The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1887 advisory.

  - dovecot: IMAP hibernation function allows mail access (CVE-2020-24386)

  - dovecot: Denial of service via mail MIME parsing (CVE-2020-25275)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1983 advisory.

  - slapi-nis: NULL dereference (DoS) with specially crafted Binding DN (CVE-2021-3480)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1678 advisory.

  - perl: heap-based buffer overflow in regular expression compiler leads to DoS (CVE-2020-10543)

  - perl: corruption of intermediate language state of compiled regular expression due to integer overflow     leads to DoS (CVE-2020-10878)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1744 advisory.

  - sane-backends: NULL pointer dereference in sanei_epson_net_read function (CVE-2020-12867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1598 advisory.

  - bluez: double free in gatttool client disconnect callback handler in src/shared/att.c could lead to DoS or     RCE (CVE-2020-27153)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1846 advisory.

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1935 advisory.

  - rust: memory safety violation in String::retain() (CVE-2020-36317)

  - rust: use-after-free or double free in VecDeque::make_contiguous (CVE-2020-36318)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:1791 advisory.

  - spice-vdagent: memory DoS via arbitrary entries in active_xfers hash table (CVE-2020-25650)

  - spice-vdagent: possible file transfer DoS and information leak via active_xfers hash map (CVE-2020-25651)

  - spice-vdagent: possibility to exhaust file descriptors in vdagentd (CVE-2020-25652)

  - spice-vdagent: UNIX domain socket peer PID retrieved via SO_PEERCRED is subject to race condition     (CVE-2020-25653)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1783 advisory.

  - tigervnc: certificate exceptions stored as authorities (CVE-2020-26117)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1647 advisory.

  - samba: Missing handle permissions check in SMB1/2/3 ChangeNotify (CVE-2020-14318)

  - samba: Unprivileged user can crash winbind (CVE-2020-14323)

  - samba: Netlogon elevation of privilege vulnerability (Zerologon) (CVE-2020-1472)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1627 advisory.

  - trousers: fails to drop the root gid privilege when no longer needed (CVE-2020-24330)

  - trousers: tss user still has read and write access to the /etc/tcsd.conf file if tcsd is started as root     (CVE-2020-24331)

  - trousers: tss user can be used to create or corrupt existing files, this could lead to DoS     (CVE-2020-24332)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1752 advisory.

  - evolution-data-server: NULL pointer dereference related to imapx_free_capability and     imapx_connect_to_server (CVE-2020-16117)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1761 advisory.

  - python: CRLF injection via HTTP request method in httplib/http.client (CVE-2020-26116)

  - python-urllib3: CRLF injection via HTTP request method (CVE-2020-26137)

  - python-lxml: mXSS due to the use of improper parser (CVE-2020-27783)

  - python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c (CVE-2021-3177)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1775 advisory.

  - resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class (CVE-2020-1695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:1631 advisory.

  - python-urllib3: CRLF injection via HTTP request method (CVE-2020-26137)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:1582 advisory.

  - cpio: improper input validation when writing tar header fields leads to unexpected tar generation     (CVE-2019-14866)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1853 advisory.

  - unbound: integer overflow in the regional allocator via regional_alloc (CVE-2019-25032)

  - unbound: integer overflow in sldns_str2wire_dname_buf_origin can lead to an out-of-bounds write     (CVE-2019-25034)

  - unbound: out-of-bounds write in sldns_bget_token_par (CVE-2019-25035)

  - unbound: assertion failure and denial of service in synth_cname (CVE-2019-25036)

  - unbound: assertion failure and denial of service in dname_pkt_copy via an invalid packet (CVE-2019-25037)

  - unbound: integer overflow in a size calculation in dnscrypt/dnscrypt.c (CVE-2019-25038)

  - unbound: integer overflow in a size calculation in respip/respip.c (CVE-2019-25039)

  - unbound: infinite loop via a compressed name in dname_pkt_copy (CVE-2019-25040)

  - unbound: assertion failure via a compressed name in dname_pkt_copy (CVE-2019-25041)

  - unbound: out-of-bounds write via a compressed name in rdata_copy (CVE-2019-25042)

  - unbound: symbolic link traversal when writing PID file (CVE-2020-28935)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1968 advisory.

