The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5350 advisory.

  - Net-SNMP through 5.7.3 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as root. (CVE-2020-15862)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5966 advisory.

  - containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows.
    In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host     network containers. Access controls for the shims API socket verified that the connecting process had an     effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would     allow malicious containers running in the same network namespace as the shim, with an effective UID of 0     but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This     vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon     as they are released. It should be noted that containers started with an old version of containerd-shim     should be stopped and restarted, as running containers will continue to be vulnerable even after an     upgrade. If you are not providing the ability for untrusted users to start containers in the same network     namespace as the shim (typically the host network namespace, for example with docker run --net=host or     hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this     issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract     sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice     to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The     containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of     isolation mechanisms used for a container necessarily increases that container's privilege, regardless of     what container runtime is used for running that container. (CVE-2020-15257)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-5964 advisory.

  - containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows.
    In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host     network containers. Access controls for the shims API socket verified that the connecting process had an     effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would     allow malicious containers running in the same network namespace as the shim, with an effective UID of 0     but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This     vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon     as they are released. It should be noted that containers started with an old version of containerd-shim     should be stopped and restarted, as running containers will continue to be vulnerable even after an     upgrade. If you are not providing the ability for untrusted users to start containers in the same network     namespace as the shim (typically the host network namespace, for example with docker run --net=host or     hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this     issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract     sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice     to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The     containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of     isolation mechanisms used for a container necessarily increases that container's privilege, regardless of     what container runtime is used for running that container. (CVE-2020-15257)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5962 advisory.

  - The Linux kernel through 5.7.11 allows remote attackers to make observations that help to obtain sensitive     information about the internal state of the network RNG, aka CID-f227e3ec3b5c. This is related to     drivers/char/random.c and kernel/time/timer.c. (CVE-2020-16166)

  - The vmw_gb_surface_define_ioctl function (accessible via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in     drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.11.4 defines a backup_handle     variable but does not give it an initial value. If one attempts to create a GB surface, with a previously     allocated DMA buffer to be used as a backup buffer, the backup_handle variable does not get written to and     is then later returned to user space, allowing local users to obtain sensitive information from     uninitialized kernel memory via a crafted ioctl call. (CVE-2017-9605)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5239 advisory.

  - When drawing a transparent image on top of an unknown cross-origin image, the Skia library     drawImage function took a variable amount of time depending on the content of the underlying     image. This resulted in potential cross-origin information exposure of image content through timing side-     channel attacks.  (CVE-2020-16012)

  - A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even     after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal     pages could have used this attack to bypass our built-in sanitizer.  (CVE-2020-26951)

  - Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and     cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a     Content Security Policy bypass.  (CVE-2020-26958)

  - Mozilla: DoH did not filter IPv4 mapped IP Addresses (CVE-2020-26961)

  - Mozilla developers Randell Jesup, Christian Holler, Jason Kratzer, Byron Campen, and Steve Fink reported     memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code.  (CVE-2020-26968)

  - Mozilla: Fullscreen could be enabled without displaying the security UI (CVE-2020-26953)

  - In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and     therefore lead to XSS.  (CVE-2020-26956)

  - During browser shutdown, reference decrementing could have occured on a previously freed object, resulting     in a use-after-free, memory corruption, and a potentially exploitable crash.  (CVE-2020-26959)

  - Mozilla: Potential use-after-free in uses of nsTArray (CVE-2020-26960)

  - Mozilla: Software keyboards may have remembered typed passwords (CVE-2020-26965)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5237 advisory.

