An update of the binutils package has been released.

  - stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of     service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-     of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699. (CVE-2021-45078)

An update of the keepalived package has been released.

  - In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination,     allowing any user to inspect and manipulate any property. This leads to access-control bypass in some     situations in which an unrelated D-Bus system service has a settable (writable) property (CVE-2021-44225)

An update of the python3 package has been released.

  - There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince     another local or adjacent user to start a pydoc server could access the server and use it to disclose     sensitive information belonging to the other user that they would not normally be able to access. The     highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9,     Python versions before 3.9.3 and Python versions before 3.10.0a7. (CVE-2021-3426)

An update of the vim package has been released.

  - vim is vulnerable to Heap-based Buffer Overflow (CVE-2021-3973)

  - vim is vulnerable to Use After Free (CVE-2021-3974)

An update of the vim package has been released.

  - vim is vulnerable to Heap-based Buffer Overflow (CVE-2021-3984, CVE-2021-4019)

An update of the consul package has been released.

  - HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect     Access Control. An ACL token (with the default operator:write permissions) in one namespace can be used     for unintended privilege escalation in a different namespace. (CVE-2021-41805)

An update of the pkg package has been released.

  - ** DISPUTED ** GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds     write, in g_option_group_add_entries. NOTE: the vendor's position is Realistically this is not a security     issue. The standard pattern is for callers to provide a static list of option entries in a fixed number of     calls to g_option_group_add_entries(). The researcher states that this pattern is undocumented.
    (CVE-2020-35457)

  - An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take()     was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32,     causing unintended length truncation. (CVE-2021-27218)

An update of the httpd package has been released.

  - A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser     (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the     vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and     earlier. (CVE-2021-44790)

An update of the bluez package has been released.

  - BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in     sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates     and will not be freed. This will cause a memory leak over time. The data can be a very large object, which     can be caused by an attacker continuously sending sdp packets and this may cause the service of the target     device to crash. (CVE-2021-41229)

An update of the krb5 package has been released.

  - ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before     1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon     crash. This occurs because a return value is not properly managed in a certain situation. (CVE-2021-36222)

  - MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an     ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths     lacks a recursion limit. (CVE-2020-28196)

  - The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has     a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.
    (CVE-2021-37750)

An update of the wireshark package has been released.

  - Uncontrolled Recursion in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17     allows denial of service via packet injection or crafted capture file (CVE-2021-39929)

  - NULL pointer exception in the IPPUSB dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service via     packet injection or crafted capture file (CVE-2021-39920)

  - NULL pointer exception in the Modbus dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows     denial of service via packet injection or crafted capture file (CVE-2021-39921)

  - Buffer overflow in the C12.22 dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of     service via packet injection or crafted capture file (CVE-2021-39922)

  - Large loop in the PNRP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service     via packet injection or crafted capture file (CVE-2021-39923)

An update of the vim package has been released.

  - vim is vulnerable to Use After Free (CVE-2021-4069)

An update of the linux package has been released.

  - An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-     free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is     called, aka CID-f5449e74802c. (CVE-2020-36385)

An update of the runc package has been released.

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc, netlink is used internally as a serialization system for specifying the relevant container     configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In     all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in     the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte     array attribute could result in the length overflowing and the attribute contents being parsed as netlink     messages for container configuration. This vulnerability requires the attacker to have some control over     the configuration of the container and would allow the attacker to bypass the namespace restrictions of     the container by simply adding their own netlink payload which disables all namespaces. The main users     impacted are those who allow untrusted images with untrusted configurations to run on their machines (such     as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one     may try disallowing untrusted namespace paths from your container. It should be noted that untrusted     namespace paths would allow the attacker to disable namespace protections entirely even in the absence of     this bug. (CVE-2021-43784)

An update of the lapack package has been released.

  - An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through     version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these     functions could cause an application using lapack to crash or possibly disclose portions of its memory.
    (CVE-2021-4048)

An update of the vim package has been released.

  - vim is vulnerable to Heap-based Buffer Overflow (CVE-2021-3903, CVE-2021-3927)

  - vim is vulnerable to Use of Uninitialized Variable (CVE-2021-3928)

An update of the nss package has been released.

  - NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow     when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures     encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for     certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how     they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and     PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and     Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
    (CVE-2021-43527)

An update of the rubygem package has been released.

  - A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a     subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method     `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This     vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by     Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was     addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
    (CVE-2019-5477)

  - Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In     Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by     Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network,     potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by     Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed     in Nokogiri version 1.11.0.rc4. (CVE-2020-26247)

  - Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In     Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users     of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected:
    Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser,     Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias     Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a     patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not     affected. (CVE-2021-41098)

An update of the mysql package has been released.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).
    Supported versions that are affected are 5.7.35 and prior and 8.0.26 and prior. Easily exploitable     vulnerability allows high privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all MySQL Server accessible data. CVSS 3.1 Base Score 4.9     (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N). (CVE-2021-35624)

An update of the bindutils package has been released.

