The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0114 advisory.

  - A use-after-free exists in Python through 3.9 via heappushpop in heapq. (CVE-2022-48560)

  - read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM     exhaustion when processing malformed Apple Property List files in binary format. (CVE-2022-48564)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0113 advisory.

  - An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU     component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local     attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
    (CVE-2022-36402)

  - A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address     prediction. This may result in speculative execution at an attacker-controlled address, potentially     leading to information disclosure. (CVE-2023-20569)

  - A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
    (CVE-2023-2162)

  - An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro     could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to     arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash     the system or potentially escalate their privileges on the system. (CVE-2023-42753)

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-     after-free flaw in the way memory objects were handled when they were being used to store a surface. When     running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially     use this flaw to escalate their privileges. (CVE-2023-5633)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0134 advisory.

  - An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU     component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local     attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
    (CVE-2022-36402)

  - A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address     prediction. This may result in speculative execution at an attacker-controlled address, potentially     leading to information disclosure. (CVE-2023-20569)

  - A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in     SCSI sub-component in the Linux Kernel. In this flaw an attacker could leak kernel internal information.
    (CVE-2023-2162)

  - An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro     could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to     arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash     the system or potentially escalate their privileges on the system. (CVE-2023-42753)

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-     after-free flaw in the way memory objects were handled when they were being used to store a surface. When     running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially     use this flaw to escalate their privileges. (CVE-2023-5633)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0130 advisory.

  - bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a flowspec     overflow. (CVE-2023-38406)

  - bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during     labeled unicast parsing. (CVE-2023-38407)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP     UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path     attributes). (CVE-2023-47234)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE     message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw     outcome. (CVE-2023-47235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0121 advisory.

  - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

  - Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could     cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics.
    After fix, Reader.Read limits the maximum size of header blocks to 1 MiB. (CVE-2022-2879)

  - Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including     unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy     forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in     the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director     function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse     query parameters continue to forward the original query parameters unchanged. (CVE-2022-2880)

  - Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion     or denial of service. The parsed regexp representation is linear in the size of the input, but in some     cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger     amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular     expressions whose representation would use more space than that are rejected. Normal use of regular     expressions is unaffected. (CVE-2022-41715)

  - Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time     verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <=     8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in     circulation with keys larger than this, and all three appear to be test certificates that are not actively     deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so     causing breakage here in the interests of increasing the default safety of users of crypto/tls seems     reasonable. (CVE-2023-29409)

  - The html/template package does not properly handle HTML-like  comment tokens, nor hashbang #! comment     tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of     <script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS     attack. (CVE-2023-39318)

  - The html/template package does not apply the proper rules for handling occurrences of <script, <!--,     and </script within JS literals in <script> contexts. This may cause the template parser to improperly     consider script contexts to be terminated early, causing actions to be improperly escaped. This could be     leveraged to perform an XSS attack. (CVE-2023-39319)

  - Processing an incomplete post-handshake message for a QUIC connection can cause a panic. (CVE-2023-39321)

  - QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake     messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now     consistently reject messages larger than 65KiB in size. (CVE-2023-39322)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:0135 advisory.

  - A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in     QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a     denial of service. (CVE-2023-3019)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:0128 advisory.

  - A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect     calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function     in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible     escalation of privileges or denial of service. (CVE-2023-5367)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:0116 advisory.

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP     request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method     changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs.
    Although this behavior is not specified in the section for redirects, it can be inferred by piecing     together information from different sections and we have observed the behavior in other major HTTP client     implementations like curl and web browsers. Because the vulnerability requires a previously trusted     service to become compromised in order to have an impact on confidentiality we believe the exploitability     of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request     bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions     must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information     in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts     redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised.
    This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve     this issue. Users unable to update should disable redirects for services that aren't expecting to respond     with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle     301, 302, and 303 redirects manually by stripping the HTTP request body. (CVE-2023-45803)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:0105 advisory.

