The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3891 advisory.

  - OpenJDK: Weak ciphers preferred over stronger ones for TLS (JSSE, 8264210) (CVE-2021-35550)

  - OpenJDK: Excessive memory allocation in RTFParser (Swing, 8265167) (CVE-2021-35556)

  - OpenJDK: Excessive memory allocation in RTFReader (Swing, 8265580) (CVE-2021-35559)

  - OpenJDK: Excessive memory allocation in HashMap and HashSet (Utility, 8266097) (CVE-2021-35561)

  - OpenJDK: Certificates with end dates too far in the future can corrupt keystore (Keytool, 8266137)     (CVE-2021-35564)

  - OpenJDK: Loop in HttpsServer triggered during TLS session close (JSSE, 8254967) (CVE-2021-35565)

  - OpenJDK: Incorrect principal selection when using Kerberos Constrained Delegation (Libraries, 8266689)     (CVE-2021-35567)

  - OpenJDK: Unexpected exception raised during TLS handshake (JSSE, 8267729) (CVE-2021-35578)

  - OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8267735) (CVE-2021-35586)

  - OpenJDK: Non-constant comparison during TLS handshakes (JSSE, 8269618) (CVE-2021-35603)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3918 advisory.

  - redis: Lua scripts can overflow the heap-based Lua stack (CVE-2021-32626)

  - redis: Integer overflow issue with Streams (CVE-2021-32627)

  - redis: Integer overflow bug in the ziplist data structure (CVE-2021-32628)

  - redis: Denial of service via Redis Standard Protocol (RESP) request (CVE-2021-32675)

  - redis: Integer overflow issue with intsets (CVE-2021-32687)

  - redis: Integer overflow issue with strings (CVE-2021-41099)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3893 advisory.

  - OpenJDK: Weak ciphers preferred over stronger ones for TLS (JSSE, 8264210) (CVE-2021-35550)

  - OpenJDK: Excessive memory allocation in RTFParser (Swing, 8265167) (CVE-2021-35556)

  - OpenJDK: Excessive memory allocation in RTFReader (Swing, 8265580) (CVE-2021-35559)

  - OpenJDK: Excessive memory allocation in HashMap and HashSet (Utility, 8266097) (CVE-2021-35561)

  - OpenJDK: Certificates with end dates too far in the future can corrupt keystore (Keytool, 8266137)     (CVE-2021-35564)

  - OpenJDK: Loop in HttpsServer triggered during TLS session close (JSSE, 8254967) (CVE-2021-35565)

  - OpenJDK: Incorrect principal selection when using Kerberos Constrained Delegation (Libraries, 8266689)     (CVE-2021-35567)

  - OpenJDK: Unexpected exception raised during TLS handshake (JSSE, 8267729) (CVE-2021-35578)

  - OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8267735) (CVE-2021-35586)

  - OpenJDK: Incomplete validation of inner class references in ClassFileParser (Hotspot, 8268071)     (CVE-2021-35588)

  - OpenJDK: Non-constant comparison during TLS handshakes (JSSE, 8269618) (CVE-2021-35603)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3945 advisory.

  - redis: Lua scripts can overflow the heap-based Lua stack (CVE-2021-32626)

  - redis: Integer overflow issue with Streams (CVE-2021-32627)

  - redis: Integer overflow bug in the ziplist data structure (CVE-2021-32628)

  - redis: Denial of service via Redis Standard Protocol (RESP) request (CVE-2021-32675)

  - redis: Integer overflow issue with intsets (CVE-2021-32687)

  - redis: Integer overflow issue with strings (CVE-2021-41099)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:3819 advisory.

  - dotnet: System.DirectoryServices.Protocols.LdapConnection sends credentials in plaintext if TLS handshake     fails (CVE-2021-41355)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:3838 advisory.

  - rust-crossbeam-deque: race condition may lead to double free (CVE-2021-32810)

  - Mozilla: Use-after-free in MessageTask (CVE-2021-38496)

  - Mozilla: Validation message could have been overlaid on another origin (CVE-2021-38497)

  - Mozilla: Use-after-free of nsLanguageAtomService object (CVE-2021-38498)

  - Mozilla: Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15, and Firefox ESR 91.2 (CVE-2021-38500)

  - Mozilla: Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2 (CVE-2021-38501)

  - Mozilla: Downgrade attack on SMTP STARTTLS connections (CVE-2021-38502)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:3771 advisory.

  - grafana: Snapshot authentication bypass (CVE-2021-39226)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:3755 advisory.

