)	medium
157486	AlmaLinux 8 : kernel (ALSA-2021:3548)	high
157485	AlmaLinux 8 : openjpeg2 (ALSA-2021:4251)	high
157484	AlmaLinux 8 : exiv2 (ALSA-2021:3152)	critical
157483	AlmaLinux 8 : dovecot (ALSA-2021:1887)	medium
157482	AlmaLinux 8 : pandoc (ALSA-2021:1972)	medium
157481	AlmaLinux 8 : java-11-openjdk (ALSA-2021:3891)	medium
157480	AlmaLinux 8 : rpm (ALSA-2021:4489)	medium
157479	AlmaLinux 8 : binutils (ALSA-2021:4364)	medium
157478	AlmaLinux 8 : wpa_supplicant (ALSA-2021:1686)	high
157477	AlmaLinux 8 : libldb (ALSA-2020:4568)	medium
157476	AlmaLinux 8 : libjpeg-turbo (ALSA-2019:3705)	medium
157475	AlmaLinux 8 : ghostscript (ALSA-2021:1852)	high
157474	AlmaLinux 8 : httpd:2.4 (ALSA-2021:4537)	critical
157473	AlmaLinux 8 : kernel (ALSA-2021:2570)	high
157472	AlmaLinux 8 : libsolv (ALSA-2021:4408)	low
157471	AlmaLinux 8 : krb5 (ALSA-2021:3576)	high
157470	AlmaLinux 8 : mingw packages (ALSA-2021:1968)	high
157469	AlmaLinux 8 : tpm2-tools (ALSA-2021:4413)	medium

Detections

Analytics

Alma Linux Local Security Checks Family for Nessus

critical

high

critical

high

medium

critical

medium

medium

high

high

medium

high

high

medium

high

medium

high

medium

high

medium

high

medium

high

high

high

medium

high

medium

medium

high

high

critical

medium

medium

medium

medium

medium

high

medium

medium

high

critical

high

low

high

high

medium