  - sqlite: Division by zero in whereLoopAddBtreeIndex in sqlite3.c (CVE-2019-16168)

  - sqlite: integer overflow in sqlite3_str_vappendf function in printf.c (CVE-2020-13434)

  - sqlite: Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c (CVE-2020-13630)

  - sqlite: Virtual table can be renamed into the name of one of its shadow tables (CVE-2020-13631)

  - sqlite: NULL pointer dereference in ext/fts3/fts3_snippet.c via a crafted matchinfo() query     (CVE-2020-13632)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1597 advisory.

  - libxml2: Buffer overflow vulnerability in xmlEncodeEntitiesInternal() in entities.c (CVE-2020-24977)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1586 advisory.

  - glib2: insecure permissions for files and directories (CVE-2019-13012)

  - webkitgtk: use-after-free may lead to arbitrary code execution (CVE-2020-13543, CVE-2020-13584,     CVE-2020-9951)

  - webkitgtk: type confusion may lead to arbitrary code execution (CVE-2020-9948)

  - webkitgtk: out-of-bounds write may lead to code execution (CVE-2020-9983)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1609 advisory.

  - p11-kit: integer overflow when allocating memory for arrays or attributes and object identifiers     (CVE-2020-29361)

  - p11-kit: out-of-bounds read in p11_rpc_buffer_get_byte_array function in rpc-message.c (CVE-2020-29362)

  - p11-kit: out-of-bounds write in p11_rpc_buffer_get_byte_array_value function in rpc-message.c     (CVE-2020-29363)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1756 advisory.

  - qt: buffer over-read in read_xbm_body in gui/image/qxbmhandler.cpp (CVE-2020-17507)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1593 advisory.

  - krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead     to DoS (CVE-2020-28196)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1809 advisory.

  - httpd: mod_session_cookie does not respect expiry time (CVE-2018-17199)

  - httpd: mod_proxy_uwsgi buffer overflow (CVE-2020-11984)

  - httpd: mod_http2 concurrent pool usage (CVE-2020-11993)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1924 advisory.

  - spice: Client initiated renegotiation denial of service (CVE-2021-20201)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:1859 advisory.

  - grafana: XSS via a query alias for the Elasticsearch and Testdata datasource (CVE-2020-24303)

  - crewjam/saml: authentication bypass in saml authentication (CVE-2020-27846)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1849 advisory.

  - freerdp: out of bound reads resulting in accessing memory location outside of static array     PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11095)

  - freerdp: out-of-bound read in update_read_cache_bitmap_v3_order (CVE-2020-11096)

  - freerdp: out of bounds read in PRIMARY_DRAWING_ORDER_FIELD_BYTES (CVE-2020-11097)

  - freerdp: out-of-bound read in glyph_cache_put (CVE-2020-11098)

  - freerdp: out of bounds read in license_read_new_or_upgrade_license_packet (CVE-2020-11099)

  - freerdp: integer overflow due to missing input sanitation in rdpegfx channel (CVE-2020-15103)

  - freerdp: out of bounds read in TrioParse (CVE-2020-4030)

  - freerdp: out-of-bounds read in RLEDECOMPRESS (CVE-2020-4033)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1581 advisory.

  - sqlite: integer overflow in sqlite3_str_vappendf function in printf.c (CVE-2020-13434)

  - sqlite: heap-based buffer overflow in multiSelectOrderBy due to mishandling of query-flattener     optimization in select.c (CVE-2020-15358)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1842 advisory.