  - In BIND 9.3.0 -> 9.11.35, 9.12.0 -> 9.16.21, and versions 9.9.3-S1 -> 9.11.35-S1 and 9.16.8-S1 ->     9.16.21-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.18 of the BIND     9.17 development branch, exploitation of broken authoritative servers using a flaw in response processing     can cause degradation in BIND resolver performance. The way the lame cache is currently designed makes it     possible for its internal data structures to grow almost infinitely, which may cause significant delays in     client query processing. (CVE-2021-25219)

An update of the apache package has been released.

  - The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to     9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP     upgrade connections was not released for WebSocket connections once the connection was closed. This     created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.
    (CVE-2021-42340)

An update of the linux package has been released.

  - loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain     privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by     using /proc/<pid>/maps for exploitation. (CVE-2021-41073)

  - Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP     socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux     kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, 4.4.0-193.224, 3.13.0.182.191 and 3.2.0-149.196.
    (CVE-2020-16119)

  - A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in     the Linux kernel through 5.13.13. (CVE-2021-40490)

  - prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel through 5.14.9 allows     unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds     write. (CVE-2021-41864)

  - An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux     kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite     memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a     certain comparison uses values that are not memory sizes. (CVE-2021-42252)

An update of the linux package has been released.

  - An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-     Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of     user-supplied sizes for the MSG_CRYPTO message type. (CVE-2021-43267)

An update of the libgcrypt package has been released.

  - The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction     between two cryptographic libraries, a certain dangerous combination of the prime defined by the     receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral     exponents can lead to a cross-configuration attack against OpenPGP. (CVE-2021-40528)

An update of the mysql package has been released.

  - Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions     that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker     with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this     vulnerability can result in unauthorized access to critical data or complete access to all MySQL     Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H). (CVE-2021-2471)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions     that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker     with network access via multiple protocols to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). (CVE-2021-2478, CVE-2021-2479, CVE-2021-35591)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported     versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). (CVE-2021-35546)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Error Handling). Supported     versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). (CVE-2021-35596)

  - Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 8.0.26 and prior. Easily exploitable vulnerability allows low privileged attacker with     network access via multiple protocols to compromise MySQL Client. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL     Client. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). (CVE-2021-35597)

An update of the rust package has been released.

  - An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It     permits the visual reordering of characters via control sequences, which can be used to craft source code     that renders different logic than the logical ordering of tokens ingested by compilers and interpreters.
    Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted     vulnerabilities are introduced invisibly to human reviewers. (CVE-2021-42574)

An update of the kafka package has been released.

  - Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to     timing attacks that make brute force attacks for such credentials more likely to be successful. Users     should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The     affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1,     2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0. (CVE-2021-38153)

An update of the vim package has been released.

  - vim is vulnerable to Use After Free (CVE-2021-3796)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the libsepol package has been released.

  - The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from     cil_reset_classperms_set and cil_reset_classperms_list). (CVE-2021-36086)

  - The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from
    __cil_verify_classpermission and __cil_pre_verify_helper). (CVE-2021-36084)

  - The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from
    __verify_map_perm_classperms and hashtab_map). (CVE-2021-36085)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the apache package has been released.

  - Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate     incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially     crafted packet could be used to trigger an infinite loop resulting in a denial of service.
    (CVE-2021-41079)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the httpd package has been released.

  - ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules     pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache     HTTP Server 2.4.48 and earlier. (CVE-2021-39275)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the containerd package has been released.

  - containerd is an open source container runtime with an emphasis on simplicity, robustness and portability.
    A bug was found in containerd where container root directories and some plugins had insufficiently     restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and     execute programs. When containers included executable programs with extended permission bits (such as     setuid), unprivileged Linux users could discover and execute those programs. When the UID of an     unprivileged Linux user on the host collided with the file owner or group inside a container, the     unprivileged Linux user on the host could discover, read, and modify those files. This vulnerability has     been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are     released and may restart containers or update directory permissions to mitigate the vulnerability. Users     unable to update should limit access to the host to trusted users. Update directory permission on     container bundles directories. (CVE-2021-41103)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the docker package has been released.

  - Moby is an open-source project created by Docker to enable software containerization. A bug was found in     Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container     can result in Unix file permission changes for existing files in the hosts filesystem, widening access     to others. This bug does not directly allow files to be read, modified, or executed without an additional     cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this     version as soon as possible. Running containers do not need to be restarted. (CVE-2021-41089)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the openssh package has been released.

  - sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows     privilege escalation because supplemental groups are not initialized as expected. Helper programs for     AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group     memberships of the sshd process, if the configuration specifies running the command as a different user.
    (CVE-2021-41617)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the openssh package has been released.

  - sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows     privilege escalation because supplemental groups are not initialized as expected. Helper programs for     AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group     memberships of the sshd process, if the configuration specifies running the command as a different user.
    (CVE-2021-41617)

  - OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username     and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a     challenge is sent only when that combination could be valid for a login session. (CVE-2016-20012)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

  - u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to     improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for     a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon     Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon     Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W,     MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150 (CVE-2020-3702)

  - A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in     the Linux kernel through 5.13.13. (CVE-2021-40490)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the httpd package has been released.