  - rust-crossbeam-deque: race condition may lead to double free (CVE-2021-32810)

  - Mozilla: Use-after-free in MessageTask (CVE-2021-38496)

  - Mozilla: Validation message could have been overlaid on another origin (CVE-2021-38497)

  - Mozilla: Use-after-free of nsLanguageAtomService object (CVE-2021-38498)

  - Mozilla: Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15, and Firefox ESR 91.2 (CVE-2021-38500)

  - Mozilla: Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2 (CVE-2021-38501)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3816 advisory.

  - httpd: mod_session: Heap overflow via a crafted SessionHeader value (CVE-2021-26691)

  - httpd: mod_proxy: SSRF via a crafted request uri-path containing unix: (CVE-2021-40438)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3438 advisory.

  - A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3715)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3666 advisory.

  - nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930, CVE-2021-22940)

  - nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)

  - nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)

  - nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

  - nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite     (CVE-2021-32803)

  - nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite     (CVE-2021-32804)

  - c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3576 advisory.

  - krb5: Sending a request containing PA-ENCRYPTED-CHALLENGE padata element without using FAST could result     in NULL dereference in KDC which leads to DoS (CVE-2021-36222)

  - krb5: NULL pointer dereference in process_tgs_req() in kdc/do_tgs_req.c via a FAST inner body that lacks     server field (CVE-2021-37750)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3582 advisory.

  - curl: Content not matching hash in Metalink is not being discarded (CVE-2021-22922)

  - curl: Metalink download sends credentials (CVE-2021-22923)

  - curl: Bad connection reuse due to flawed path name checks (CVE-2021-22924)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3623 advisory.

  - nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930, CVE-2021-22940)

  - nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)

  - nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)

  - nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

  - nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite     (CVE-2021-32803)

  - nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite     (CVE-2021-32804)

  - c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:3585 advisory.

  - golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet     (CVE-2021-29923)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:3572 advisory.

  - nss: TLS 1.3 CCS flood remote DoS Attack (CVE-2020-25648)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3590 advisory.

  - mysql: Server: Stored Procedure unspecified vulnerability (CPU Oct 2020) (CVE-2020-14672)

  - mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765, CVE-2020-14789,     CVE-2020-14804)

  - mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2020) (CVE-2020-14769, CVE-2020-14773,     CVE-2020-14777, CVE-2020-14785, CVE-2020-14793, CVE-2020-14794, CVE-2020-14809, CVE-2020-14830,     CVE-2020-14836, CVE-2020-14837, CVE-2020-14839, CVE-2020-14845, CVE-2020-14846, CVE-2020-14861,     CVE-2020-14866, CVE-2020-14868, CVE-2020-14888, CVE-2020-14891, CVE-2020-14893)

  - mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14775, CVE-2020-14776, CVE-2020-14791,     CVE-2020-14821, CVE-2020-14829, CVE-2020-14848)

  - mysql: Server: PS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14786, CVE-2020-14790,     CVE-2020-14844)

  - mysql: Server: Security: Encryption unspecified vulnerability (CPU Oct 2020) (CVE-2020-14800)

  - mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812)

  - mysql: Server: DML unspecified vulnerability (CPU Oct 2020) (CVE-2020-14814, CVE-2020-14828)

  - mysql: Server: Security: Privileges unspecified vulnerability (CPU Oct 2020) (CVE-2020-14838)

  - mysql: Server: Charsets unspecified vulnerability (CPU Oct 2020) (CVE-2020-14852)

  - mysql: Server: Security: Roles unspecified vulnerability (CPU Oct 2020) (CVE-2020-14860)

  - mysql: Server: DDL unspecified vulnerability (CPU Oct 2020) (CVE-2020-14867)

  - mysql: Server: X Plugin unspecified vulnerability (CPU Oct 2020) (CVE-2020-14870)

  - mysql: Server: Logging unspecified vulnerability (CPU Oct 2020) (CVE-2020-14873)

  - mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2021) (CVE-2021-2001, CVE-2021-2021,     CVE-2021-2024, CVE-2021-2030, CVE-2021-2031, CVE-2021-2036, CVE-2021-2055, CVE-2021-2060, CVE-2021-2065,     CVE-2021-2070, CVE-2021-2076)

  - mysql: Server: Replication unspecified vulnerability (CPU Jan 2021) (CVE-2021-2002)

  - mysql: C API unspecified vulnerability (CPU Jan 2021) (CVE-2021-2010, CVE-2021-2011)