  - raptor: heap-based buffer overflows due to an error in calculating the maximum nspace declarations for the     XML writer (CVE-2017-18926)

  - raptor2: malformed input file can lead to a segfault due to an out of bounds array access in     raptor_xml_writer_start_element_common (CVE-2020-25713)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:1600 advisory.

  - opensc: heap-based buffer overflow in sc_oberthur_read_file (CVE-2020-26570)

  - opensc: stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init (CVE-2020-26571)

  - opensc: stack-based buffer overflow in tcos_decipher (CVE-2020-26572)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1633 advisory.

  - python: CRLF injection via HTTP request method in httplib/http.client (CVE-2020-26116)

  - python: Unsafe use of eval() on data retrieved via HTTP in the test suite (CVE-2020-27619)

  - python: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in     query parameters (CVE-2021-23336)

  - python: Stack-based buffer overflow in PyCArg_repr in _ctypes/callproc.c (CVE-2021-3177)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:1811 advisory.

  - libvncserver: uninitialized memory contents are vulnerable to Information Leak (CVE-2018-21247)

  - libvncserver: buffer overflow in ConnectClientToUnixSock() (CVE-2019-20839)

  - libvncserver: libvncserver/rfbregion.c has a NULL pointer dereference (CVE-2020-14397)

  - libvncserver: libvncclient/rfbproto.c does not limit TextChat size (CVE-2020-14405)

  - libvncserver: libvncserver/rfbserver.c has a divide by zero which could result in DoS (CVE-2020-25708)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:0617 advisory.

  - xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service     (segmentation fault) via a crafted UTF-8 combining character sequence. (CVE-2021-27135)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:1360 advisory.

  - Mozilla: More internal network hosts could have been probed by a malicious webpage (CVE-2021-23961)

  - Mozilla: Out of bound write due to lazy initialization (CVE-2021-23994)

  - Mozilla: Use-after-free in Responsive Design Mode (CVE-2021-23995)

  - Mozilla: Secure Lock icon could have been spoofed (CVE-2021-23998)

  - Mozilla: Blob URLs may have been granted additional privileges (CVE-2021-23999)

  - Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL (CVE-2021-24002)

  - Mozilla: Incorrect size computation in WebAssembly JIT could lead to null-reads (CVE-2021-29945)

  - Mozilla: Port blocking could be bypassed (CVE-2021-29946)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1354 advisory.

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a     remote host only by manipulating the processed input stream. No user is affected, who followed the     recommendation to setup XStream's security framework with a whitelist limited to the minimal required     types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least     version 1.4.16. (CVE-2021-21344, CVE-2021-21346, CVE-2021-21347)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands     of the host only by manipulating the processed input stream. No user is affected, who followed the     recommendation to setup XStream's security framework with a whitelist limited to the minimal required     types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least     version 1.4.16. (CVE-2021-21345)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,     there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating     the processed input stream. No user is affected, who followed the recommendation to setup XStream's     security framework with a whitelist limited to the minimal required types. If you rely on XStream's     default blacklist of the Security Framework, you will have to use at least version 1.4.16.
    (CVE-2021-21350)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1297 advisory.

  - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java     SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16;
    Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2021-2163)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1298 advisory.

  - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java     SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16;
    Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2021-2163)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1469 advisory.

  - In BIND 9.0.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.9.3-S1 -> 9.11.29-S1 and 9.16.8-S1 ->     9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.11 of the BIND     9.17 development branch, when a vulnerable version of named receives a query for a record triggering the     flaw described above, the named process will terminate due to a failed assertion check. The vulnerability     affects all currently maintained BIND 9 branches (9.11, 9.11-S, 9.16, 9.16-S, 9.17) as well as all other     versions of BIND 9. (CVE-2021-25215)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:1353 advisory.