  - It was discovered that the numerical library used in NSS for RSA cryptography leaks information whether     high order bits of the RSA decryption result are zero. This information can be used to mount a     Bleichenbacher or Manger like attack against all RSA decryption operations. As the leak happens before any     padding operations, it affects all padding modes: PKCS#1 v1.5, OAEP, and RSASVP. Both API level calls and     TLS server operation are affected. (CVE-2023-5388) (CVE-2023-5388)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0400 advisory.

  - hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 (CVE-2021-26401)

  - A flaw was found in the Linux kernel's driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet     Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.
    (CVE-2022-2964)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6886 advisory.

  - Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory     with a unified `Archiver`/`UnArchiver` API. Prior to version 4.8.0, using AbstractUnArchiver for     extracting an archive might lead to an arbitrary file creation and possibly remote code execution. When     extracting an archive with an entry that already exists in the destination directory as a symbolic link     whose target does not exist - the `resolveFile()` function will return the symlink's source instead of its     target, which will pass the verification that ensures the file will not be extracted outside of the     destination directory. Later `Files.newOutputStream()`, that follows symlinks by default, will actually     write the entry's content to the symlink's target. Whoever uses plexus archiver to extract an untrusted     archive is vulnerable to an arbitrary file creation and possibly remote code execution. Version 4.8.0     contains a patch for this issue. (CVE-2023-37460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4821 advisory.

  - An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to     potentially access sensitive information. (CVE-2023-20593)

  - An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7.
    It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets.
    This may result in denial of service or privilege escalation. (CVE-2023-35788)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0009 advisory.

  - A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to     a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or     possible remote code execution in cases where X11 forwarding is involved. (CVE-2023-6377)

  - A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or     RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive     information. (CVE-2023-6478)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7424 advisory.

  - Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to     achieve local privilege escalation. When route4_change() is called on an existing filter, the whole     tcf_result struct is always copied into the new instance of the filter. This causes a problem when     updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the     success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading     to a use-after-free. We recommend upgrading past commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8.
    (CVE-2023-4206)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result     struct is always copied into the new instance of the filter. This causes a problem when updating a filter     bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path,     decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-     free. We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec. (CVE-2023-4207)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. When u32_change() is called on an existing filter, the whole     tcf_result struct is always copied into the new instance of the filter. This causes a problem when     updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the     success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading     to a use-after-free. We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.
    (CVE-2023-4208)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1988 advisory.

  - drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-     space client to corrupt the monitor's internal memory. (CVE-2022-43750)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0013 advisory.

  - MXF demuxer use-after-free vulnerability [fedora-all] (CVE-2023-44446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:4461 advisory.

  - Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image     data from another site in violation of same-origin policy. This vulnerability affects Firefox < 116,     Firefox ESR < 102.14, and Firefox ESR < 115.1. (CVE-2023-4045)

  - In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This     resulted in incorrect compilation and a potentially exploitable crash in the content process. This     vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. (CVE-2023-4046)

  - A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user     into granting permissions. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR     < 115.1. (CVE-2023-4047)

  - An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low     memory situations. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR <     115.1. (CVE-2023-4048)

  - Race conditions in reference counting code were found through code inspection. These could have resulted     in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116,     Firefox ESR < 102.14, and Firefox ESR < 115.1. (CVE-2023-4049)

  - In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This     resulted in a potentially exploitable crash which could have led to a sandbox escape. This vulnerability     affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. (CVE-2023-4050)

  - When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the     host was no longer consistent with expected cookie jar state. This could have caused requests to be sent     with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR     < 115.1. (CVE-2023-4055)

  - Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and     Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects     Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. (CVE-2023-4056)

  - Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and     Thunderbird < 115.1. (CVE-2023-4057)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7428 advisory.

  - A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect     calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function     in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible     escalation of privileges or denial of service. (CVE-2023-5367)

  - A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and     legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if     the pointer is warped from within a window on one screen to the root window of the other screen and if the     original window is destroyed followed by another window being destroyed. (CVE-2023-5380)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1593 advisory.

  - Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request     Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of     RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied     request-target (URL) data and is then re-inserted into the proxied request-target using variable     substitution. For example, something like: RewriteEngine on RewriteRule ^/here/(.*)     http://example.com:8080/elsewhere?$1; [P] ProxyPassReverse /here/ http://example.com:8080/ Request     splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended     URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version     2.4.56 of Apache HTTP Server. (CVE-2023-25690)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5621 advisory.

  - In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled. (CVE-2023-32233)

  - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5461 advisory.

  - An issue was discovered with ImageMagick 7.1.0-4 via Division by zero in function ReadEnhMetaFile of     coders/emf.c. (CVE-2021-40211)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5616 advisory.

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4150 advisory.

  - A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the     function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The     manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated     identifier of this vulnerability is VDB-211087. (CVE-2022-3564)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0006 advisory.

  - A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to     a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or     possible remote code execution in cases where X11 forwarding is involved. (CVE-2023-6377)

  - A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or     RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive     information. (CVE-2023-6478)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:4495 advisory.

  - Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could     be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of     Thunderbird will strip the character and show the correct file extension. This vulnerability affects     Thunderbird < 115.0.1 and Thunderbird < 102.13.1. (CVE-2023-3417)

  - Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image     data from another site in violation of same-origin policy. This vulnerability affects Firefox < 116,     Firefox ESR < 102.14, and Firefox ESR < 115.1. (CVE-2023-4045)

  - In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This     resulted in incorrect compilation and a potentially exploitable crash in the content process. This     vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. (CVE-2023-4046)

  - A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user     into granting permissions. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR     < 115.1. (CVE-2023-4047)

  - An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low     memory situations. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR <     115.1. (CVE-2023-4048)

  - Race conditions in reference counting code were found through code inspection. These could have resulted     in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116,     Firefox ESR < 102.14, and Firefox ESR < 115.1. (CVE-2023-4049)

  - In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This     resulted in a potentially exploitable crash which could have led to a sandbox escape. This vulnerability     affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. (CVE-2023-4050)

  - When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the     host was no longer consistent with expected cookie jar state. This could have caused requests to be sent     with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR     < 115.1. (CVE-2023-4055)

  - Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and     Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects     Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. (CVE-2023-4056)

  - Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 115.1, and     Thunderbird < 115.1. (CVE-2023-4057)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1092 advisory.

  - mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
    (CVE-2022-42703)

  - A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain     kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their     privileges on the system. (CVE-2022-4378)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:7790 advisory.

  - A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through     missing overflow checks during SQL array value modification. This issue exists due to an integer overflow     during array modification where a remote user can trigger the overflow by providing specially crafted     data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary     bytes to memory and extensively read the server's memory. (CVE-2023-5869)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:7884 advisory.

  - IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@,     @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ). If an     administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with     database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. (CVE-2023-39417)

  - A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows     against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some     rows that INSERT policies do not forbid, a user could store such rows. (CVE-2023-39418)

  - A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive     information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling     'unknown'-type values from string literals without type designation can disclose bytes, potentially     revealing notable and confidential information. This issue exists due to excessive data output in     aggregate function calls, enabling remote users to read some portion of system memory. (CVE-2023-5868)

  - A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through     missing overflow checks during SQL array value modification. This issue exists due to an integer overflow     during array modification where a remote user can trigger the overflow by providing specially crafted     data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary     bytes to memory and extensively read the server's memory. (CVE-2023-5869)

  - A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers,     including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful     exploitation requires a non-core extension with a less-resilient background worker and would affect that     specific background worker only. This issue may allow a remote high privileged user to launch a denial of     service (DoS) attack. (CVE-2023-5870)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:7876 advisory.

  - A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated     by one process, it can perform cryptographic operations in other processes when an empty zero-length pin     is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small,     permanently connected tokens to computers. Additionally, the token can internally track login status. This     flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system     without the user's awareness. (CVE-2023-40660)

  - Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card     enrollment process using pkcs15-init when a user or administrator enrolls cards. To take advantage of     these flaws, an attacker must have physical access to the computer system and employ a custom-crafted USB     device or smart card to manipulate responses to APDUs. This manipulation can potentially allow compromise     key generation, certificate loading, and other card management operations during enrollment.
    (CVE-2023-40661)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:7841 advisory.

