The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the LibRaw-0.21.1-1.el9 build changelog.

  - A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file     may lead to an application crash. (CVE-2023-1729)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the lua-5.4.4-3.el9 build changelog.

  - singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain     luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles     untrusted Lua code. (CVE-2022-28805)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libmicrohttpd-0.9.72-5.el9 build changelog.

  - GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a     multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an     attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a     multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-     bounds read and a crash in the find_boundary() function. (CVE-2023-27371)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the pesign-115-6.el9 build changelog.

  - A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon.
    This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant     access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links.
    This could allow an attacker to gain access to privileged files and directories via a path traversal     attack. (CVE-2022-3560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the keylime-6.5.2-1.el9 build changelog.

  - A vulnerability was found in keylime. This security issue happens in some circumstances, due to some     improperly handled exceptions, there exists the possibility that a rogue agent could create errors on the     verifier that stopped attestation attempts for that host leaving it in an attested state but not verifying     that anymore. (CVE-2022-3500)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ghostscript-9.54.0-13.el9 build changelog.

  - A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This     issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN     device with gs. (CVE-2023-38559)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the unbound-1.16.2-3.el9 build changelog.

  - A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in     various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a     considerable number of non responsive nameservers. The attack starts by querying a resolver for a record     that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of     time/resources resolving records under a malicious delegation point where a considerable number of     unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that     continually look in the cache for resolved NS records in that delegation. This can lead to degraded     performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high     CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying     to resolve the record until hard limits are reached. Based on the nature of the attack and the replies,     different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance     when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and     limiting the number of times a delegation point can issue a cache lookup for missing records.
    (CVE-2022-3204)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the xorg-x11-server-1.20.11-15.el9 build changelog.

  - A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access     can occur in the SProcRenderCompositeGlyphs function. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-4008)

  - A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access     can occur in the SProcXFixesCreatePointerBarrier function. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability. (CVE-2021-4009)

  - A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access     can occur in the SProcScreenSaverSuspend function. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2021-4010)

  - A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access     can occur in the SwapCreateRegister function. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2021-4011)

  - A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry     function due to improper validation of the request length. (CVE-2022-2319)

  - A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of     ProcXkbSetDeviceInfo requests. The issue results from the lack of proper validation of user-supplied data,     which can result in a memory access past the end of an allocated buffer. This flaw allows an attacker to     escalate privileges and execute arbitrary code in the context of root. (CVE-2022-2320)

  - A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the     function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is     recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is     VDB-211051. (CVE-2022-3550)

  - A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this     issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It     is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211052.
    (CVE-2022-3551)

  - A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a     dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName     requests.. This issue can lead to local privileges elevation on systems where the X server is running     privileged and remote code execution for ssh X forwarding sessions. (CVE-2022-4283)

  - A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the     XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger     than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges     elevation on systems where the X server is running privileged and remote code execution for ssh X     forwarding sessions. This issue does not affect systems where client and server use the same byte order.
    (CVE-2022-46340)

  - A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab     request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead     to local privileges elevation on systems where the X server is running privileged and remote code     execution for ssh X forwarding sessions. (CVE-2022-46341)

  - A vulnerability was found in X.Org. This security flaw occurs because the handler for the     XvdiSelectVideoNotify request may write to memory after it has been freed. This issue can lead to local     privileges elevation on systems where the X se (CVE-2022-46342)

  - A vulnerability was found in X.Org. This security flaw occurs because the handler for the     ScreenSaverSetAttributes request may write to memory after it has been freed. This issue can lead to local     privileges elevation on systems where the X server is running privileged and remote code execution for ssh     X forwarding sessions. (CVE-2022-46343)

  - A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty     request has a length-validation issues, resulting in out-of-bounds memory reads and potential information     disclosure. This issue can lead to local privileges elevation on systems where the X server is running     privileged and remote code execution for ssh X forwarding sessions. (CVE-2022-46344)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libvpx-1.9.0-7.el9 build changelog.

  - VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. (CVE-2023-44488)

  - Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1     allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium     security severity: High) (CVE-2023-5217)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the polkit-0.117-9.el9 build changelog.

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the polkit-0.117-10.el9 build changelog.

  - There is a flaw in polkit which can allow an unprivileged user to cause polkit to crash, due to process     file descriptor exhaustion. The highest threat from this vulnerability is to availability. NOTE: Polkit     process outage duration is tied to the failing process being reaped and a new one being spawned     (CVE-2021-4115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libarchive-3.5.3-2.el9 build changelog.

  - Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx_lzma_alone_init.
    (CVE-2022-26280)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the nginx-1.20.1-10.el9 build changelog.

  - Application Layer Protocol Confusion (CVE-2021-3618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the python3.11-urllib3-1.26.12-2.el9 build changelog.

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libXpm-3.5.13-8.el9 build changelog.

  - runaway loop with width of 0 (#2160232) (CVE-2022-44617)

  - infinite loop on unclosed comments (#2160230) (CVE-2022-46285)

  - compression depends on $PATH (#2160242) (CVE-2022-4883)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the fetchmail-6.4.24-1.el9 build changelog.

  - report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf     va_list argument, which might allow mail servers to cause a denial of service or possibly have unspecified     other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic     platform results in an impact beyond an inconvenience to the client user. (CVE-2021-36386)

  - Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a     certain situation with IMAP and PREAUTH. (CVE-2021-39272)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the spamassassin-3.4.6-5.el9 build changelog.

  - In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run     system commands without any output or errors. With this, exploits can be injected in a number of     scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd     party .cf files from trusted places. (CVE-2020-1946)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the linux- firmware-20230726-138.el9 build changelog.

  - Cross-Process Information Leak (rhbz 2227156) (CVE-2023-20593)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the cyrus- imapd-3.4.1-6.el9 build changelog.

  - Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang)     via input that is mishandled during hash-table interaction. Because there are many insertions into a     single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16. (CVE-2021-33582)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the fribidi-1.0.10-6.el9.2 build changelog.

  - A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass     a specially crafted file to the Fribidi application, which leads to a possible memory leak or a denial of     service. (CVE-2022-25308)

  - A heap-based buffer overflow flaw was found in the Fribidi package and affects the     fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an     attacker to pass a specially crafted file to the Fribidi application with the '--caprtl' option, leading     to a crash and causing a denial of service. (CVE-2022-25309)

  - A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the     fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This flaw allows an attacker to pass a     specially crafted file to Fribidi, leading to a crash and causing a denial of service. (CVE-2022-25310)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libtpms-0.9.1-2.20211126git1ff6fe1f43.el9 build changelog.

  - out-of-bounds access when trying to resume the state of the vTPM (CVE-2021-3623)

  - out-of-bounds access via specially crafted TPM 2 command packets (CVE-2021-3746)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the mingw- binutils-2.39-2.el9 build changelog.

  - In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called     from the strip_main function in strip-new via a crafted file. (CVE-2022-38533)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the xorg-x11-server-Xwayland-21.1.3-5.el9 build changelog.

  - A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access     can occur in the SProcRenderCompositeGlyphs function. The highest threat from this vulnerability is to     data confidentiality and integrity as well as system availability. (CVE-2021-4008)

  - A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access     can occur in the SProcXFixesCreatePointerBarrier function. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability. (CVE-2021-4009)

  - A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access     can occur in the SProcScreenSaverSuspend function. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2021-4010)

  - A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access     can occur in the SwapCreateRegister function. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2021-4011)

  - A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry     function due to improper validation of the request length. (CVE-2022-2319)

  - A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of     ProcXkbSetDeviceInfo requests. The issue results from the lack of proper validation of user-supplied data,     which can result in a memory access past the end of an allocated buffer. This flaw allows an attacker to     escalate privileges and execute arbitrary code in the context of root. (CVE-2022-2320)

  - A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the     function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is     recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is     VDB-211051. (CVE-2022-3550)

  - A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this     issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It     is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211052.
    (CVE-2022-3551)

  - A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a     dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName     requests.. This issue can lead to local privileges elevation on systems where the X server is running     privileged and remote code execution for ssh X forwarding sessions. (CVE-2022-4283)

  - A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the     XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger     than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges     elevation on systems where the X server is running privileged and remote code execution for ssh X     forwarding sessions. This issue does not affect systems where client and server use the same byte order.
    (CVE-2022-46340)

  - A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab     request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead     to local privileges elevation on systems where the X server is running privileged and remote code     execution for ssh X forwarding sessions. (CVE-2022-46341)

  - A vulnerability was found in X.Org. This security flaw occurs because the handler for the     XvdiSelectVideoNotify request may write to memory after it has been freed. This issue can lead to local     privileges elevation on systems where the X se (CVE-2022-46342)

  - A vulnerability was found in X.Org. This security flaw occurs because the handler for the     ScreenSaverSetAttributes request may write to memory after it has been freed. This issue can lead to local     privileges elevation on systems where the X server is running privileged and remote code execution for ssh     X forwarding sessions. (CVE-2022-46343)

  - A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty     request has a length-validation issues, resulting in out-of-bounds memory reads and potential information     disclosure. This issue can lead to local privileges elevation on systems where the X server is running     privileged and remote code execution for ssh X forwarding sessions. (CVE-2022-46344)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the expat-2.2.10-10.el9 build changelog.