  - Mozilla: More internal network hosts could have been probed by a malicious webpage (CVE-2021-23961)

  - Mozilla: Out of bound write due to lazy initialization (CVE-2021-23994)

  - Mozilla: Use-after-free in Responsive Design Mode (CVE-2021-23995)

  - Mozilla: Secure Lock icon could have been spoofed (CVE-2021-23998)

  - Mozilla: Blob URLs may have been granted additional privileges (CVE-2021-23999)

  - Mozilla: Arbitrary FTP command execution on FTP servers using an encoded URL (CVE-2021-24002)

  - Mozilla: Incorrect size computation in WebAssembly JIT could lead to null-reads (CVE-2021-29945)

  - Mozilla: Port blocking could be bypassed (CVE-2021-29946)

  - Mozilla: Race condition when reading from disk while verifying signatures (CVE-2021-29948)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1307 advisory.

  - OpenJDK: Incomplete enforcement of JAR signing disabled algorithms (Libraries, 8249906) (CVE-2021-2163)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1301 advisory.

  - OpenJDK: Incomplete enforcement of JAR signing disabled algorithms (Libraries, 8249906) (CVE-2021-2163)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1135 advisory.

  - An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it     allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the     security controls. This occurs for certain uri_whitespace configuration settings. (CVE-2020-25097)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:1192 advisory.

  - If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity     period of her key, but Alice's updated key has not yet been imported, an attacker may send an email     containing a crafted version of Alice's key with an invalid subkey, Thunderbird might subsequently attempt     to use the invalid subkey, and will fail to send encrypted email to Alice. This vulnerability affects     Thunderbird < 78.9.1. (CVE-2021-23991)

  - Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An     attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by     adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may     falsely conclude that the false user ID belongs to the correspondent. This vulnerability affects     Thunderbird < 78.9.1. (CVE-2021-23992)

  - An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If     an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the     Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid subkey, but the RNP     library rejects it from being used, causing encryption to fail. This vulnerability affects Thunderbird <     78.9.1. (CVE-2021-23993)

  - When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially     attempt to open it using a filename that isn't distributed by Thunderbird. If a computer has already been     infected with a malicious library of the alternative filename, and the malicious library has been copied     to a directory that is contained in the search path for executable libraries, then Thunderbird will load     the incorrect library. This vulnerability affects Thunderbird < 78.9.1. (CVE-2021-29949)

  - Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import     task. If the task runs into a failure, the secret key may remain in memory in its unprotected state. This     vulnerability affects Thunderbird < 78.8.1. (CVE-2021-29950)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1242 advisory.

  - mariadb: writable system variables allows a database user with SUPER privilege to execute arbitrary code     as the system mysql user (CVE-2021-27928)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1145 advisory.

  - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions     (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being     called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to     force an invalid signature, causing an assertion failure or possible validation. The highest threat to     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-20305)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1206 advisory.

  - nettle: Out of bounds memory access in signature verification (CVE-2021-20305)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:1193 advisory.

  - Mozilla: An attacker may use Thunderbird's OpenPGP key refresh mechanism to poison an existing key     (CVE-2021-23991)

  - Mozilla: A crafted OpenPGP key with an invalid user ID could be used to confuse the user (CVE-2021-23992)

  - Mozilla: Inability to send encrypted OpenPGP email after importing a crafted OpenPGP key (CVE-2021-23993)

  - Mozilla: Thunderbird might execute an alternative OTR library (CVE-2021-29949)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1197 advisory.

  - samba: Out of bounds read in AD DC LDAP server (CVE-2021-20277)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:0742 advisory.

  - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write     access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character     sequence. (CVE-2021-26937)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1072 advisory.