  - When drawing a transparent image on top of an unknown cross-origin image, the Skia library     drawImage function took a variable amount of time depending on the content of the underlying     image. This resulted in potential cross-origin information exposure of image content through timing side-     channel attacks.  (CVE-2020-16012)

  - A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even     after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal     pages could have used this attack to bypass our built-in sanitizer.  (CVE-2020-26951)

  - Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and     cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a     Content Security Policy bypass.  (CVE-2020-26958)

  - Mozilla: DoH did not filter IPv4 mapped IP Addresses (CVE-2020-26961)

  - Mozilla developers Randell Jesup, Christian Holler, Jason Kratzer, Byron Campen, and Steve Fink reported     memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code.  (CVE-2020-26968)

  - Mozilla: Fullscreen could be enabled without displaying the security UI (CVE-2020-26953)

  - In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and     therefore lead to XSS.  (CVE-2020-26956)

  - During browser shutdown, reference decrementing could have occured on a previously freed object, resulting     in a use-after-free, memory corruption, and a potentially exploitable crash.  (CVE-2020-26959)

  - Mozilla: Potential use-after-free in uses of nsTArray (CVE-2020-26960)

  - Mozilla: Software keyboards may have remembered typed passwords (CVE-2020-26965)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5236 advisory.

  - When drawing a transparent image on top of an unknown cross-origin image, the Skia library     drawImage function took a variable amount of time depending on the content of the underlying     image. This resulted in potential cross-origin information exposure of image content through timing side-     channel attacks.  (CVE-2020-16012)

  - A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even     after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal     pages could have used this attack to bypass our built-in sanitizer.  (CVE-2020-26951)

  - Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and     cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a     Content Security Policy bypass.  (CVE-2020-26958)

  - Mozilla: DoH did not filter IPv4 mapped IP Addresses (CVE-2020-26961)

  - Mozilla developers Randell Jesup, Christian Holler, Jason Kratzer, Byron Campen, and Steve Fink reported     memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code.  (CVE-2020-26968)

  - Mozilla: Fullscreen could be enabled without displaying the security UI (CVE-2020-26953)

  - In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and     therefore lead to XSS.  (CVE-2020-26956)

  - During browser shutdown, reference decrementing could have occured on a previously freed object, resulting     in a use-after-free, memory corruption, and a potentially exploitable crash.  (CVE-2020-26959)

  - Mozilla: Potential use-after-free in uses of nsTArray (CVE-2020-26960)

  - Mozilla: Software keyboards may have remembered typed passwords (CVE-2020-26965)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5235 advisory.

  - When drawing a transparent image on top of an unknown cross-origin image, the Skia library     drawImage function took a variable amount of time depending on the content of the underlying     image. This resulted in potential cross-origin information exposure of image content through timing side-     channel attacks.  (CVE-2020-16012)

  - A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even     after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal     pages could have used this attack to bypass our built-in sanitizer.  (CVE-2020-26951)

  - Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and     cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a     Content Security Policy bypass.  (CVE-2020-26958)

  - Mozilla: DoH did not filter IPv4 mapped IP Addresses (CVE-2020-26961)

  - Mozilla developers Randell Jesup, Christian Holler, Jason Kratzer, Byron Campen, and Steve Fink reported     memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code.  (CVE-2020-26968)

  - Mozilla: Fullscreen could be enabled without displaying the security UI (CVE-2020-26953)

  - In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and     therefore lead to XSS.  (CVE-2020-26956)

  - During browser shutdown, reference decrementing could have occured on a previously freed object, resulting     in a use-after-free, memory corruption, and a potentially exploitable crash.  (CVE-2020-26959)

  - Mozilla: Potential use-after-free in uses of nsTArray (CVE-2020-26960)

  - Mozilla: Software keyboards may have remembered typed passwords (CVE-2020-26965)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-4158 advisory.

  - Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and     Firefox ESR < 78.3. (CVE-2020-15673)

  - Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove,     resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable     element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.
    (CVE-2020-15676)

  - By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site     displayed in the download file dialog to show the original site (the one suffering from the open redirect)     rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81,     Thunderbird < 78.3, and Firefox ESR < 78.3. (CVE-2020-15677)

  - When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in     a potential use-after-free. This occurs because the function     APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This     vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. (CVE-2020-15678)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-5947 advisory.

