The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3108 advisory.

  - An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in     drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value of kmemdup(). (CVE-2022-3108)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of mariadb installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-27449 advisory.

  - MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component     sql/item_func.cc:148. (CVE-2022-27449)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of busybox installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-42384 advisory.

  - A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when     processing a crafted awk pattern in the handle_special function (CVE-2021-42384)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-0051 advisory.

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. (CVE-2023-0051)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-2380 advisory.

  - The Linux kernel was found vulnerable out of bounds memory access in the     drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerability could result in local attackers     being able to crash the kernel. (CVE-2022-2380)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of qemu / qemu-kvm installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3872 advisory.

  - An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the     Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count ==     block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a     denial of service condition. (CVE-2022-3872)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nodejs installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-32215 advisory.

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly     handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
    (CVE-2022-32215)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of mysql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-21881 advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. (CVE-2023-21881)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of opensc installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-42779 advisory.

  - A heap use after free issue was found in Opensc before version 0.22.0 in sc_file_valid. (CVE-2021-42779)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of mariadb installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-27444 advisory.

  - MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component     sql/item_subselect.cc. (CVE-2022-27444)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-33743 advisory.

  - network backend May cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data     Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further     processing to nevertheless be freed. (CVE-2022-33743)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-28388 advisory.

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tensorflow installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-41911 advisory.

  - TensorFlow is an open source platform for machine learning. When printing a tensor, we get it's data as a     `const char*` array (since that's the underlying storage) and then we typecast it to the element type.
    However, conversions from `char` to `bool` are undefined if the `char` is not `0` or `1`, so     sanitizers/fuzzers will crash. The issue has been patched in GitHub commit `1be74370327`. The fix will be     included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.10.1, TensorFlow 2.9.3,     and TensorFlow 2.8.4, as these are also affected and still in supported range. (CVE-2022-41911)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of systemd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3821 advisory.

  - An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An     attacker could supply specific values for time and accuracy that leads to buffer overrun in     format_timespan(), leading to a Denial of Service. (CVE-2022-3821)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tensorflow installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-41893 advisory.

  - TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListResize` is given a     nonscalar value for input `size`, it results `CHECK` fail which can be used to trigger a denial of service     attack. We have patched the issue in GitHub commit 888e34b49009a4e734c27ab0c43b0b5102682c56. The fix will     be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and     TensorFlow 2.8.4, as these are also affected and still in supported range. (CVE-2022-41893)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-0500 advisory.

  - A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds     memory write in the Linux kernel's BPF subsystem due to the way a user loads BTF. This flaw allows a local     user to crash or escalate their privileges on the system. (CVE-2022-0500)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of subversion installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-24070 advisory.

  - Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization     rules, mod_dav_svn servers May attempt to use memory which has already been freed. Affected Subversion     mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not     affected. (CVE-2022-24070)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of mysql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-21887 advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). Supported versions     that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker     with network access via multiple protocols to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. (CVE-2023-21887)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-47939 advisory.

  - An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c     has a use-after-free and OOPS for SMB2_TREE_DISCONNECT. (CVE-2022-47939)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-2318 advisory.

  - There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that     allow attackers to crash linux kernel without any privileges. (CVE-2022-2318)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of sqlite installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-46908 advisory.

  - SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly     implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as     WRITEFILE. (CVE-2022-46908)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3107 advisory.

  - An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in     drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kvmalloc_array() and will cause the     null pointer dereference. (CVE-2022-3107)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of emacs installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-45939 advisory.

  - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a     source-code file, because lib-src/etags.c uses the system C library function in its implementation of the     ctags program. For example, a victim May use the ctags * command (suggested in the ctags documentation)     in a situation where the current working directory has contents that depend on untrusted input.
    (CVE-2022-45939)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of device-mapper-multipath installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-41974 advisory.

  - multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited     alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass     access controls and manipulate the multipath setup. This can lead to local privilege escalation to root.
    This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used     instead of bitwise OR. (CVE-2022-41974)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tensorflow installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-41899 advisory.

  - TensorFlow is an open source platform for machine learning. Inputs `dense_features` or     `example_state_data` not of rank 2 will trigger a `CHECK` fail in `SdcaOptimizer`. We have patched the     issue in GitHub commit 80ff197d03db2a70c6a111f97dcdacad1b0babfa. The fix will be included in TensorFlow     2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are     also affected and still in supported range. (CVE-2022-41899)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
172758	CBL Mariner 2.0 Security Update: kernel (CVE-2022-3108)	medium
172757	CBL Mariner 2.0 Security Update: mariadb (CVE-2022-27449)	high
172756	CBL Mariner 2.0 Security Update: busybox (CVE-2021-42384)	high
172755	CBL Mariner 2.0 Security Update: vim (CVE-2023-0051)	high
172754	CBL Mariner 2.0 Security Update: kernel (CVE-2022-2380)	medium
172753	CBL Mariner 2.0 Security Update: qemu / qemu-kvm (CVE-2022-3872)	high
172752	CBL Mariner 2.0 Security Update: nodejs (CVE-2022-32215)	medium
172751	CBL Mariner 2.0 Security Update: mysql (CVE-2023-21881)	medium
172750	CBL Mariner 2.0 Security Update: opensc (CVE-2021-42779)	medium
172749	CBL Mariner 2.0 Security Update: mariadb (CVE-2022-27444)	high
172748	CBL Mariner 2.0 Security Update: kernel (CVE-2022-33743)	high
172747	CBL Mariner 2.0 Security Update: kernel (CVE-2022-28388)	medium
172746	CBL Mariner 2.0 Security Update: tensorflow (CVE-2022-41911)	high
172745	CBL Mariner 2.0 Security Update: systemd (CVE-2022-3821)	medium
172744	CBL Mariner 2.0 Security Update: tensorflow (CVE-2022-41893)	high
172743	CBL Mariner 2.0 Security Update: kernel (CVE-2022-0500)	high
172742	CBL Mariner 2.0 Security Update: subversion (CVE-2022-24070)	high
172741	CBL Mariner 2.0 Security Update: mysql (CVE-2023-21887)	medium
172740	CBL Mariner 2.0 Security Update: kernel (CVE-2022-47939)	critical
172739	CBL Mariner 2.0 Security Update: kernel (CVE-2022-2318)	medium
172738	CBL Mariner 2.0 Security Update: sqlite (CVE-2022-46908)	high
172737	CBL Mariner 2.0 Security Update: kernel (CVE-2022-3107)	medium
172736	CBL Mariner 2.0 Security Update: emacs (CVE-2022-45939)	high
172735	CBL Mariner 2.0 Security Update: device-mapper-multipath (CVE-2022-41974)	high
172734	CBL Mariner 2.0 Security Update: tensorflow (CVE-2022-41899)	high

Detections

Analytics

MarinerOS Local Security Checks Family for Nessus

medium

high

high

high

medium

high

medium

medium

medium

high

high

medium

high

medium

high

high

high

medium

critical

medium

high

medium

high

high

high