  - A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the     remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. (CVE-2021-40438)

  - Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP     Server 2.4.48 and earlier. (CVE-2021-34798)

  - A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and     crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive). (CVE-2021-36160)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the vim package has been released.

  - vim is vulnerable to Heap-based Buffer Overflow (CVE-2021-3778)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
156592	Photon OS 3.0: Binutils PHSA-2022-3.0-0348	high
156591	Photon OS 3.0: Keepalived PHSA-2022-3.0-0348	medium
156590	Photon OS 3.0: Python3 PHSA-2022-3.0-0349	medium
156589	Photon OS 3.0: Vim PHSA-2022-3.0-0338	high
156588	Photon OS 3.0: Vim PHSA-2021-3.0-0346	high
156587	Photon OS 3.0: Consul PHSA-2021-3.0-0346	high
156586	Photon OS 3.0: Pkg PHSA-2021-3.0-0346	high
156585	Photon OS 3.0: Httpd PHSA-2021-3.0-0346	critical
156584	Photon OS 3.0: Bluez PHSA-2021-3.0-0346	medium
156583	Photon OS 3.0: Krb5 PHSA-2021-3.0-0342	high
156582	Photon OS 3.0: Wireshark PHSA-2022-3.0-0341	high
156581	Photon OS 3.0: Vim PHSA-2022-3.0-0347	high
156580	Photon OS 3.0: Linux PHSA-2022-3.0-0345	high
156579	Photon OS 3.0: Runc PHSA-2022-3.0-0345	medium
156578	Photon OS 3.0: Lapack PHSA-2022-3.0-0344	critical
156577	Photon OS 3.0: Vim PHSA-2022-3.0-0344	high
155853	Photon OS 4.0: Nss PHSA-2021-4.0-0135	critical
155852	Photon OS 3.0: Nss PHSA-2021-3.0-0337	critical
155851	Photon OS 2.0: Nss PHSA-2021-2.0-0418	critical
155850	Photon OS 1.0: Nss PHSA-2021-1.0-0454	critical
155347	Photon OS 2.0: Rubygem PHSA-2021-2.0-0413	critical
155331	Photon OS 2.0: Mysql PHSA-2021-2.0-0412	medium
155330	Photon OS 2.0: Bindutils PHSA-2021-2.0-0412	medium
155329	Photon OS 1.0: Mysql PHSA-2021-1.0-0448	medium
155328	Photon OS 1.0: Bindutils PHSA-2021-1.0-0448	medium
155327	Photon OS 4.0: Apache PHSA-2021-4.0-0126	high
155326	Photon OS 4.0: Linux PHSA-2021-4.0-0126	high
155322	Photon OS 4.0: Linux PHSA-2021-4.0-0127	critical
155321	Photon OS 3.0: Libgcrypt PHSA-2021-3.0-0327	medium
155320	Photon OS 3.0: Mysql PHSA-2021-3.0-0327	high
155319	Photon OS 3.0: Bindutils PHSA-2021-3.0-0327	medium
155313	Photon OS 4.0: Rust PHSA-2021-4.0-0122	high
155310	Photon OS 3.0: Kafka PHSA-2021-3.0-0324	medium
155309	Photon OS 3.0: Rust PHSA-2021-3.0-0324	high
154025	Photon OS 2.0: Vim PHSA-2021-2.0-0403	high
153990	Photon OS 3.0: Libsepol PHSA-2021-3.0-0303	low
153988	Photon OS 3.0: Apache PHSA-2021-3.0-0312	high
153987	Photon OS 3.0: Vim PHSA-2021-3.0-0312	high
153986	Photon OS 3.0: Httpd PHSA-2021-3.0-0312	critical
153980	Photon OS 2.0: Containerd PHSA-2021-2.0-0402	high
153979	Photon OS 2.0: Docker PHSA-2021-2.0-0402	medium
153975	Photon OS 1.0: Openssh PHSA-2021-1.0-0440	high
153974	Photon OS 4.0: Containerd PHSA-2021-4.0-0113	high
153973	Photon OS 4.0: Docker PHSA-2021-4.0-0113	medium
153972	Photon OS 4.0: Openssh PHSA-2021-4.0-0113	high
153971	Photon OS 4.0: Vim PHSA-2021-4.0-0113	high
153963	Photon OS 2.0: Linux PHSA-2021-2.0-0399	high
153962	Photon OS 2.0: Httpd PHSA-2021-2.0-0399	critical
153961	Photon OS 3.0: Httpd PHSA-2021-3.0-0309	critical
153960	Photon OS 3.0: Vim PHSA-2021-3.0-0309	high

PhotonOS Local Security Checks Family for Nessus

high

medium

medium

high

high

high

high

critical

medium

high

high

high

high

medium

critical

high

critical

critical

critical

critical

critical

medium

medium

medium

medium

high

high

critical

medium

high

medium

high

medium

high

high

low

high

high

critical

high

medium

high

high

medium

high

high

high

critical

critical

high