The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2381 advisory.

  - When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a     potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox     ESR < 68.9. (CVE-2020-12405)

  - Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting     in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This     vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. (CVE-2020-12406)

  - Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and     Firefox ESR < 68.9. (CVE-2020-12410)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2378 advisory.

  - When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a     potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox     ESR < 68.9. (CVE-2020-12405)

  - Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting     in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This     vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. (CVE-2020-12406)

  - Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and     Firefox ESR < 68.9. (CVE-2020-12410)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2344 advisory.

  - A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches     performed when processing referrals can, through the use of specially crafted referrals, cause a recursing     server to issue a very large number of fetches in an attempt to process the referral. This has at least     two potential effects: The performance of the recursing server can potentially be degraded by the     additional work required to perform these fetches, and The attacker can exploit this behavior to use the     recursing server as a reflector in a reflection attack with a high amplification factor. (CVE-2020-8616)

  - Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an     inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the     server. Since BIND, by default, configures a local session key even on servers whose configuration does     not otherwise make use of it, almost all current BIND servers are vulnerable. In releases of BIND dating     from March 2018 and after, an assertion check in tsig.c detects this inconsistent state and deliberately     exits. Prior to the introduction of the check the server would continue operating in an inconsistent     state, with potentially harmful results. (CVE-2020-8617)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2337 advisory.

  - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix     for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker     cannot control which one). Git uses external credential helper programs to store and retrieve passwords     or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are     considered illegal as of the recently published Git versions can cause Git to send a blank pattern to     helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and     will return some unspecified stored password, leaking the password to an attacker's server. The     vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look     rather suspicious; the likely vector would be through systems which automatically clone URLs not visible     to the user, such as Git submodules, or package systems built around Git. The root of the problem is in     Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the     vulnerability in practice depends on which helpers are in use. Credential helpers which are known to     trigger the vulnerability: - Git's store helper - Git's cache helper - the osxkeychain helper that     ships in Git's contrib directory Credential helpers which are known to be safe even with vulnerable     versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to     trigger the vulnerability. (CVE-2020-11008)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2334 advisory.

  - libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.
    (CVE-2020-11521)

  - libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.
    (CVE-2020-11523)

  - libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.
    (CVE-2020-11524)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2103 advisory.

  - A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7.
    This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into     the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO     restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate     that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer     dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network     user to crash the system kernel, resulting in a denial of service. (CVE-2020-10711)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2050 advisory.

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76,     and Thunderbird < 68.8.0. (CVE-2020-12387)

  - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a     request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the     command into a terminal, it could have resulted in the disclosure of local files. This vulnerability     affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12392)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR     68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12395)

  - By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender     email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0. (CVE-2020-12397)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-6831)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2049 advisory.

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76,     and Thunderbird < 68.8.0. (CVE-2020-12387)

  - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a     request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the     command into a terminal, it could have resulted in the disclosure of local files. This vulnerability     affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12392)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR     68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12395)

  - By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender     email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0. (CVE-2020-12397)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-6831)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2040 advisory.

  - An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid     calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's     being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a     new member to the stack. When adding a new member, there is no check to ensure that the stack won't     overflow. (CVE-2019-12519)

  - An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use     Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as     domain, uri, and qop. Squid checks if this token's value starts with a quote and ends with one. If so, it     performs a memcpy of its length minus 2. Squid never checks whether the value is just a single quote     (which would satisfy its requirements), leading to a memcpy of its length minus 1. (CVE-2019-12525)

  - An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest     Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the     attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if     the pooled token credentials are freed (instead of replayed as valid credentials). (CVE-2020-11945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2037 advisory.

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76,     and Thunderbird < 68.8.0. (CVE-2020-12387)

  - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a     request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the     command into a terminal, it could have resulted in the disclosure of local files. This vulnerability     affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12392)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR     68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12395)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-6831)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2036 advisory.

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76,     and Thunderbird < 68.8.0. (CVE-2020-12387)

  - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a     request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the     command into a terminal, it could have resulted in the disclosure of local files. This vulnerability     affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12392)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR     68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12395)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-6831)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0984 advisory.