  - malformed 2 (CVE-2022-25235)

  - namespace-separator characters in xmlns[:prefix] attribute values can lead to arbitrary code execution     (CVE-2022-25236)

  - integer overflow in storeRawNames() (CVE-2022-25315)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the liblouis-3.16.1-5.el9 build changelog.

  - Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of     service via the lou_logFile function at logginc.c endpoint. (CVE-2023-26767)

  - Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of     service via the compileTranslationTable.c and lou_setDataPath functions. (CVE-2023-26768)

  - Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a     denial of service via the resolveSubtable function at compileTranslationTabel.c. (CVE-2023-26769)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the libreswan-4.12-1.el9 build changelog.

  - An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid     IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's     protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an     assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash and restart.
    NOTE: the earliest affected version is 3.20. (CVE-2023-38710)

  - An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with     ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN, a NULL pointer dereference causes a     crash and restart of the pluto daemon. NOTE: the earliest affected version is 4.6. (CVE-2023-38711)

  - An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational     Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA,     such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state causes the     pluto daemon to crash and restart. (CVE-2023-38712)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python- dateutil-2.8.1-7.el9 build changelog.

  - Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in     Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in     filenames in a TAR archive, a related issue to CVE-2001-1267. (CVE-2007-4559)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.11-3.11.4-1.el9 build changelog.

  - An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting     methods by supplying a URL that starts with blank characters. (CVE-2023-24329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the perl- CPAN-2.29-3.el9 build changelog.

  - CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.
    (CVE-2023-31484)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the squashfs-tools-4.4-10.git1.el9 build changelog.

  - unvalidated filepaths allow writing outside of destination rhbz#2000638 (CVE-2021-40153)

  - additional write outside destination directory exploit fix rhbz#2007304 (CVE-2021-41072)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the net-snmp-5.9.1-9.el9 build changelog.

  - handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer     Exception bug that can be used by a remote attacker (who has write access) to cause the instance to crash     via a crafted UDP packet, resulting in Denial of Service. (CVE-2022-44792)

  - handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL     Pointer Exception bug that can be used by a remote attacker to cause the instance to crash via a crafted     UDP packet, resulting in Denial of Service. (CVE-2022-44793)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libxml2-2.9.13-3.el9 build changelog.

  - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the     XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to     access an array at a negative 2GB offset, typically leading to a segmentation fault. (CVE-2022-40303)

  - An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a     hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be     provoked. (CVE-2022-40304)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the c-ares-1.19.1-1.el9 build changelog.

  - AutoTools does not set CARES_RANDOM_FILE during cross compilation [rhel-9] (CVE-2023-31124)

  - Buffer Underwrite in ares_inet_net_pton() [rhel-9] (CVE-2023-31130)

  - Insufficient randomness in generation of DNS query IDs [rhel-9] (CVE-2023-31147)

  - 0-byte UDP payload Denial of Service [rhel-9.3.0] (CVE-2023-32067)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libtiff-4.4.0-5.el9 build changelog.

  - Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
    (CVE-2022-2056, CVE-2022-2057, CVE-2022-2058)

  - There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1     (CVE-2022-2519)

  - A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at     tiffcrop.c:8621 that can cause program crash when reading a crafted input. (CVE-2022-2520)

  - It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at     tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while     processing crafted input. (CVE-2022-2521)

  - LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing     attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from     sources, the fix is available with commit 48d6ece8. (CVE-2022-2953)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.17-2.el9 build changelog.

  - An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting     methods by supplying a URL that starts with blank characters. (CVE-2023-24329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the linuxptp-3.1.1-2.el9 build changelog.

  - A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a     PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially     remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity     as well as system availability. This flaw affects linuxptp versions before 3.1.1, before 2.0.1, before     1.9.3, before 1.8.1, before 1.7.1, before 1.6.1 and before 1.5.1. (CVE-2021-3570)

  - A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian     architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to     cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality     and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.
    (CVE-2021-3571)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libnbd-1.12.5-1.el9 build changelog.

  - A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using     asynchronous nbd calls, nbdcopy was blindly treating the completion of an asynchronous command as     successful, rather than checking the *error parameter. This could result in the silent creation of a     corrupted destination image. (CVE-2022-0485)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the curl-7.76.1-26.el9 build changelog.