  - In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for     `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same     server. This vulnerability impacts software that uses httplib2 with uri constructed by string     concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0.
    (CVE-2020-11078)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-5164 advisory.

  - Mozilla: Write side effects in MCallGetProperty opcode not accounted for (CVE-2020-26950)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-5163 advisory.

  - Mozilla: Write side effects in MCallGetProperty opcode not accounted for (CVE-2020-26950)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-5146 advisory.

  - Mozilla: Write side effects in MCallGetProperty opcode not accounted for (CVE-2020-26950)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5934 advisory.

  - arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall     auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service     (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. (CVE-2014-4508)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4481 advisory.

  - Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to     potentially enable escalation of privilege and denial of service via adjacent access (CVE-2020-0556)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5129 advisory.

  - Net-SNMP through 5.7.3 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as root. (CVE-2020-15862)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-5100 advisory.

  - Mozilla: Write side effects in MCallGetProperty opcode not accounted for (CVE-2020-26950)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5083 advisory.

  - Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to     potentially enable information disclosure via local access. (CVE-2020-8695)

  - Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow     an authenticated user to potentially enable information disclosure via local access. (CVE-2020-8696)

  - Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to     potentially enable information disclosure via local access. (CVE-2020-8698)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5085 advisory.

  - Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to     potentially enable information disclosure via local access. (CVE-2020-8695)

  - Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow     an authenticated user to potentially enable information disclosure via local access. (CVE-2020-8696)

  - Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to     potentially enable information disclosure via local access. (CVE-2020-8698)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-4913 advisory.

  - Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR     78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4,     Firefox < 82, and Thunderbird < 78.4. (CVE-2020-15683)

  - Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-15969)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5084 advisory.

  - Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow     an authenticated user to potentially enable information disclosure via local access. (CVE-2020-8696)

  - Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to     potentially enable information disclosure via local access. (CVE-2020-8698)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5936 advisory.

  - arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall     auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service     (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. (CVE-2014-4508)

  - The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local     users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling.
    (CVE-2017-8925)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-4947 advisory.

  - Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR     78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4,     Firefox < 82, and Thunderbird < 78.4. (CVE-2020-15683)

  - Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-15969)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4685 advisory.

  - A Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth     implementation handled L2CAP packets with A2MP CID. This flaw allows a remote attacker in an adjacent     range to crash the system, causing a denial of service or potentially executing arbitrary code on the     system by sending a specially crafted L2CAP packet. The highest threat from this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2020-25661)

  - kernel: net: bluetooth: heap buffer overflow when processing extended advertising report events     (CVE-2020-24490)

  - A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack     implementation handled the initialization of stack memory when handling certain AMP packets. This flaw     allows a remote attacker in an adjacent range to leak small portions of stack memory on the system by     sending specially crafted AMP packets. The highest threat from this vulnerability is to data     confidentiality. (CVE-2020-25662)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5009 advisory.

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-3835 advisory.

  - By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site     displayed in the download file dialog to show the original site (the one suffering from the open redirect)     rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81,     Thunderbird < 78.3, and Firefox ESR < 78.3. (CVE-2020-15677)

  - Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and     Firefox ESR < 78.3. (CVE-2020-15673)

  - Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove,     resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable     element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.
    (CVE-2020-15676)

  - When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in     a potential use-after-free. This occurs because the function     APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This     vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. (CVE-2020-15678)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-5104 advisory.

  - Mozilla: Write side effects in MCallGetProperty opcode not accounted for (CVE-2020-26950)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4952 advisory.

  - Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-15999)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-5099 advisory.

  - Mozilla: Write side effects in MCallGetProperty opcode not accounted for (CVE-2020-26950)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5924 advisory.

  - Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to     potentially enable information disclosure via local access. (CVE-2020-8695)

  - Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2020-8694)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-5923 advisory.

  - Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2020-8694)

  - Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to     potentially enable information disclosure via local access. (CVE-2020-8695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5926 advisory.

  - Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to     potentially enable information disclosure via local access. (CVE-2020-8695)

  - Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2020-8694)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4827 advisory.