  - MXF demuxer use-after-free vulnerability [fedora-all] (CVE-2023-44446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0046 advisory.

  - Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions     3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of     Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial     of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a     server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version     6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch     archives. Those who you use a prepackaged version of Squid should refer to the package vendor for     availability information on updated packages. (CVE-2023-46724)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer     dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The     gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this     bug are possible to be received from any gopher server, even those without malicious intent. Gopher     support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade     should reject all gopher URL requests. (CVE-2023-46728)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug     Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed     by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2023-49285)

  - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of     Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process     management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known     workarounds for this vulnerability. (CVE-2023-49286)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0018 advisory.

  - A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to     a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or     possible remote code execution in cases where X11 forwarding is involved. (CVE-2023-6377)

  - A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or     RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive     information. (CVE-2023-6478)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:7877 advisory.

  - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary:
    Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key     or DH parameters may experience long delays. Where the key or parameters that are being checked have been     obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs     various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too     large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is     over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or     parameters that have been supplied. Some of those checks use the supplied modulus value even if it has     already been found to be too large. An application that calls DH_check() and supplies a key or parameters     obtained from an untrusted source could be vulernable to a Denial of Service attack. The function     DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those     other functions may similarly be affected. The other functions affected by this are DH_check_ex() and     EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications     when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The     OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. (CVE-2023-3446)

  - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary:
    Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key     or DH parameters may experience long delays. Where the key or parameters that are being checked have been     obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs     various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter     value can also trigger an overly long computation during some of these checks. A correct q value, if     present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if     q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an     untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself     called by a number of other OpenSSL functions. An application calling any of those other functions may     similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check().
    Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the -check     option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS     providers are not affected by this issue. (CVE-2023-3817)

  - Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or     parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to     generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(),     DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may     experience long delays. Where the key or parameters that are being checked have been obtained from an     untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks     (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable     for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an     excessively large P, it doesn't check for an excessively large Q. An application that calls     DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source     could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also     called by a number of other OpenSSL functions. An application calling any of those other functions may     similarly be affected. The other functions affected by this are DH_check_pub_key_ex(),     EVP_PKEY_public_check(), and EVP_PKEY_generate(). Also vulnerable are the OpenSSL pkey command line     application when using the -pubcheck option, as well as the OpenSSL genpkey command line application.
    The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers     are not affected by this issue. (CVE-2023-5678)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:7716 advisory.

  - A memory corruption vulnerability was addressed with improved locking. (CVE-2023-42917)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:7732 advisory.

  - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted     file to execute code outside the sandbox if the tracker-extract process has first been compromised by a     separate vulnerability. (CVE-2023-5557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:7836 advisory.

  - A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the     client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing     a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the     availability of the avahi service, which becomes unresponsive after this flaw is triggered.
    (CVE-2021-3468)

  - A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
    (CVE-2023-38469)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
    (CVE-2023-38470)

  - A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
    (CVE-2023-38471)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
    (CVE-2023-38472)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name()     function. (CVE-2023-38473)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:7714 advisory.

  - IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@,     @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ). If an     administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with     database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. (CVE-2023-39417)

  - A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive     information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling     'unknown'-type values from string literals without type designation can disclose bytes, potentially     revealing notable and confidential information. This issue exists due to excessive data output in     aggregate function calls, enabling remote users to read some portion of system memory. (CVE-2023-5868)

  - A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through     missing overflow checks during SQL array value modification. This issue exists due to an integer overflow     during array modification where a remote user can trigger the overflow by providing specially crafted     data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary     bytes to memory and extensively read the server's memory. (CVE-2023-5869)

  - A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers,     including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful     exploitation requires a non-core extension with a less-resilient background worker and would affect that     specific background worker only. This issue may allow a remote high privileged user to launch a denial of     service (DoS) attack. (CVE-2023-5870)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0026 advisory.