  - A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may     allow an attacker to pass on maliciously crafted user name and telnet options during server negotiation.
    The lack of proper input scrubbing allows an attacker to send content or perform option negotiation     without the application's intent. This vulnerability could be exploited if an application allows user     input, thereby enabling attackers to execute arbitrary code on the system. (CVE-2023-27533)

  - A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to     be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as     the first element to indicate a path relative to the user's home directory. Attackers can exploit this     flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a     server with a specific user. (CVE-2023-27534)

  - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that     can result in wrong credentials being used during subsequent transfers. Previously created connections are     kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as     CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not     included in the configuration match checks, causing them to match too easily. This could lead to libcurl     using the wrong credentials when performing a transfer, potentially allowing unauthorized access to     sensitive information. (CVE-2023-27535)

  - An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can     reuse previously established connections with incorrect user permissions due to a failure to check for     changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI     transfers and could potentially result in unauthorized access to sensitive information. The safest option     is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. (CVE-2023-27536)

  - An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously     established SSH connection despite the fact that an SSH option was modified, which should have prevented     reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if     the configurations match. However, two SSH settings were omitted from the configuration check, allowing     them to match easily, potentially leading to the reuse of an inappropriate connection. (CVE-2023-27538)

  - An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of     wildcard patterns when listed as Subject Alternative Name in TLS server certificates. curl can be built     to use its own name matching function for TLS rather than one provided by a TLS library. This private     wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a     result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before     used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to     pattern match, but the wildcard check in curl could still check for `x*`, which would match even though     the IDN name most likely contained nothing even resembling an `x`. (CVE-2023-28321)

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libxml2-2.9.13-2.el9 build changelog.

  - In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*)     don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a     victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for     example libxslt through 1.1.35, is affected as well. (CVE-2022-29824)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the mod_auth_openidc-2.4.9.1-1.el9 build changelog.

  - open redirect in oidc_validate_redirect_url() [rhel-9.0] (CVE-2021-32786)

  - hardcoded static IV and AAD with a reused key in AES GCM encryption [rhel-9.0] (CVE-2021-32791)

  - XSS when using OIDCPreservePost On [rhel-9.0] (CVE-2021-32792)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the perl- HTTP-Tiny-0.076-461.el9 build changelog.

  - HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure     default TLS configuration where users must opt in to verify certificates. (CVE-2023-31486)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssh-8.7p1-34.el9 build changelog.

  - The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path,     leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in     /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an     incomplete fix for CVE-2016-10009. (CVE-2023-38408)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ghostscript-9.54.0-4.el9 build changelog.

  - A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter     by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute     arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3781)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the expat-2.5.0-1.el9 build changelog.

  - In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in     XML_ExternalEntityParserCreate in out-of-memory situations. (CVE-2022-43680)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the cyrus- sasl-2.1.27-20.el9 build changelog.

  - In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL     INSERT or UPDATE statement. (CVE-2022-24407)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the bind-9.16.23-7.el9 build changelog.

  - BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 ->     9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including     Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL.
    The cache could become poisoned with incorrect records leading to queries being made to the wrong servers,     which might also result in false information being returned to clients. (CVE-2021-25220)

  - BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported     Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT     status for an indefinite period of time, even after the client has terminated the connection.
    (CVE-2022-0396)

  - By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the     resolver's performance, effectively denying legitimate clients access to the DNS resolution service.
    (CVE-2022-2795)

  - By sending specific queries to the resolver, an attacker can cause named to crash. (CVE-2022-3080)

  - By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can     trigger a small memory leak. It is possible to gradually erode available memory to the point where named     crashes for lack of resources. (CVE-2022-38177)

  - By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can     trigger a small memory leak. It is possible to gradually erode available memory to the point where named     crashes for lack of resources. (CVE-2022-38178)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libtiff-4.4.0-10.el9 build changelog.

  - loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted     TIFF image. (CVE-2023-26965)

  - libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian     TIFF file and specifies the output to be big-endian. (CVE-2023-26966)

  - A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file.
    This flaw allows a local attacker to craft specific input data that can cause the program to dereference a     NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service.
    (CVE-2023-2731)

  - A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path     or a path that requires permissions like /dev/null) while specifying zones. (CVE-2023-3316)

  - A memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a     TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes     this memory leak issue, resulting an application crash, eventually leading to a denial of service.
    (CVE-2023-3576)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libtpms-0.8.2-0.20210301git729fc6a4ca.el9.6 build changelog.