  - It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data     received from a remote LAN party, which may lead to buffer overflows and potentially to remote code     execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This     problem is fixed in version 1.8.19. (CVE-2020-5208)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1962 advisory.

  - In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two     content-length headers, it ignored the first header. When the second content-length value was set to zero,     the request body was interpreted as a pipelined request. (CVE-2020-10108)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1561 advisory.

  - In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two     content-length headers, it ignored the first header. When the second content-length value was set to zero,     the request body was interpreted as a pipelined request. (CVE-2020-10108)

  - In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a     content-length and a chunked encoding header, the content-length took precedence and the remainder of the     request body was interpreted as a pipelined request. (CVE-2020-10109)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1512 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported     versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-2754, CVE-2020-2755)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-2756, CVE-2020-2757)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-2773)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java     SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause     a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-2781)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP     Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded:
    8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability can only be exploited by supplying data to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.
    (CVE-2020-2800)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE,     Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2020-2803, CVE-2020-2805)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-2830)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1511 advisory.

  - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. Git uses external credential helper programs to store and retrieve     passwords or other credentials from secure storage provided by the operating system. Specially-crafted     URLs that contain an encoded newline can inject unintended values into the credential helper protocol     stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for     an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the     former being sent to the latter. There are no restrictions on the relationship between the two, meaning     that an attacker can craft a URL that will present stored credentials for any host to a host of their     choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the     affected URLs look rather suspicious; the likely vector would be through systems which automatically clone     URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has     been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to     backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks     for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched     versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.
    (CVE-2020-5260)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1509 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported     versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-2754, CVE-2020-2755)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-2756, CVE-2020-2757)

  - Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are     affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result     in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized     read access to a subset of Java SE accessible data. Note: Applies to client and server deployment of Java.
    This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java     applets. It can also be exploited by supplying data to APIs in the specified Component without using     sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
    (CVE-2020-2767)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-2773)

  - Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are     affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result     in unauthorized read access to a subset of Java SE accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-2778)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java     SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause     a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-2781)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP     Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded:
    8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability can only be exploited by supplying data to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.
    (CVE-2020-2800)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE,     Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2020-2803, CVE-2020-2805)

  - Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are     affected are Java SE: 11.0.6 and 14. Easily exploitable vulnerability allows unauthenticated attacker with     network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Java SE accessible data.
    Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component     without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web     service. (CVE-2020-2816)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-2830)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1507 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-2756, CVE-2020-2757)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-2773)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java     SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause     a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-2781)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP     Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded:
    8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability can only be exploited by supplying data to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.
    (CVE-2020-2800)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE,     Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2020-2803, CVE-2020-2805)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-2830)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1489 advisory.

  - Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-     free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects     Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6819)

  - Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We     are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird <     68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6820)

  - When reading from areas partially or fully outside the source resource with WebGL's     <code>copyTexSubImage</code> method, the specification requires the returned values be zero. Previously,     this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability     affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. (CVE-2020-6821)

  - On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in     <code>GMPDecodeData</code>. It is possible that with enough effort this could have been exploited to run     arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.
    (CVE-2020-6822)

  - Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs     present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code. This     vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. (CVE-2020-6825)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1524 advisory.

  - The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to     RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack     will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance     between the end of the PIE binary's read-write segment and the start of the stack becomes small enough     that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5.
    This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to     i386 based systems. (CVE-2017-1000371)

  - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a     certain upper-bound check, leading to a buffer overflow. (CVE-2019-17666)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1508 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-2756, CVE-2020-2757)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-2773)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java     SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause     a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-2781)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP     Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded:
    8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability can only be exploited by supplying data to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.
    (CVE-2020-2800)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE,     Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2020-2803, CVE-2020-2805)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-2830)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1506 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported     versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-2754, CVE-2020-2755)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-2756, CVE-2020-2757)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-2773)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java     SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause     a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-2781)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP     Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded:
    8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability can only be exploited by supplying data to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.
    (CVE-2020-2800)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE,     Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2020-2803, CVE-2020-2805)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-2830)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1488 advisory.

  - Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-     free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects     Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6819)

  - Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We     are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird <     68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6820)

  - When reading from areas partially or fully outside the source resource with WebGL's     <code>copyTexSubImage</code> method, the specification requires the returned values be zero. Previously,     this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability     affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. (CVE-2020-6821)

  - On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in     <code>GMPDecodeData</code>. It is possible that with enough effort this could have been exploited to run     arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.
    (CVE-2020-6822)

  - Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs     present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code. This     vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. (CVE-2020-6825)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1429 advisory.

  - When reading from areas partially or fully outside the source resource with WebGL's     <code>copyTexSubImage</code> method, the specification requires the returned values be zero. Previously,     this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability     affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. (CVE-2020-6821)

  - On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in     <code>GMPDecodeData</code>. It is possible that with enough effort this could have been exploited to run     arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.
    (CVE-2020-6822)

  - Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs     present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code. This     vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. (CVE-2020-6825)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1403 advisory.

  - In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer     overflow in later code. (CVE-2020-8608)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1349 advisory.

  - telnet-server: no bounds checks in nextitem() function     allows to remotely execute arbitrary code     (CVE-2020-10188)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1339 advisory.

  - Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-     free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects     Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6819)

  - Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We     are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird <     68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6820)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1335 advisory.

  - utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via     short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions.
    (CVE-2020-10188)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1331 advisory.

  - It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data     received from a remote LAN party, which may lead to buffer overflows and potentially to remote code     execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This     problem is fixed in version 1.8.19. (CVE-2020-5208)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1190 advisory.

  - The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which     allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
    (CVE-2015-8035)

  - Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82,     allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors     related to the XPointer range-to function. (CVE-2016-5131)

  - Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products,     allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2017-15412)

  - The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of     service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict     memory usage to what is required for a legitimate file. (CVE-2017-18258)

  - A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2     through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case.
    Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable     to a denial of service attack due to a crash of the application. (CVE-2018-14404)

  - libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite     loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different     vulnerability than CVE-2015-8035 and CVE-2018-9251. (CVE-2018-14567)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1189 advisory.

  - libqb before 1.0.5 allows local users to overwrite arbitrary files via a symlink attack, because it uses     predictable filenames (under /dev/shm and /tmp) without O_EXCL. (CVE-2019-12779)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1185 advisory.

  - A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28 allows remote attackers to     cause a denial of service (application crash) or possibly have unspecified other impact via a crafted     audio file. The vulnerability can be triggered by the executable sndfile-deinterleave. (CVE-2018-13139)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1181 advisory.

  - unzip: overlapping of files in ZIP container leads to     denial of service (CVE-2019-13232)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1180 advisory.

  - ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in the function ReadDDSInfo in     coders/dds.c, which allows attackers to cause a denial of service. (CVE-2017-1000476)

  - The ReadXWDImage function in coders\xwd.c in ImageMagick 7.0.5-6 has a memory leak vulnerability that can     cause memory exhaustion via a crafted length (number of color-map entries) field in the header of an XWD     file. (CVE-2017-11166)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which     allows attackers to cause a denial of service. (CVE-2017-12805)

  - In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which     allows attackers to cause a denial of service. (CVE-2017-12806)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     ReadPCDImage in coders/pcd.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18251)

  - An issue was discovered in ImageMagick 7.0.7. The MogrifyImageList function in MagickWand/mogrify.c allows     attackers to cause a denial of service (assertion failure and application exit in ReplaceImageInList) via     a crafted file. (CVE-2017-18252)

  - An issue was discovered in ImageMagick 7.0.7. A memory leak vulnerability was found in the function     WriteGIFImage in coders/gif.c, which allow remote attackers to cause a denial of service via a crafted     file. (CVE-2017-18254)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted MIFF image file. (CVE-2017-18271)

  - In ImageMagick 7.0.7-16 Q16 x86_64 2017-12-22, an infinite loop vulnerability was found in the function     ReadTXTImage in coders/txt.c, which allows attackers to cause a denial of service (CPU exhaustion) via a     crafted image file that is mishandled in a GetImageIndexInList call. (CVE-2017-18273)