  - A flaw was found in Samba's libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to     an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The     highest threat from this vulnerability is to system availability. (CVE-2021-20277)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
149762	CentOS 8 : dovecot (CESA-2021:1887)	medium
149761	CentOS 8 : idm:DL1 (CESA-2021:1983)	high
149759	CentOS 8 : perl (CESA-2021:1678)	high
149758	CentOS 8 : sane-backends (CESA-2021:1744)	medium
149757	CentOS 8 : bluez (CESA-2021:1598)	high
149756	CentOS 8 : idm:DL1 and idm:client (CESA-2021:1846)	medium
149755	CentOS 8 : rust-toolset:rhel8 (CESA-2021:1935)	critical
149754	CentOS 8 : spice-vdagent (CESA-2021:1791)	medium
149753	CentOS 8 : tigervnc (CESA-2021:1783)	high
149752	CentOS 8 : samba (CESA-2021:1647)	medium
149751	CentOS 8 : trousers (CESA-2021:1627)	high
149750	CentOS 8 : evolution (CESA-2021:1752)	medium
149749	CentOS 8 : python27:2.7 (CESA-2021:1761)	critical
149748	CentOS 8 : pki-core:10.6 and pki-deps:10.6 (CESA-2021:1775)	high
149747	CentOS 8 : python-urllib3 (CESA-2021:1631)	medium
149746	CentOS 8 : cpio (CESA-2021:1582)	high
149745	CentOS 8 : unbound (CESA-2021:1853)	critical
149744	CentOS 8 : mingw packages (CESA-2021:1968)	high
149743	CentOS 8 : libxml2 (CESA-2021:1597)	medium
149741	CentOS 8 : GNOME (CESA-2021:1586)	high
149740	CentOS 8 : p11-kit (CESA-2021:1609)	medium
149739	CentOS 8 : qt5-qtbase (CESA-2021:1756)	medium
149738	CentOS 8 : krb5 (CESA-2021:1593)	high
149737	CentOS 8 : httpd:2.4 (CESA-2021:1809)	critical
149736	CentOS 8 : spice (CESA-2021:1924)	medium
149734	CentOS 8 : grafana (CESA-2021:1859)	critical
149733	CentOS 8 : freerdp (CESA-2021:1849)	medium
149732	CentOS 8 : sqlite (CESA-2021:1581)	medium
149731	CentOS 8 : raptor2 (CESA-2021:1842)	high
149730	CentOS 8 : opensc (CESA-2021:1600)	medium
149729	CentOS 8 : python3 (CESA-2021:1633)	critical
149728	CentOS 8 : libvncserver (CESA-2021:1811)	high
149505	CentOS 7 : xterm (RHSA-2021:0617)	critical
149237	CentOS 8 : firefox (CESA-2021:1360)	high
149208	CentOS 7 : xstream (RHSA-2021:1354)	critical
149207	CentOS 7 : java-11-openjdk (RHSA-2021:1297)	medium
149206	CentOS 7 : java-1.8.0-openjdk (RHSA-2021:1298)	medium
149205	CentOS 7 : bind (RHSA-2021:1469)	high
149026	CentOS 8 : thunderbird (CESA-2021:1353)	high
148941	CentOS 8 : java-11-openjdk (CESA-2021:1307)	medium
148940	CentOS 8 : java-1.8.0-openjdk (CESA-2021:1301)	medium
148885	CentOS 7 : squid (RHSA-2021:1135)	high
148882	CentOS 7 : thunderbird (RHSA-2021:1192)	high
148863	CentOS 8 : mariadb:10.3 and mariadb-devel:10.3 (CESA-2021:1242)	high
148745	CentOS 7 : nettle (RHSA-2021:1145)	high
148688	CentOS 8 : gnutls and nettle (CESA-2021:1206)	high
148687	CentOS 8 : thunderbird (CESA-2021:1193)	high
148686	CentOS 8 : libldb (CESA-2021:1197)	high
148557	CentOS 7 : screen (RHSA-2021:0742)	critical
148426	CentOS 7 : libldb (RHSA-2021:1072)	high

Detections

Analytics

CentOS Local Security Checks Family for Nessus

medium

high

high

medium

high

medium

critical

medium

high

medium

high

medium

critical

high

medium

high

critical

high

medium

high

medium

medium

high

critical

medium

critical

medium

medium

high

medium

critical

high

critical

high

critical

medium

medium

high

high

medium

medium

high

high

high

high

high

high

high

critical

high