  - The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems     with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox     escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
    (CVE-2023-6856)

  - When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller     than necessary. *This bug only affects Firefox on Unix-based operating systems (Android, Linux, MacOS).
    Windows is unaffected.* This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox <     121. (CVE-2023-6857)

  - Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling.
    This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. (CVE-2023-6858)

  - A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability     affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. (CVE-2023-6859)

  - The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be     abused to escape the sandbox. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and     Firefox < 121. (CVE-2023-6860)

  - The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless     mode. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
    (CVE-2023-6861)

  - A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during     start-up. This vulnerability affects Firefox ESR < 115.6 and Thunderbird < 115.6. (CVE-2023-6862)

  - The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a     dynamic type that lacked a virtual destructor. This vulnerability affects Firefox ESR < 115.6, Thunderbird     < 115.6, and Firefox < 121. (CVE-2023-6863)

  - Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and     Firefox < 121. (CVE-2023-6864)

  - `EncryptingOutputStream` was susceptible to exposing uninitialized data. This issue could only be abused     in order to write data to a local disk which may have implications for private browsing mode. This     vulnerability affects Firefox ESR < 115.6 and Firefox < 121. (CVE-2023-6865)

  - The timing of a button click causing a popup to disappear was approximately the same length as the anti-     clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring     them to click where the permission grant button would be about to appear. This vulnerability affects     Firefox ESR < 115.6 and Firefox < 121. (CVE-2023-6867)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0027 advisory.

  - The signature of a digitally signed S/MIME email message may optionally specify the signature creation     date and time. If present, Thunderbird did not compare the signature creation date with the message date     and time, and displayed a valid signature despite a date or time mismatch. This could be used to give     recipients the impression that a message was sent at a different date or time. This vulnerability affects     Thunderbird < 115.6. (CVE-2023-50761)

  - When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text     was never shown to the user. This is because the text was interpreted as a MIME message and the first     paragraph was always treated as an email header section. A digitally signed text from a different context,     such as a signed GIT commit, could be used to spoof an email message. This vulnerability affects     Thunderbird < 115.6. (CVE-2023-50762)

  - The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems     with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox     escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
    (CVE-2023-6856)

  - When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller     than necessary. *This bug only affects Firefox on Unix-based operating systems (Android, Linux, MacOS).
    Windows is unaffected.* This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox <     121. (CVE-2023-6857)

  - Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling.
    This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. (CVE-2023-6858)

  - A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability     affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. (CVE-2023-6859)

  - The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be     abused to escape the sandbox. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and     Firefox < 121. (CVE-2023-6860)

  - The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless     mode. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.
    (CVE-2023-6861)

  - A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during     start-up. This vulnerability affects Firefox ESR < 115.6 and Thunderbird < 115.6. (CVE-2023-6862)

  - The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a     dynamic type that lacked a virtual destructor. This vulnerability affects Firefox ESR < 115.6, Thunderbird     < 115.6, and Firefox < 121. (CVE-2023-6863)

  - Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and     Firefox < 121. (CVE-2023-6864)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4166 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371,     8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle     GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise     Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read     access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible     data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a     web service which supplies data to the APIs. This vulnerability also applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. (CVE-2023-22045)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of     Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u371,     8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle     GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise     Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle     GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. (CVE-2023-22049)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5622 advisory.

  - In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests     can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users     can obtain root privileges. This occurs because anonymous sets are mishandled. (CVE-2023-32233)

  - Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register     contents when CAP_NET_ADMIN is in any user or network namespace (CVE-2023-35001)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return     an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
    (CVE-2023-3609)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6162 advisory.

  - VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. (CVE-2023-44488)

  - It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by     the user due to an insufficient activation-delay. This vulnerability affects Firefox < 119, Firefox ESR <     115.4, and Thunderbird < 115.4.1. (CVE-2023-5721)

  - Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led     to a crash. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.
    (CVE-2023-5724)

  - A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be     leveraged to collect sensitive user data. This vulnerability affects Firefox < 119, Firefox ESR < 115.4,     and Thunderbird < 115.4.1. (CVE-2023-5725)

  - During garbage collection extra operations were performed on a object that should not be. This could have     led to a potentially exploitable crash. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and     Thunderbird < 115.4.1. (CVE-2023-5728)

  - Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and     Thunderbird < 115.4.1. (CVE-2023-5730)

  - An attacker could have created a malicious link using bidirectional characters to spoof the location in     the address bar when visited. This vulnerability affects Firefox < 117, Firefox ESR < 115.4, and     Thunderbird < 115.4.1. (CVE-2023-5732)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5736 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u381,     8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition:
    20.3.11, 21.3.7 and 22.3.3. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of     service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note:
    This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2023-22081)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5691 advisory.

  - The code that processes control channel messages sent to `named` calls certain functions recursively     during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on     the environment, this may cause the packet-parsing code to run out of available stack memory, causing     `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its     contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key;
    only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9     versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through     9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1. (CVE-2023-3341)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3137 advisory.

  - In multiple cases browser prompts could have been obscured by popups controlled by content. These could     have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox < 113,     Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32205)

  - An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects     Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32206)

  - A missing delay in popup notifications could have made it possible for an attacker to trick a user into     granting permissions. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird <     102.11. (CVE-2023-32207)

  - A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox <     113, Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32211)

  - An attacker could have positioned a <code>datalist</code> element to obscure the address bar. This     vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32212)

  - When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects     Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. (CVE-2023-32213)

  - Memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.
    (CVE-2023-32215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4701 advisory.

  - A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate     authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users     that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a     low-privileged local user could tamper with the state of the registration, by unregistering the system or     by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration     directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an     unconfined root. (CVE-2023-3899)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6805 advisory.

  - Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by     writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest     Authentication. (CVE-2023-46847)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5217 advisory.

  - A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-     vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine     may be able to elevate their privileges if that target virtual machine has been assigned a more privileged     Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-     public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-     db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . (CVE-2023-20900)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:7505 advisory.

  - On some systemsdepending on the graphics settings and driversit was possible to force an out-of-bounds     read and leak memory data into the images created on the canvas element. This vulnerability affects     Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. (CVE-2023-6204)

  - It was possible to cause the use of a MessagePort after it had already been freed, which could potentially     have led to an exploitable crash. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and     Thunderbird < 115.5. (CVE-2023-6205)

  - The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on     permission prompts. It was possible to use this fact to surprise users by luring them to click where the     permission grant button would be about to appear. This vulnerability affects Firefox < 120, Firefox ESR <     115.5.0, and Thunderbird < 115.5. (CVE-2023-6206)

  - Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox     < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. (CVE-2023-6207)

  - When using X11, text selected by the page using the Selection API was erroneously copied into the primary     selection, a temporary storage not unlike the clipboard. *This bug only affects Firefox on X11. Other     systems are unaffected.* This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird     < 115.5. (CVE-2023-6208)

  - Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal /../ part in the     path could be used to override the specified host. This could contribute to security problems in web     sites. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.
    (CVE-2023-6209)

  - Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and     Thunderbird < 115.5. (CVE-2023-6212)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7423 advisory.

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to     achieve local privilege escalation. When u32_change() is called on an existing filter, the whole     tcf_result struct is always copied into the new instance of the filter. This causes a problem when     updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the     success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading     to a use-after-free. We recommend upgrading past commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81.
    (CVE-2023-4208)

  - Information exposure through microarchitectural state after transient execution in certain vector     execution units for some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2022-40982)

  - qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX. (CVE-2023-31436)

  - An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited     to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-     of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend     upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. (CVE-2023-3611)