  - In ImageMagick 7.0.7-28, there is an infinite loop in the ReadOneMNGImage function of the coders/png.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted mng     file. (CVE-2018-10177)

  - ImageMagick version 7.0.7-28 contains a memory leak in WriteTIFFImage in coders/tiff.c. (CVE-2018-10804)

  - ImageMagick version 7.0.7-28 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. (CVE-2018-10805)

  - In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in     coders/dcm.c, which allows attackers to cause a denial of service via a crafted DCM image file.
    (CVE-2018-11656)

  - In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12599)

  - In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out     of bounds write via a crafted file. (CVE-2018-12600)

  - In ImageMagick 7.0.8-4, there is a memory leak in the XMagickCommand function in MagickCore/animate.c.
    (CVE-2018-13153)

  - ImageMagick 7.0.8-4 has a memory leak for a colormap in WriteMPCImage in coders/mpc.c. (CVE-2018-14434)

  - ImageMagick 7.0.8-4 has a memory leak in DecodeImage in coders/pcd.c. (CVE-2018-14435)

  - ImageMagick 7.0.8-4 has a memory leak in ReadMIFFImage in coders/miff.c. (CVE-2018-14436)

  - ImageMagick 7.0.8-4 has a memory leak in parse8BIM in coders/meta.c. (CVE-2018-14437)

  - In ImageMagick 7.0.8-11 Q16, a tiny input file 0x50 0x36 0x36 0x36 0x36 0x4c 0x36 0x38 0x36 0x36 0x36 0x36     0x36 0x36 0x1f 0x35 0x50 0x00 can result in a hang of several minutes during which CPU and memory     resources are consumed until ultimately an attempted large memory allocation fails. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted file. (CVE-2018-15607)

  - In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in     MagickCore/log.c. (CVE-2018-16328)

  - ImageMagick 7.0.8-5 has a memory leak vulnerability in the function ReadOneJNGImage in coders/png.c.
    (CVE-2018-16640)

  - The function InsertRow in coders/cut.c in ImageMagick 7.0.7-37 allows remote attackers to cause a denial     of service via a crafted image file due to an out-of-bounds write. (CVE-2018-16642)

  - The functions ReadDCMImage in coders/dcm.c, ReadPWPImage in coders/pwp.c, ReadCALSImage in coders/cals.c,     and ReadPICTImage in coders/pict.c in ImageMagick 7.0.8-4 do not check the return value of the fputc     function, which allows remote attackers to cause a denial of service via a crafted image file.
    (CVE-2018-16643)

  - There is a missing check for length in the functions ReadDCMImage of coders/dcm.c and ReadPICTImage of     coders/pict.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of service via a     crafted image. (CVE-2018-16644)

  - There is an excessive memory allocation issue in the functions ReadBMPImage of coders/bmp.c and     ReadDIBImage of coders/dib.c in ImageMagick 7.0.8-11, which allows remote attackers to cause a denial of     service via a crafted image file. (CVE-2018-16645)

  - In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an     attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted     file. (CVE-2018-16749)

  - In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c     was found. (CVE-2018-16750)

  - ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePDBImage in coders/pdb.c. (CVE-2018-17966)

  - ImageMagick 7.0.7-28 has a memory leak vulnerability in ReadBGRImage in coders/bgr.c. (CVE-2018-17967)

  - ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePCXImage in coders/pcx.c. (CVE-2018-18016)

  - In ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ReadBMPImage function of the coders/bmp.c     file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp     file. (CVE-2018-18024)

  - There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the     function ProcessMSLScript of coders/msl.c in GraphicsMagick before 1.3.31. (CVE-2018-18544)

  - In coders/bmp.c in ImageMagick before 7.0.8-16, an input file can result in an infinite loop and hang,     with high CPU and memory consumption. Remote attackers could leverage this vulnerability to cause a denial     of service via a crafted file. (CVE-2018-20467)

  - WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of     service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact     via a crafted file. (CVE-2018-8804)

  - ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions     (coders/tiff.c), which results in a hang (tens of minutes) with a tiny PoC file. Remote attackers could     leverage this vulnerability to cause a denial of service via a crafted tiff file. (CVE-2018-9133)

  - An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the     formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end     of the buffer or to crash the program. (CVE-2019-10131)

  - In ImageMagick 7.0.8-36 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or information disclosure via a     crafted image file. (CVE-2019-10650)

  - The cineon parsing component in ImageMagick 7.0.8-26 Q16 allows attackers to cause a denial-of-service     (uncontrolled resource consumption) by crafting a Cineon image with an incorrect claimed image size. This     occurs because ReadCINImage in coders/cin.c lacks a check for insufficient image data in a file.
    (CVE-2019-11470)

  - ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the     header indicates neither LSB first nor MSB first. (CVE-2019-11472)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of     coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure     via a crafted image file. (CVE-2019-11597)

  - In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of     coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via     a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c. (CVE-2019-11598)

  - A NULL pointer dereference in the function ReadPANGOImage in coders/pango.c and the function ReadVIDImage     in coders/vid.c in ImageMagick 7.0.8-34 allows remote attackers to cause a denial of service via a crafted     image. (CVE-2019-12974)

  - ImageMagick 7.0.8-34 has a memory leak vulnerability in the WriteDPXImage function in coders/dpx.c.
    (CVE-2019-12975)

  - ImageMagick 7.0.8-34 has a memory leak in the ReadPCLImage function in coders/pcl.c. (CVE-2019-12976)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the ReadPANGOImage function in     coders/pango.c. (CVE-2019-12978)

  - ImageMagick 7.0.8-34 has a use of uninitialized value vulnerability in the SyncImageSettings function in     MagickCore/image.c. This is related to AcquireImage in magick/image.c. (CVE-2019-12979)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadBMPImage in coders/bmp.c.
    (CVE-2019-13133)

  - ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadVIFFImage in     coders/viff.c. (CVE-2019-13134)

  - ImageMagick before 7.0.8-50 has a use of uninitialized value vulnerability in the function ReadCUTImage     in coders/cut.c. (CVE-2019-13135)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a width of zero is mishandled. (CVE-2019-13295)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in     AdaptiveThresholdImage because a height of zero is mishandled. (CVE-2019-13297)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling columns. (CVE-2019-13300)

  - ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
    (CVE-2019-13301)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced assignment. (CVE-2019-13304)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a     misplaced strncpy and an off-by-one error. (CVE-2019-13305)

  - ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of     off-by-one errors. (CVE-2019-13306)

  - ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages     because of mishandling rows. (CVE-2019-13307)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage     error in CLIListOperatorImages in MagickWand/operation.c. (CVE-2019-13309)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in     MagickWand/mogrify.c. (CVE-2019-13310)

  - ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
    (CVE-2019-13311)

  - ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
    (CVE-2019-13454)

  - In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in     the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14980)

  - In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in     the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
    (CVE-2019-14981)

  - The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows     attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in     ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than     CVE-2019-11472. (CVE-2019-15139)

  - coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-     free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that     is mishandled in ReadImage in MagickCore/constitute.c. (CVE-2019-15140)

  - WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service     (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to     TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in     tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
    (CVE-2019-15141)

  - ImageMagick 7.0.8-35 has a memory leak in magick/xwindow.c, related to XCreateImage. (CVE-2019-16708)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dps.c, as demonstrated by XCreateImage. (CVE-2019-16709)

  - ImageMagick 7.0.8-35 has a memory leak in coders/dot.c, as demonstrated by AcquireMagickMemory in     MagickCore/memory.c. (CVE-2019-16710)

  - ImageMagick 7.0.8-40 has a memory leak in Huffman2DEncodeImage in coders/ps2.c. (CVE-2019-16711)

  - ImageMagick 7.0.8-43 has a memory leak in Huffman2DEncodeImage in coders/ps3.c, as demonstrated by     WritePS3Image. (CVE-2019-16712)

  - ImageMagick 7.0.8-43 has a memory leak in coders/dot.c, as demonstrated by PingImage in     MagickCore/constitute.c. (CVE-2019-16713)

  - ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.
    (CVE-2019-17540)

  - ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the     error manager is mishandled in coders/jpeg.c. (CVE-2019-17541)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of     coders/sgi.c. (CVE-2019-19948)

  - In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of     coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare. (CVE-2019-19949)

  - In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c. (CVE-2019-7175)

  - In ImageMagick before 7.0.8-25 and GraphicsMagick through 1.3.31, several memory leaks exist in     WritePDFImage in coders/pdf.c. (CVE-2019-7397)

  - In ImageMagick before 7.0.8-25, a memory leak exists in WriteDIBImage in coders/dib.c. (CVE-2019-7398)

  - In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of     coders/ps.c, which allows an attacker to cause a denial of service or code execution via a crafted image     file. (CVE-2019-9956)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1178 advisory.

  - Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a     .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.
    (CVE-2018-17828)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1176 advisory.

  - avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source     addresses that are not on-link, which allows remote attackers to cause a denial of service (traffic     amplification) and may cause information leakage by obtaining potentially sensitive information from the     responding device via port-5353 UDP packets. NOTE: this may overlap CVE-2015-2809. (CVE-2017-6519)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1175 advisory.

  - The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to     cause information disclosure (heap-based buffer over-read) via a crafted audio file. (CVE-2018-11439)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1173 advisory.

  - okular version 18.08 and earlier contains a Directory Traversal vulnerability in function     unpackDocumentArchive(...) in core/document.cpp that can result in Arbitrary file creation on the user     workstation. This attack appear to be exploitable via he victim must open a specially crafted Okular     archive. This issue appears to have been corrected in version 18.08.1 (CVE-2018-1000801)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1172 advisory.

  - QXmlStream in Qt 5.x before 5.11.3 has a double-free or corruption during parsing of a specially crafted     illegal XML document. (CVE-2018-15518)

  - An issue was discovered in Qt before 5.11.3. A malformed SVG image causes a segmentation fault in     qsvghandler.cpp. (CVE-2018-19869)

  - An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in     QGifHandler resulting in a segmentation fault. (CVE-2018-19870)

  - An issue was discovered in Qt before 5.11.3. There is QTgaFile Uncontrolled Resource Consumption.
    (CVE-2018-19871)

  - An issue was discovered in Qt 5.11. A malformed PPM image causes a division by zero and a crash in     qppmhandler.cpp. (CVE-2018-19872)

  - An issue was discovered in Qt before 5.11.3. QBmpHandler has a buffer overflow via BMP data.
    (CVE-2018-19873)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1167 advisory.

  - A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could     connect to the nbdkit service and cause it to perform a large amount of work in initializing backend     plugins, by simply opening a connection to the service. This vulnerability could cause resource     consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.
    (CVE-2019-14850)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1151 advisory.

  - LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on     various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a     programmable turtle vector graphics script, which can be manipulated into executing arbitrary python     commands. By using the document event feature to trigger LibreLogo to execute python contained within a     document a malicious document could be constructed which would execute arbitrary python commands silently     without warning. In the fixed versions, LibreLogo cannot be called from a document event handler. This     issue affects: Document Foundation LibreOffice versions prior to 6.2.5. (CVE-2019-9848)

  - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to     retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to     disable LibreOffice's ability to include remote resources within a document. A flaw existed where bullet     graphics were omitted from this protection prior to version 6.2.5. This issue affects: Document Foundation     LibreOffice versions prior to 6.2.5. (CVE-2019-9849)

  - LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can     execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a     feature where documents can specify that pre-installed scripts can be executed on various document script     events such as mouse-over, etc. Protection was added, to address CVE-2019-9848, to block calling LibreLogo     from script event handers. However an insufficient url validation vulnerability in LibreOffice allowed     malicious to bypass that protection and again trigger calling LibreLogo from script event handlers. This     issue affects: Document Foundation LibreOffice versions prior to 6.2.6. (CVE-2019-9850)

  - LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can     execute arbitrary python commands contained with the document it is launched from. Protection was added,     to address CVE-2019-9848, to block calling LibreLogo from document event script handers, e.g. mouse over.
    However LibreOffice also has a separate feature where documents can specify that pre-installed scripts can     be executed on various global script events such as document-open, etc. In the fixed versions, global     script event handlers are validated equivalently to document script event handlers. This issue affects:
    Document Foundation LibreOffice versions prior to 6.2.6. (CVE-2019-9851)

  - LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various     script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under     the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was     added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary     locations on the file system could be executed. However this new protection could be bypassed by a URL     encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded     before further processing. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
    (CVE-2019-9852)

  - LibreOffice documents can contain macros. The execution of those macros is controlled by the document     security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in     how the urls to the macros within the document were processed and categorized, resulting in the     possibility to construct a document where macro execution bypassed the security settings. The documents     were correctly detected as containing macros, and prompted the user to their existence within the     documents, but macros within the document were subsequently not controlled by the security settings     allowing arbitrary macro execution This issue affects: LibreOffice 6.2 series versions prior to 6.2.7;
    LibreOffice 6.3 series versions prior to 6.3.1. (CVE-2019-9853)

  - LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various     script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under     the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was     added, to address CVE-2019-9852, to avoid a directory traversal attack where scripts in arbitrary     locations on the file system could be executed by employing a URL encoding attack to defeat the path     verification step. However this protection could be bypassed by taking advantage of a flaw in how     LibreOffice assembled the final script URL location directly from components of the passed in path as     opposed to solely from the sanitized output of the path verification step. This issue affects: Document     Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1. (CVE-2019-9854)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1138 advisory.

  - An issue was discovered in GNU gettext 0.19.8. There is a double free in default_add_message in read-     catalog.c, related to an invalid free in po_gram_parse in po-gram-gen.y, as demonstrated by lt-msgfmt.
    (CVE-2018-18751)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1135 advisory.

  - A flaw was found in polkit before version 0.116. The implementation of the     polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for     authentication and trigger authentication of unrelated processes owned by other users. This may result in     a local DoS and information disclosure. (CVE-2018-1116)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1132 advisory.

  - http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not     correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An     attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix     (e.g., pythonicexample.com to steal cookies for example.com). When a program uses     http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing     cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before     3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3. (CVE-2018-20852)

  - An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x     through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An     application that uses the email module and implements some kind of checks on the From/To headers of a     message could be tricked into accepting an email address that should be denied. An attack may be the same     as in CVE-2019-11340; however, this CVE applies to Python more generally. (CVE-2019-16056)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1131 advisory.

  - http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not     correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An     attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix     (e.g., pythonicexample.com to steal cookies for example.com). When a program uses     http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing     cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before     3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3. (CVE-2018-20852)

  - An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x     through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An     application that uses the email module and implements some kind of checks on the From/To headers of a     message could be tricked into accepting an email address that should be denied. An attack may be the same     as in CVE-2019-11340; however, this CVE applies to Python more generally. (CVE-2019-16056)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1126 advisory.

  - An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ..
    directory traversal in a mailbox name. (CVE-2018-14355)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1121 advisory.

  - In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured     with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding     when verifying the user's credentials. If the header value is not present in the charset conversion table,     a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example,     'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of     one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the     process would crash which could be used as a Denial of Service attack. In the more likely case, this     memory is already reserved for future use and the issue has no effect at all. (CVE-2017-15710)

  - A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an     out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is     considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is     classified as low risk for common server usage. (CVE-2018-1301)

  - In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before     decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since     the expiry time is loaded when the session is decoded. (CVE-2018-17199)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1116 advisory.

  - tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which     can lead to a DoS or potential execute arbitrary code. (CVE-2020-7039)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1113 advisory.

  - rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the     user to execute any command with the permissions of the shell. (CVE-2019-9924)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1112 advisory.