  - A NULL Pointer Dereference in match_at() in regexec.c in Oniguruma 6.9.2 allows attackers to potentially     cause denial of service by providing a crafted regular expression. Oniguruma issues often affect Ruby, as     well as common optional libraries for PHP and Rust. (CVE-2019-13225)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4490 advisory.

  - Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through     2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS     keyserver network. Retrieving data from this network may cause a persistent denial of service, because of     a Certificate Spamming Attack. (CVE-2019-13050)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4628 advisory.

  - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to     retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to     disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote     graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This     issue affects: The Document Foundation LibreOffice versions prior to 6.4.4. (CVE-2020-12802)

  - ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form     data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF     implements the XForms W3C standard, which allows data to be submitted without the need for macros or other     active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including     file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the     form, but to avoid the possibility of malicious documents engineered to maximize the possibility of     inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to     overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.
    (CVE-2020-12803)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4508 advisory.

  - repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last     schema whose length is less than the length of the input schema. (CVE-2019-20387)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4465 advisory.

  - find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.32, allows remote attackers to cause a denial of service (infinite recursion     and application crash) via a crafted ELF file. (CVE-2019-17450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4627 advisory.

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     SDL_GetRGB in video/SDL_pixels.c. (CVE-2019-7636)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitMS_ADPCM in audio/SDL_wave.c (outside the wNumCoef loop). (CVE-2019-7576)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in     IMA_ADPCM_nibble in audio/SDL_wave.c. (CVE-2019-7572)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     Map1toN in video/SDL_pixels.c. (CVE-2019-7638)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     Blit1to4 in video/SDL_blit_1.c. (CVE-2019-7635)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in     SDL_FillRect in video/SDL_surface.c. (CVE-2019-7637)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a buffer over-read in     SDL_LoadWAV_RW in audio/SDL_wave.c. (CVE-2019-7577)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitIMA_ADPCM in audio/SDL_wave.c. (CVE-2019-7578)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     InitMS_ADPCM in audio/SDL_wave.c (inside the wNumCoef loop). (CVE-2019-7573)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in     IMA_ADPCM_decode in audio/SDL_wave.c. (CVE-2019-7574)

  - SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer overflow in     MS_ADPCM_decode in audio/SDL_wave.c. (CVE-2019-7575)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4500 advisory.

  - In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating     the server receiving the TSIG-signed request, could send a truncated response to that request, triggering     an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to     correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and     message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.
    (CVE-2020-8622)

  - In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND     Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service     for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk     (*) character, this defect cannot be encountered. A would-be attacker who is allowed to change zone     content could theoretically introduce such a record in order to exploit this condition to cause denial of     service, though we consider the use of this vector unlikely because any such attack would require a     significant privilege level and be easily traceable. (CVE-2020-8619)

  - In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted     query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with
    --enable-native-pkcs11 * be signing one or more zones with an RSA key * be able to receive queries from     a possible attacker (CVE-2020-8623)

  - In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also     affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An     attacker who has been granted privileges to change a specific subset of the zone's content could abuse     these unintended additional privileges to update other contents of the zone. (CVE-2020-8624)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4690 advisory.

  - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is     mishandled in QXmlStreamReader, a related issue to CVE-2003-1564. (CVE-2015-9541)

  - In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages.
    Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service     (memory consumption). (CVE-2018-21035)

  - Qt 5.12.2 through 5.14.2, as used in unofficial builds of Mumble 1.3.0 and other products, mishandles     OpenSSL's error queue, which can cause a denial of service to QSslSocket users. Because errors leak in     unrelated TLS sessions, an unrelated session may be disconnected when any handshake fails. (Mumble 1.3.1     is not affected, regardless of the Qt version.) (CVE-2020-13962)

  - qt: files placed by attacker can influence the working directory and lead to malicious code execution     (CVE-2020-0569)

  - Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated     user to potentially enable elevation of privilege via local access. (CVE-2020-0570)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-4667 advisory.

  - GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts.
    This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an     archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the     MIME type should have been text/html, and execute JavaScript code. (CVE-2020-12137)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-4638 advisory.

  - sysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in sa_common.c.
    (CVE-2019-16167)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4553 advisory.

  - An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the     udevadm trigger command, a memory leak may occur. (CVE-2019-20386)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5002 advisory.

  - curl: Incorrect argument check can allow remote servers to overwrite local files (CVE-2020-8177)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4709 advisory.

  - In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of     service when passed to the library for processing. The attacker constructs pattern elements so that the     number of final rendered objects grows exponentially. (CVE-2019-20446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-4483 advisory.

  - OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in     libopensc/asn1.c. (CVE-2019-15946)

  - An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-cac1.c     mishandles buffer limits for CAC certificates. (CVE-2019-19481)

  - OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in     libopensc/asn1.c. (CVE-2019-15945)

  - An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c     has an incorrect read operation during parsing of a SETCOS file attribute. (CVE-2019-19479)

  - OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in     libopensc/card-coolkey.c lacks a uniqueness check. (CVE-2019-20792)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4484 advisory.

  - In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons     could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be     usable for denial-of-service attacks). (CVE-2018-20843)

  - In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to     document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber)     then resulted in a heap-based buffer over-read. (CVE-2019-15903)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4806 advisory.

  - A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in     vhost_user_set_log_base() could result in a smaller memory map than requested, possibly allowing memory     corruption. (CVE-2020-10722)

  - A flaw was found in DPDK version 19.11 and above that allows a malicious guest to cause a segmentation     fault of the vhost-user backend application running on the host, which could result in a loss of     connectivity for the other guests running on that host. This is caused by a missing validity check of the     descriptor address in the function `virtio_dev_rx_batch_packed()`. (CVE-2020-10725)

  - A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer     truncation on the index of a payload. Under certain circumstances, the index (a UInt) is copied and     truncated into a uint16, which can lead to out of bound indexing and possible memory corruption.
    (CVE-2020-10723)

  - A vulnerability was found in DPDK versions 19.11 and above. A malicious container that has direct access     to the vhost-user socket can keep sending VHOST_USER_GET_INFLIGHT_FD messages, causing a resource leak     (file descriptors and virtual memory), which may result in a denial of service. (CVE-2020-10726)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-4625 advisory.

  - In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources.
    Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly.
    (CVE-2019-12420)

  - A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious     rule configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. With     this bug unpatched, exploits can be injected in a number of scenarios including the same privileges as     spamd is run which may be elevated though doing so remotely is difficult. In addition to upgrading to SA     3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted     places. If you cannot upgrade, do not use 3rd party rulesets, do not use sa-compile and do not run spamd     as an account with elevated privileges. (CVE-2020-1930)

  - In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without     any output or errors. With this, exploits can be injected in a number of scenarios. In addition to     upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from     trusted places. (CVE-2018-11805)

  - A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious     Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue     is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at     credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number     of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again     recommend that users should only use update channels or 3rd party .cf files from trusted places.
    (CVE-2020-1931)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5011 advisory.

  - In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also     affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An     attacker who has been granted privileges to change a specific subset of the zone's content could abuse     these unintended additional privileges to update other contents of the zone. (CVE-2020-8624)

  - In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted     query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with
    --enable-native-pkcs11 * be signing one or more zones with an RSA key * be able to receive queries from     a possible attacker (CVE-2020-8623)