  - mysql: InnoDB unspecified vulnerability (CPU Jan 2021) (CVE-2021-2022, CVE-2021-2028, CVE-2021-2042,     CVE-2021-2048)

  - mysql: Information Schema unspecified vulnerability (CPU Jan 2021) (CVE-2021-2032)

  - mysql: Server: Components Services unspecified vulnerability (CPU Jan 2021) (CVE-2021-2038)

  - mysql: Server: Stored Procedure unspecified vulnerability (CPU Jan 2021) (CVE-2021-2046, CVE-2021-2072,     CVE-2021-2081)

  - mysql: Server: DML unspecified vulnerability (CPU Jan 2021) (CVE-2021-2056, CVE-2021-2087, CVE-2021-2088)

  - mysql: Server: Locking unspecified vulnerability (CPU Jan 2021) (CVE-2021-2058)

  - mysql: Server: DDL unspecified vulnerability (CPU Jan 2021) (CVE-2021-2061, CVE-2021-2122)

  - mysql: Server: Options unspecified vulnerability (CPU Apr 2021) (CVE-2021-2146)

  - mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2021) (CVE-2021-2164, CVE-2021-2169,     CVE-2021-2170, CVE-2021-2193, CVE-2021-2203, CVE-2021-2212, CVE-2021-2213, CVE-2021-2230, CVE-2021-2278,     CVE-2021-2298, CVE-2021-2299)

  - mysql: Server: DML unspecified vulnerability (CPU Apr 2021) (CVE-2021-2166, CVE-2021-2172, CVE-2021-2196,     CVE-2021-2300, CVE-2021-2305)

  - mysql: Server: Replication unspecified vulnerability (CPU Apr 2021) (CVE-2021-2171, CVE-2021-2178,     CVE-2021-2202)

  - mysql: InnoDB unspecified vulnerability (CPU Apr 2021) (CVE-2021-2174, CVE-2021-2180, CVE-2021-2194)

  - mysql: Server: Group Replication Plugin unspecified vulnerability (CPU Apr 2021) (CVE-2021-2179,     CVE-2021-2232)

  - mysql: Server: Partition unspecified vulnerability (CPU Apr 2021) (CVE-2021-2201, CVE-2021-2208)

  - mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2021) (CVE-2021-2215, CVE-2021-2217,     CVE-2021-2293, CVE-2021-2304)

  - mysql: Server: Information Schema unspecified vulnerability (CPU Apr 2021) (CVE-2021-2226, CVE-2021-2301,     CVE-2021-2308)

  - mysql: Server: Packaging unspecified vulnerability (CPU Apr 2021) (CVE-2021-2307)

  - mysql: Server: DDL unspecified vulnerability (CPU Jul 2021) (CVE-2021-2339, CVE-2021-2352, CVE-2021-2399)

  - mysql: Server: Memcached unspecified vulnerability (CPU Jul 2021) (CVE-2021-2340)

  - mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2021) (CVE-2021-2342, CVE-2021-2357,     CVE-2021-2367, CVE-2021-2383, CVE-2021-2384, CVE-2021-2387, CVE-2021-2410, CVE-2021-2412, CVE-2021-2418,     CVE-2021-2425, CVE-2021-2426, CVE-2021-2427, CVE-2021-2437, CVE-2021-2441, CVE-2021-2444)

  - mysql: Server: Federated unspecified vulnerability (CPU Jul 2021) (CVE-2021-2354)

  - mysql: Server: Replication unspecified vulnerability (CPU Jul 2021) (CVE-2021-2356, CVE-2021-2385)

  - mysql: Server: DML unspecified vulnerability (CPU Jul 2021) (CVE-2021-2370, CVE-2021-2440)

  - mysql: InnoDB unspecified vulnerability (CPU Jul 2021) (CVE-2021-2372, CVE-2021-2374, CVE-2021-2389,     CVE-2021-2390, CVE-2021-2429)

  - mysql: Server: Locking unspecified vulnerability (CPU Jul 2021) (CVE-2021-2402)

  - mysql: Server: GIS unspecified vulnerability (CPU Jul 2021) (CVE-2021-2417)

  - mysql: Server: PS unspecified vulnerability (CPU Jul 2021) (CVE-2021-2422)

  - mysql: Server: Stored Procedure unspecified vulnerability (CPU Jul 2021) (CVE-2021-2424)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:3494 advisory.

  - Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.14, Thunderbird < 78.14,     and Firefox < 92. (CVE-2021-38493)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:3498 advisory.

  - Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.14, Thunderbird < 78.14,     and Firefox < 92. (CVE-2021-38493)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:3497 advisory.

  - Mozilla: Memory safety bugs fixed in Firefox 92, Firefox ESR 78.14 and Firefox ESR 91.1 (CVE-2021-38493)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:3492 advisory.

  - cyrus-imapd: Denial of service via string hashing algorithm collisions (CVE-2021-33582)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:3499 advisory.

  - Mozilla: Memory safety bugs fixed in Firefox 92, Firefox ESR 78.14 and Firefox ESR 91.1 (CVE-2021-38493)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:3548 advisory.

  - kernel: SVM nested virtualization issue in KVM (AVIC support) (CVE-2021-3653)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3447 advisory.

  - kernel: powerpc: KVM guest OS users can cause host OS memory corruption (CVE-2021-37576)

  - kernel: slab-out-of-bounds access in xdr_set_page_base() in net/sunrpc/xdr.c (CVE-2021-38201)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:3151 advisory.

  - sssd: shell command injection in sssctl (CVE-2021-3621)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:3153 advisory.

  - exiv2: Heap-based buffer overflow vulnerability in jp2image.cpp (CVE-2021-31291)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:3152 advisory.

  - exiv2: Heap-based buffer overflow vulnerability in jp2image.cpp (CVE-2021-31291)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3336 advisory.

  - A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-     fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a     specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3621)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3325 advisory.

  - In BIND 9.8.5 -> 9.8.8, 9.9.3 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and     9.16.8-S1 -> 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11     of the BIND 9.17 development branch, when a vulnerable version of named receives a malformed IXFR     triggering the flaw described above, the named process will terminate due to a failed assertion the next     time the transferred secondary zone is refreshed. (CVE-2021-25214)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3338 advisory.

  - A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows     Registry (hive) file, which would cause hivex to recursively call the _get_children() function, leading to     a stack overflow. The highest threat from this vulnerability is to system availability. (CVE-2021-3622)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3327 advisory.

  - A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked     down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries     platform) a root like local user could use this flaw to further increase their privileges to that of a     running kernel. (CVE-2020-27777)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements,     allowing them to execute arbitrary code within the kernel context. This affects     arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. (CVE-2021-29154)

  - An issue was discovered in the Linux kernel before 5.11.11. The netfilter subsystem allows attackers to     cause a denial of service (panic) because net/netfilter/x_tables.c and include/linux/netfilter/x_tables.h     lack a full memory barrier upon the assignment of a new table value, aka CID-175e476b8cdf.
    (CVE-2021-29650)

  - net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI     controller. (CVE-2021-32399)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3295 advisory.

  - A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to     execute arbitrary code via a crafted WAV file. (CVE-2021-3246)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3296 advisory.

  - LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute     arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw     allowing a client to send color-name requests with a name longer than the maximum size allowed by the     protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data     exceeding the maximum size is then interpreted by the server as additional X protocol requests and     executed, e.g., to disable X server authorization completely. For example, if the victim encounters     malicious terminal control sequences for color codes, then the attacker may be able to take full control     of the running graphical session. (CVE-2021-31535)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:3253 advisory.

  - libsndfile: Heap buffer overflow via crafted WAV file allows arbitrary code execution (CVE-2021-3246)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:3160 advisory.

  - Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption     and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91,     Firefox ESR < 78.13, and Firefox < 91. (CVE-2021-29980)

  - Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly     considered during garbage collection. This led to memory corruption and a potentially exploitable crash.
    This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
    (CVE-2021-29984)

  - A use-after-free vulnerability in media channels could have led to memory corruption and a potentially     exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13,     and Firefox < 91. (CVE-2021-29985)

  - A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable     crash. *Note: This issue only affected Linux operating systems. Other operating systems are unaffected.*     This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
    (CVE-2021-29986)

  - Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds     read or memory corruption, and a potentially exploitable crash. This vulnerability affects Thunderbird <     78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. (CVE-2021-29988)

  - Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.13, Firefox ESR < 78.13,     and Firefox < 91. (CVE-2021-29989)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:3154 advisory.

  - Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption     and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91,     Firefox ESR < 78.13, and Firefox < 91. (CVE-2021-29980)

  - Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly     considered during garbage collection. This led to memory corruption and a potentially exploitable crash.
    This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
    (CVE-2021-29984)

  - A use-after-free vulnerability in media channels could have led to memory corruption and a potentially     exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13,     and Firefox < 91. (CVE-2021-29985)

  - A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable     crash. *Note: This issue only affected Linux operating systems. Other operating systems are unaffected.*     This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.
    (CVE-2021-29986)

  - Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds     read or memory corruption, and a potentially exploitable crash. This vulnerability affects Thunderbird <     78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. (CVE-2021-29988)

  - Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.13, Firefox ESR < 78.13,     and Firefox < 91. (CVE-2021-29989)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3057 advisory.

  - kernel: Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks (CVE-2021-22543)

  - kernel: out-of-bounds write in xt_compat_target_from_user() in net/netfilter/x_tables.c (CVE-2021-22555)

  - kernel: race condition in net/can/bcm.c leads to local privilege escalation (CVE-2021-3609)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:3157 advisory.

  - Mozilla: Uninitialized memory in a canvas object could have led to memory corruption (CVE-2021-29980)

  - Mozilla: Incorrect instruction reordering during JIT optimization (CVE-2021-29984)

  - Mozilla: Use-after-free media channels (CVE-2021-29985)

  - Mozilla: Race condition when resolving DNS names could have led to memory corruption (CVE-2021-29986)

  - Mozilla: Memory corruption as a result of incorrect style treatment (CVE-2021-29988)

  - Mozilla: Memory safety bugs fixed in Thunderbird 78.13 (CVE-2021-29989)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3142 advisory.

  - dotnet: ASP.NET Core WebSocket frame processing DoS (CVE-2021-26423)

  - dotnet: Dump file created world-readable (CVE-2021-34485)

  - dotnet: ASP.NET Core JWT token logging (CVE-2021-34532)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:3079 advisory.

  - 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed (CVE-2021-3652)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:3075 advisory.

  - libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes     (CVE-2021-22918)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3148 advisory.

  - dotnet: ASP.NET Core WebSocket frame processing DoS (CVE-2021-26423)

  - dotnet: Dump file created world-readable (CVE-2021-34485)

  - dotnet: ASP.NET Core JWT token logging (CVE-2021-34532)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:3155 advisory.

  - Mozilla: Uninitialized memory in a canvas object could have led to memory corruption (CVE-2021-29980)

  - Mozilla: Incorrect instruction reordering during JIT optimization (CVE-2021-29984)

  - Mozilla: Use-after-free media channels (CVE-2021-29985)

  - Mozilla: Race condition when resolving DNS names could have led to memory corruption (CVE-2021-29986)

  - Mozilla: Memory corruption as a result of incorrect style treatment (CVE-2021-29988)

  - Mozilla: Memory safety bugs fixed in Thunderbird 78.13 (CVE-2021-29989)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:3058 advisory.

  - glib: integer overflow in g_byte_array_new_take function when called with a buffer of 4GB or more on a     64-bit platform (CVE-2021-27218)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3063 advisory.

  - rust: optimization for joining strings can cause uninitialized bytes to be exposed (CVE-2020-36323)

  - rust: heap-based buffer overflow in read_to_end() because it does not validate the return value from Read     in an unsafe context (CVE-2021-28875)

  - rust: panic safety issue in Zip implementation (CVE-2021-28876)

  - rust: memory safety violation in Zip implementation for nested iter::Zips (CVE-2021-28877)

  - rust: memory safety violation in Zip implementation when next_back() and next() are used together     (CVE-2021-28878)

  - rust: integer overflow in the Zip implementation can lead to a buffer overflow (CVE-2021-28879)

  - rust: double free in Vec::from_iter function if freeing the element panics (CVE-2021-31162)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:3145 advisory.

  - dotnet: Dump file created world-readable (CVE-2021-34485)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:3081 advisory.

  - cloud-init: randomly generated passwords logged in clear-text to world-readable file (CVE-2021-3429)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2845 advisory.

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2021-2341)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2021-2369)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2021-2388)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3073 advisory.

  - libuv: out-of-bounds read in uv__idna_toascii() can lead to information disclosures or crashes     (CVE-2021-22918)

  - nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl()     (CVE-2021-23362)

  - nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode (CVE-2021-27290)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3061 advisory.