  - An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before     7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request     data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2018-5712. (CVE-2018-10547)

  - An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before     7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.
    (CVE-2018-5712)

  - In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a     stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function     in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string. (CVE-2018-7584)

  - An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated     areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c. (CVE-2019-9024)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
137150	CentOS 7 : firefox (RHSA-2020:2381)	high
137149	CentOS 6 : firefox (RHSA-2020:2378)	high
137007	CentOS 7 : bind (RHSA-2020:2344)	high
137006	CentOS 7 : git (RHSA-2020:2337)	high
137005	CentOS 7 : freerdp (RHSA-2020:2334)	medium
136777	CentOS 6 : kernel (RHSA-2020:2103)	medium
136776	CentOS 7 : thunderbird (RHSA-2020:2050)	critical
136775	CentOS 6 : thunderbird (RHSA-2020:2049)	critical
136774	CentOS 7 : squid (RHSA-2020:2040)	critical
136773	CentOS 7 : firefox (RHSA-2020:2037)	critical
136772	CentOS 6 : firefox (RHSA-2020:2036)	critical
136771	CentOS 7 : ipmitool (RHSA-2020:0984)	high
136200	CentOS 6 : python-twisted-web (RHSA-2020:1962)	critical
136199	CentOS 7 : python-twisted-web (RHSA-2020:1561)	critical
136198	CentOS 7 : java-1.8.0-openjdk (RHSA-2020:1512)	high
136197	CentOS 7 : git (RHSA-2020:1511)	high
136196	CentOS 7 : java-11-openjdk (RHSA-2020:1509)	high
136195	CentOS 7 : java-1.7.0-openjdk (RHSA-2020:1507)	high
136194	CentOS 7 : thunderbird (RHSA-2020:1489)	critical
136020	CentOS 6 : kernel (RHSA-2020:1524)	high
136019	CentOS 6 : java-1.7.0-openjdk (RHSA-2020:1508)	high
136018	CentOS 6 : java-1.8.0-openjdk (RHSA-2020:1506)	high
136017	CentOS 6 : thunderbird (RHSA-2020:1488)	critical
136016	CentOS 6 : firefox (RHSA-2020:1429)	critical
136015	CentOS 6 : qemu-kvm (RHSA-2020:1403)	medium
135362	CentOS 6 : krb5-appl (CESA-2020:1349)	critical
135361	CentOS 6 : firefox (RHSA-2020:1339)	high
135360	CentOS 6 : telnet (RHSA-2020:1335)	critical
135359	CentOS 6 : ipmitool (RHSA-2020:1331)	high
135358	CentOS 7 : libxml2 (RHSA-2020:1190)	high
135357	CentOS 7 : libqb (RHSA-2020:1189)	high
135356	CentOS 7 : libsndfile (RHSA-2020:1185)	high
135355	CentOS 7 : unzip (CESA-2020:1181)	low
135354	CentOS 7 : ImageMagick (RHSA-2020:1180)	critical
135353	CentOS 7 : zziplib (RHSA-2020:1178)	medium
135352	CentOS 7 : avahi (RHSA-2020:1176)	critical
135351	CentOS 7 : taglib (RHSA-2020:1175)	medium
135350	CentOS 7 : okular (RHSA-2020:1173)	medium
135349	CentOS 7 : qt (RHSA-2020:1172)	critical
135348	CentOS 7 : nbdkit (RHSA-2020:1167)	low
135347	CentOS 7 : libreoffice (RHSA-2020:1151)	critical
135346	CentOS 7 : gettext (RHSA-2020:1138)	critical
135345	CentOS 7 : polkit (RHSA-2020:1135)	medium
135344	CentOS 7 : python3 (RHSA-2020:1132)	high
135343	CentOS 7 : python (RHSA-2020:1131)	high
135342	CentOS 7 : mutt (RHSA-2020:1126)	medium
135341	CentOS 7 : httpd (RHSA-2020:1121)	high
135340	CentOS 7 : qemu-kvm (RHSA-2020:1116)	medium
135339	CentOS 7 : bash (RHSA-2020:1113)	high
135338	CentOS 7 : php (RHSA-2020:1112)	critical

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

high

high

high

medium

medium

critical

critical

critical

critical

critical

high

critical

critical

high

high

high

high

critical

high

high

high

critical

critical

medium

critical

high

critical

high

high

high

high

low

critical

medium

critical

medium

medium

critical

low

critical

critical

medium

high

high

medium

high

medium

high

critical