  - out-of-bounds access when trying to resume the state of the vTPM (CVE-2021-3623)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the xmlrpc-c-1.51.0-16.el9 build changelog.

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the python- urllib3-1.26.5-4.el9 build changelog.

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
191334	CentOS 9 : LibRaw-0.21.1-1.el9	medium
191333	CentOS 9 : lua-5.4.4-3.el9	critical
191332	CentOS 9 : libmicrohttpd-0.9.72-5.el9	medium
191330	CentOS 9 : pesign-115-6.el9	medium
191329	CentOS 9 : keylime-6.5.2-1.el9	medium
191328	CentOS 9 : ghostscript-9.54.0-13.el9	medium
191327	CentOS 9 : unbound-1.16.2-3.el9	high
191326	CentOS 9 : xorg-x11-server-1.20.11-15.el9	high
191325	CentOS 9 : libvpx-1.9.0-7.el9	high
191324	CentOS 9 : polkit-0.117-9.el9	medium
191323	CentOS 9 : polkit-0.117-10.el9	medium
191322	CentOS 9 : libarchive-3.5.3-2.el9	medium
191321	CentOS 9 : nginx-1.20.1-10.el9	high
191320	CentOS 9 : python3.11-urllib3-1.26.12-2.el9	high
191319	CentOS 9 : libXpm-3.5.13-8.el9	high
191318	CentOS 9 : fetchmail-6.4.24-1.el9	medium
191317	CentOS 9 : spamassassin-3.4.6-5.el9	critical
191316	CentOS 9 : linux-firmware-20230726-138.el9	medium
191315	CentOS 9 : cyrus-imapd-3.4.1-6.el9	high
191314	CentOS 9 : fribidi-1.0.10-6.el9.2	high
191313	CentOS 9 : libtpms-0.9.1-2.20211126git1ff6fe1f43.el9	medium
191312	CentOS 9 : mingw-binutils-2.39-2.el9	medium
191311	CentOS 9 : xorg-x11-server-Xwayland-21.1.3-5.el9	high
191310	CentOS 9 : expat-2.2.10-10.el9	critical
191309	CentOS 9 : liblouis-3.16.1-5.el9	high
191308	CentOS 9 : libreswan-4.12-1.el9	medium
191307	CentOS 9 : python-dateutil-2.8.1-7.el9	medium
191306	CentOS 9 : python3.11-3.11.4-1.el9	high
191305	CentOS 9 : perl-CPAN-2.29-3.el9	high
191304	CentOS 9 : squashfs-tools-4.4-10.git1.el9	high
191303	CentOS 9 : net-snmp-5.9.1-9.el9	medium
191302	CentOS 9 : libxml2-2.9.13-3.el9	high
191301	CentOS 9 : c-ares-1.19.1-1.el9	medium
191300	CentOS 9 : libtiff-4.4.0-5.el9	medium
191299	CentOS 9 : python3.9-3.9.17-2.el9	high
191298	CentOS 9 : linuxptp-3.1.1-2.el9	high
191297	CentOS 9 : libnbd-1.12.5-1.el9	medium
191296	CentOS 9 : curl-7.76.1-26.el9	high
191295	CentOS 9 : libxml2-2.9.13-2.el9	medium
191294	CentOS 9 : mod_auth_openidc-2.4.9.1-1.el9	medium
191293	CentOS 9 : perl-HTTP-Tiny-0.076-461.el9	high
191292	CentOS 9 : openssh-8.7p1-34.el9	critical
191290	CentOS 9 : ghostscript-9.54.0-4.el9	critical
191289	CentOS 9 : expat-2.5.0-1.el9	high
191288	CentOS 9 : cyrus-sasl-2.1.27-20.el9	high
191287	CentOS 9 : bind-9.16.23-7.el9	medium
191286	CentOS 9 : libtiff-4.4.0-10.el9	medium
191284	CentOS 9 : libtpms-0.8.2-0.20210301git729fc6a4ca.el9.6	medium
191283	CentOS 9 : xmlrpc-c-1.51.0-16.el9	critical
191282	CentOS 9 : python-urllib3-1.26.5-4.el9	high

Detections

Analytics

CentOS Local Security Checks Family for Nessus

medium

critical

medium

medium

medium

medium

high

high

high

medium

medium

medium

high

high

high

medium

critical

medium

high

high

medium

medium

high

critical

high

medium

medium

high

high

high

medium

high

medium

medium

high

high

medium

high

medium

medium

high

critical

critical

high

high

medium

medium

medium

critical

high