  - QEMU: msix: OOB access during mmio operations may lead to DoS (CVE-2020-13754)

  - QEMU: net: an assert failure via eth_get_gso_type (CVE-2020-27617)

  - qemu: out-of-bound heap buffer access via an interrupt ID field (CVE-2021-20221)

  - QEMU: net: Infinite loop in loopback mode may lead to stack overflow (CVE-2021-3416)

  - hivex: Buffer overflow when provided invalid node key length (CVE-2021-3504)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
154649	CentOS 8 : java-11-openjdk (CESA-2021:3891)	medium
154644	CentOS 8 : redis:5 (CESA-2021:3918)	high
154642	CentOS 8 : java-1.8.0-openjdk (CESA-2021:3893)	medium
154329	CentOS 8 : redis:6 (CESA-2021:3945)	high
154272	CentOS 8 : .NET 5.0 (CESA-2021:3819)	medium
154158	CentOS 8 : thunderbird (CESA-2021:3838)	critical
154157	CentOS 8 : grafana (CESA-2021:3771)	high
154156	CentOS 8 : firefox (CESA-2021:3755)	critical
154050	CentOS 8 : httpd:2.4 (CESA-2021:3816)	critical
153767	CentOS 7 : kernel (RHSA-2021:3438)	high
153763	CentOS 8 : nodejs:14 (CESA-2021:3666)	critical
153590	CentOS 8 : krb5 (CESA-2021:3576)	high
153539	CentOS 8 : curl (CESA-2021:3582)	medium
153532	CentOS 8 : nodejs:12 (CESA-2021:3623)	critical
153521	CentOS 8 : go-toolset:rhel8 (CESA-2021:3585)	high
153520	CentOS 8 : nss and nspr (CESA-2021:3572)	high
153519	CentOS 8 : mysql:8.0 (CESA-2021:3590)	medium
153473	CentOS 7 : thunderbird (RHSA-2021:3494)	high
153472	CentOS 7 : firefox (RHSA-2021:3498)	high
153412	CentOS 8 : firefox (CESA-2021:3497)	high
153411	CentOS 8 : cyrus-imapd (CESA-2021:3492)	high
153410	CentOS 8 : thunderbird (CESA-2021:3499)	high
153409	CentOS 8 : kernel (CESA-2021:3548)	high
153155	CentOS 8 : kernel (CESA-2021:3447)	high
153151	CentOS 8 : sssd (CESA-2021:3151)	high
153150	CentOS 8 : compat-exiv2-026 (CESA-2021:3153)	critical
153149	CentOS 8 : exiv2 (CESA-2021:3152)	critical
152976	CentOS 7 : sssd (RHSA-2021:3336)	high
152973	CentOS 7 : bind (RHSA-2021:3325)	medium
152971	CentOS 7 : hivex (RHSA-2021:3338)	medium
152970	CentOS 7 : kernel (RHSA-2021:3327)	high
152910	CentOS 7 : libsndfile (RHSA-2021:3295)	high
152909	CentOS 7 : libX11 (RHSA-2021:3296)	critical
152893	CentOS 8 : libsndfile (CESA-2021:3253)	high
152666	CentOS 7 : thunderbird (RHSA-2021:3160)	high
152663	CentOS 7 : firefox (RHSA-2021:3154)	high
152596	CentOS 8 : kernel (CESA-2021:3057)	high
152594	CentOS 8 : firefox (CESA-2021:3157)	high
152591	CentOS 8 : .NET Core 3.1 (CESA-2021:3142)	medium
152588	CentOS 8 : 389-ds:1.4 (CESA-2021:3079)	medium
152583	CentOS 8 : libuv (CESA-2021:3075)	medium
152582	CentOS 8 : .NET 5.0 (CESA-2021:3148)	medium
152576	CentOS 8 : thunderbird (CESA-2021:3155)	high
152575	CentOS 8 : glib2 (CESA-2021:3058)	high
152574	CentOS 8 : rust-toolset:rhel8 (CESA-2021:3063)	critical
152573	CentOS 8 : .NET Core 2.1 (CESA-2021:3145)	medium
152572	CentOS 8 : cloud-init (CESA-2021:3081)	medium
152497	CentOS 7 : java-1.8.0-openjdk (RHSA-2021:2845)	high
152468	CentOS 8 : nodejs:12 (CESA-2021:3073)	medium
152461	CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2021:3061)	medium

Detections

Analytics

CentOS Local Security Checks Family for Nessus

medium

high

medium

high

medium

critical

high

critical

critical

high

critical

high

medium

critical

high

high

medium

high

high

high

high

high

high

high

high

critical

critical

high

medium

medium

high

high

critical

high

high

high

high

high

medium

medium

medium

medium

high

high

critical

medium

medium

high

medium

medium