  - In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating     the server receiving the TSIG-signed request, could send a truncated response to that request, triggering     an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to     correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and     message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.
    (CVE-2020-8622)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
143534	Oracle Linux 7 : net-snmp (ELSA-2020-5350)	High
143486	Oracle Linux 7 : docker-cli / docker-engine (ELSA-2020-5966)	Low
143451	Oracle Linux 7 : containerd (ELSA-2020-5964)	High
143427	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5962)	Medium
143378	Oracle Linux 7 : firefox (ELSA-2020-5239)	High
143377	Oracle Linux 8 : firefox (ELSA-2020-5237)	High
143372	Oracle Linux 8 : thunderbird (ELSA-2020-5236)	High
143368	Oracle Linux 7 : thunderbird (ELSA-2020-5235)	High
143210	Oracle Linux 6 : thunderbird (ELSA-2020-4158)	Medium
143207	Oracle Linux 8 : resource-agents (ELSA-2020-5947)	Medium
143201	Oracle Linux 6 : thunderbird (ELSA-2020-5164)	High
143197	Oracle Linux 7 : thunderbird (ELSA-2020-5163)	High
143118	Oracle Linux 8 : thunderbird (ELSA-2020-5146)	High
143067	Oracle Linux 6 : kernel (ELSA-2020-5934)	Medium
142997	Oracle Linux 8 : bluez (ELSA-2020-4481)	Medium
142996	Oracle Linux 6 : net-snmp (ELSA-2020-5129)	High
142965	Oracle Linux 8 : firefox (ELSA-2020-5100)	High
142964	Oracle Linux 7 : microcode_ctl (ELSA-2020-5083)	Low
142963	Oracle Linux 8 : microcode_ctl (ELSA-2020-5085)	Low
142962	Oracle Linux 8 : thunderbird (ELSA-2020-4913)	High
142961	Oracle Linux 6 : microcode_ctl (ELSA-2020-5084)	Low
142905	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2020-5936)	Medium
142900	Oracle Linux 6 : thunderbird (ELSA-2020-4947)	High
142899	Oracle Linux 8 : kernel (ELSA-2020-4685)	High
142898	Oracle Linux 7 : python (ELSA-2020-5009)	Medium
142897	Oracle Linux 6 : firefox (ELSA-2020-3835)	Medium
142896	Oracle Linux 6 : firefox (ELSA-2020-5104)	High
142895	Oracle Linux 8 : freetype (ELSA-2020-4952)	Medium
142877	Oracle Linux 7 : firefox (ELSA-2020-5099)	Critical
142869	Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2020-5924)	Low
142868	Oracle Linux 7 : Unbreakable Enterprise kernel-container (ELSA-2020-5923)	Low
142867	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5926)	Low
142815	Oracle Linux 8 : oniguruma (ELSA-2020-4827)	Medium
142814	Oracle Linux 8 : gnupg2 (ELSA-2020-4490)	Medium
142813	Oracle Linux 8 : libreoffice (ELSA-2020-4628)	Medium
142812	Oracle Linux 8 : libsolv (ELSA-2020-4508)	Medium
142811	Oracle Linux 8 : binutils (ELSA-2020-4465)	Medium
142805	Oracle Linux 8 : SDL (ELSA-2020-4627)	Medium
142804	Oracle Linux 8 : bind (ELSA-2020-4500)	Medium
142803	Oracle Linux 8 : qt5-qtbase / and / qt5-qtwebsockets (ELSA-2020-4690)	Medium
142802	Oracle Linux 8 : mailman:2.1 (ELSA-2020-4667)	Medium
142801	Oracle Linux 8 : sysstat (ELSA-2020-4638)	Medium
142800	Oracle Linux 8 : systemd (ELSA-2020-4553)	Low
142799	Oracle Linux 7 : curl (ELSA-2020-5002)	Medium
142798	Oracle Linux 8 : librsvg2 (ELSA-2020-4709)	Medium
142797	Oracle Linux 8 : opensc (ELSA-2020-4483)	Medium
142796	Oracle Linux 8 : expat (ELSA-2020-4484)	High
142795	Oracle Linux 8 : dpdk (ELSA-2020-4806)	Medium
142794	Oracle Linux 8 : spamassassin (ELSA-2020-4625)	High
142793	Oracle Linux 7 : bind (ELSA-2020-5011)	Medium

Oracle Linux Local Security Checks Family for Nessus