  - A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to     achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an     error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can     control the reference counter and set it to zero, they can cause the reference to be freed, leading to a     use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f.
    (CVE-2023-3776)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
187871	CentOS 8 : python3 (CESA-2024:0114)	high
187870	CentOS 8 : kernel (CESA-2024:0113)	high
187869	CentOS 8 : kernel-rt (CESA-2024:0134)	high
187868	CentOS 8 : frr (CESA-2024:0130)	critical
187867	CentOS 8 : container-tools:4.0 (CESA-2024:0121)	high
187866	CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2024:0135)	medium
187865	CentOS 8 : tigervnc (CESA-2024:0128)	high
187864	CentOS 8 : python-urllib3 (CESA-2024:0116)	high
187856	CentOS 8 : nss (CESA-2024:0105)	medium
187766	CentOS 7 : kernel-rt (RHSA-2023:0400)	high
187765	CentOS 7 : plexus-archiver (RHSA-2023:6886)	critical
187764	CentOS 7 : kernel-rt (RHSA-2023:4821)	high
187763	CentOS 7 : xorg-x11-server (RHSA-2024:0009)	high
187762	CentOS 7 : kernel-rt (RHSA-2023:7424)	high
187761	CentOS 7 : kernel-rt (RHSA-2023:1988)	medium
187760	CentOS 7 : gstreamer1-plugins-bad-free (RHSA-2024:0013)	high
187759	CentOS 7 : firefox (RHSA-2023:4461)	critical
187758	CentOS 7 : tigervnc (RHSA-2023:7428)	high
187757	CentOS 7 : httpd (RHSA-2023:1593)	critical
187756	CentOS 7 : kernel-rt (RHSA-2023:5621)	high
187755	CentOS 7 : ImageMagick (RHSA-2023:5461)	high
187754	CentOS 7 : python-reportlab (RHSA-2023:5616)	critical
187753	CentOS 7 : kernel-rt (RHSA-2023:4150)	high
187752	CentOS 7 : tigervnc (RHSA-2024:0006)	high
187751	CentOS 7 : thunderbird (RHSA-2023:4495)	critical
187750	CentOS 7 : kernel-rt (RHSA-2023:1092)	high
187741	CentOS 8 : postgresql:10 (CESA-2023:7790)	high
187740	CentOS 8 : postgresql:15 (CESA-2023:7884)	high
187739	CentOS 8 : opensc (CESA-2023:7876)	medium
187738	CentOS 8 : gstreamer1-plugins-bad-free (CESA-2023:7841)	high
187737	CentOS 8 : squid:4 (CESA-2024:0046)	high
187736	CentOS 8 : tigervnc (CESA-2024:0018)	high
187735	CentOS 8 : openssl (CESA-2023:7877)	medium
187734	CentOS 8 : webkit2gtk3 (CESA-2023:7716)	high
187733	CentOS 8 : tracker-miners (CESA-2023:7732)	high
187732	CentOS 8 : avahi (CESA-2023:7836)	medium
187731	CentOS 8 : postgresql:12 (CESA-2023:7714)	high
187416	CentOS 7 : firefox (RHSA-2024:0026)	high
187415	CentOS 7 : thunderbird (RHSA-2024:0027)	high
187268	CentOS 7 : java-1.8.0-openjdk (RHSA-2023:4166)	low
187267	CentOS 7 : kernel (RHSA-2023:5622)	high
187266	CentOS 7 : firefox (RHSA-2023:6162)	critical
187265	CentOS 7 : java-11-openjdk (RHSA-2023:5736)	medium
187264	CentOS 7 : bind (RHSA-2023:5691)	high
187263	CentOS 7 : firefox (RHSA-2023:3137)	high
187262	CentOS 7 : subscription-manager (RHSA-2023:4701)	high
187261	CentOS 7 : squid (RHSA-2023:6805)	high
187260	CentOS 7 : open-vm-tools (RHSA-2023:5217)	high
187259	CentOS 7 : thunderbird (RHSA-2023:7505)	high
187258	CentOS 7 : kernel (RHSA-2023:7423)	high

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

high

high

critical

high

medium

high

high

medium

high

critical

high

high

high

medium

high

critical

high

critical

high

high

critical

high

high

critical

high

high

high

medium

high

high

high

medium

high

high

medium

high

high

high

low

high

critical

medium

high

high

high

high

high

high

high