The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10298:01 advisory.

    * corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-11557:01 advisory.

    * resolv: Denial of Service in resolv gem (CVE-2025-24294)
      * rexml: REXML denial of service (CVE-2025-58767)
      * When using the + operator to combine URIs, sensitive information like passwords from the original URI     can be leaked,          violating RFC3986 and making applications vulnerable to credential exposure. (CVE-2025-61594)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10678:13 advisory.

    JDK: Better Glyph drawing (CVE-2025-30749)         JDK: Enhance TLS protocol support (CVE-2025-30754)         JDK: Improve HTTP client header handling (CVE-2025-50059)         JDK: Better Glyph drawing redux (CVE-2025-50106)     CVE(s):
    CVE-2025-30749     CVE-2025-30754     CVE-2025-50059     CVE-2025-50106

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10788:12 advisory.

    * CVE-2025-27613: fix issue where untrusted repositories could create and     truncate files, with the fix implemented in versions 2.43.7 and later     CVE(s):
    CVE-2025-27613     Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted     repository and runs gitk without additional command arguments, files for which the user has write     permission can be created and truncated. The option Support per-file encoding must have been enabled     before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of     this line is used in the main window (regardless of whether Support per-file encoding is enabled or not).
    This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-11515:36 advisory.

    * firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)
      * firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)
      * firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)
      * firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)
      * firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)
      * firefox: Race condition in the Graphics component (CVE-2025-13012)
      * firefox: Spoofing issue in Firefox (CVE-2025-13015)
      * firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)
      * firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-9578:04 advisory.

    * dotnet: .NET Remote Code Execution Vulnerability (CVE-2025-21171)
      * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)
      * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173)
      * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)     For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.Security Fix(es):
      * dotnet: .NET Elevation of Privilege Vulnerability (CVE-2025-21173)
      * dotnet: .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21176)
      * dotnet: .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2025-21172)
      * dotnet: .NET Remote Code Execution Vulnerability (CVE-2025-21171)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9535:01 advisory.

    * dpdk: Denial Of Service from malicious guest on hypervisors using DPDK Vhost library (CVE-2024-11614)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10214:03 advisory.

    * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9818:04 advisory.

    * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10687:28 advisory.

    * firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)
      * firefox: thunderbird: Memory safety bugs (CVE-2025-8035)
      * firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)
      * firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)
      * firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)
      * firefox: Memory safety bugs (CVE-2025-8034)
      * firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)
      * firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)
      * firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10755:54 advisory.

    * kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CVE-2025-21928)
      * kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020)
      * kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CVE-2025-37890)
      * kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052)
      * kernel: crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079)
      * kernel: ext4: avoid resizing to a partial cluster size (CVE-2022-50020)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10834:01 advisory.

    * httpd: insufficient escaping of user-supplied data in mod_ssl (CVE-2024-47252)
      * httpd: mod_ssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption     (CVE-2025-23048)
      * httpd: mod_proxy_http2: untrusted input from a client causes an assertion to fail in the Apache     mod_proxy_http2 module (CVE-2025-49630)
      * httpd: HTTP Session Hijack via a TLS upgrade (CVE-2025-49812)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10826:01 advisory.

    * postgresql: PostgreSQL executes arbitrary code in restore operation (CVE-2025-8715)
      * postgresql: PostgreSQL code execution in restore operation (CVE-2025-8714)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
282682	MiracleLinux 9 : corosync-3.1.9-2.el9_6 (AXSA:2025-10298:01)	critical
282681	MiracleLinux 9 : ruby:3.3 (AXSA:2025-11557:01)	medium
282680	MiracleLinux 9 : java-17-openjdk-17.0.16.0.8-2.el9.ML.1 (AXSA:2025-10678:13)	high
282679	MiracleLinux 7 : git-1.8.3.1-25.0.5.el7.AXS7 (AXSA:2025-10788:12)	low
282678	MiracleLinux 9 : firefox-140.5.0-1.el9_7.ML.1 (AXSA:2025-11515:36)	high
282677	MiracleLinux 8 : dotnet9.0-9.0.102-1.el8_10 (AXSA:2025-9578:04)	high
282676	MiracleLinux 9 : dpdk-23.11-2.el9_5 (AXSA:2025-9535:01)	high
282675	MiracleLinux 9 : expat-2.5.0-5.el9_6 (AXSA:2025-10214:03)	high
282674	MiracleLinux 9 : grafana-10.2.6-9.el9_5 (AXSA:2025-9818:04)	high
282673	MiracleLinux 9 : firefox-128.13.0-1.el9_6.ML.1 (AXSA:2025-10687:28)	critical
282672	MiracleLinux 8 : kernel-4.18.0-553.66.1.el8_10 (AXSA:2025-10755:54)	high
282671	MiracleLinux 8 : httpd:2.4 (AXSA:2025-10834:01)	critical
282670	MiracleLinux 9 : postgresql:15 (AXSA:2025-10826:01)	high

Detections

Analytics

Miracle Linux Local Security Checks Family for Nessus

critical

medium

high

low

high

high

high

high

high

critical

high

critical

high