An update of the libgcrypt package has been released.

  - Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent     blinding to address a side-channel attack against mpi_powm, and the window size is not chosen     appropriately. This, for example, affects use of ElGamal in OpenPGP. (CVE-2021-33560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the httpd package has been released.

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in     mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team     could create one, though some particular compiler and/or compilation option might make it possible, with     limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow     (CVE-2020-35452)

  - Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer     dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers,     leading to a Denial of Service (CVE-2020-13950)

  - Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'     (CVE-2021-30641)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the go package has been released.

  - Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from     DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to     the RFC1035 format. (CVE-2021-33195)

  - In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's     header) can cause a NewReader or OpenReader panic. (CVE-2021-33196)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the     math/big.Rat SetString or UnmarshalText method. (CVE-2021-33198)

  - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an     X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS     server to cause a TLS client to panic. (CVE-2021-34558)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the openssl package has been released.

  - ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a     buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings     which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not     a strict requirement, ASN.1 strings that are parsed using OpenSSL's own 'd2i' functions (and other similar     parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will     additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for     applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array     by directly setting the 'data' and 'length' fields in the ASN1_STRING array. This can also happen by using     the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to     assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for     strings that have been directly constructed. Where an application requests an ASN.1 structure to be     printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the     application without NUL terminating the 'data' field, then a read buffer overrun can occur. The same thing     can also occur during name constraints processing of certificates (for example if a certificate has been     directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the     certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the     X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an     application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL     functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack).
    It could also result in the disclosure of private memory contents (such as private keys, or sensitive     plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected     1.0.2-1.0.2y). (CVE-2021-3712)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the cpio package has been released.

  - GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a     dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear     whether there are common cases where the pattern file, associated with the -E option, is untrusted data.
    (CVE-2021-38185)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

  - An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass     RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users     with the ability to start and control a VM to read/write random pages of memory and can result in local     privilege escalation. (CVE-2021-22543)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the glibc package has been released.

  - In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles     certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was     introduced as a side effect of the CVE-2021-33574 fix. (CVE-2021-38604)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the dnsmasq package has been released.

  - A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given     network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to     find the outgoing port used by dnsmasq, only needs to guess the random transmission ID to forge a reply     and get it accepted by dnsmasq. This flaw makes a DNS Cache Poisoning attack much easier. The highest     threat from this vulnerability is to data integrity. (CVE-2021-3448)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the haproxy package has been released.

  - An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead     to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority     is mishandled. (CVE-2021-39242)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

  - In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds     write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without     the CAP_SYS_ADMIN capability. (CVE-2021-38166)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the nxtgn package has been released.

  - ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a     buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings     which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not     a strict requirement, ASN.1 strings that are parsed using OpenSSL's own 'd2i' functions (and other similar     parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will     additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for     applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array     by directly setting the 'data' and 'length' fields in the ASN1_STRING array. This can also happen by using     the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to     assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for     strings that have been directly constructed. Where an application requests an ASN.1 structure to be     printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the     application without NUL terminating the 'data' field, then a read buffer overrun can occur. The same thing     can also occur during name constraints processing of certificates (for example if a certificate has been     directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the     certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the     X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an     application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL     functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack).
    It could also result in the disclosure of private memory contents (such as private keys, or sensitive     plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected     1.0.2-1.0.2y). (CVE-2021-3712)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the nettle package has been released.

  - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An     attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial     of service. (CVE-2021-3580)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the ruby package has been released.

  - An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does     not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-     middle attackers to bypass the TLS protections by leveraging a network position between the client and the     registry to block the StartTLS command, aka a 'StartTLS stripping attack.' (CVE-2021-32066)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the rust package has been released.

  - library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters     at the beginning of an IP address string, which (in some situations) allows attackers to bypass access     control that is based on IP addresses, because of unexpected octal interpretation. (CVE-2021-29922)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the mysql package has been released.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported     versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability     allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to     some of MySQL Server accessible data. CVSS 3.1 Base Score 5.9 (Integrity and Availability impacts). CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). (CVE-2021-2356)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the redis package has been released.

  - Redis is an in-memory database that persists on disk. A vulnerability involving out-of-bounds read and     integer overflow to buffer overflow exists starting with version 2.2 and prior to versions 5.0.13, 6.0.15,     and 6.2.5. On 32-bit systems, Redis `*BIT*` command are vulnerable to integer overflow that can     potentially be exploited to corrupt the heap, leak arbitrary heap contents or trigger remote code     execution. The vulnerability involves changing the default `proto-max-bulk-len` configuration parameter to     a very large value and constructing specially crafted commands bit commands. This problem only affects     Redis on 32-bit platforms, or compiled as a 32-bit binary. Redis versions 5.0.`3m 6.0.15, and 6.2.5     contain patches for this issue. An additional workaround to mitigate the problem without patching the     `redis-server` executable is to prevent users from modifying the `proto-max-bulk-len` configuration     parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.
    (CVE-2021-32761)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the util package has been released.

  - An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker     were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file.
    (CVE-2021-37600)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the c package has been released. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the glibc package has been released.

  - The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in     parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in     a denial of service or disclosure of information. This occurs because atoi was used but strtoul should     have been used to ensure correct calculations. (CVE-2021-35942)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the mysql package has been released.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported     versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability     allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to     some of MySQL Server accessible data. CVSS 3.1 Base Score 5.9 (Integrity and Availability impacts). CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). (CVE-2021-2356)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Federated). Supported     versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). (CVE-2021-2354)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 8.0.25 and prior. Easily exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). (CVE-2021-2357)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the falco package has been released.

  - A local malicious user can circumvent the Falco detection engine through 0.28.1 by running a program that     alters arguments of system calls being executed. Issue is fixed in Falco versions >= 0.29.1.
    (CVE-2021-33505)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

  - kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka     CID-0c18f29aae7c. Without CONFIG_MODULE_SIG, verification that a kernel module is signed, for loading via     init_module, does not occur for a module.sig_enforce=1 command-line argument. (CVE-2021-35039)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

An update of the wireshark package has been released.

ID	Name	Severity
153185	Photon OS 3.0: Libgcrypt PHSA-2021-3.0-0257	high
153184	Photon OS 3.0: Httpd PHSA-2021-3.0-0257	high
153045	Photon OS 3.0: Go PHSA-2021-3.0-0294	high
153044	Photon OS 4.0: Openssl PHSA-2021-4.0-0094	critical
153043	Photon OS 2.0: Cpio PHSA-2021-2.0-0388	high
153042	Photon OS 2.0: Linux PHSA-2021-2.0-0387	high
153041	Photon OS 3.0: Cpio PHSA-2021-3.0-0295	high
153040	Photon OS 3.0: Glibc PHSA-2021-3.0-0295	high
153039	Photon OS 4.0: Dnsmasq PHSA-2021-4.0-0093	medium
153038	Photon OS 2.0: Dnsmasq PHSA-2021-2.0-0386	medium
153037	Photon OS 4.0: Haproxy PHSA-2021-4.0-0092	high
153036	Photon OS 4.0: Cpio PHSA-2021-4.0-0092	high
153035	Photon OS 4.0: Linux PHSA-2021-4.0-0095	high
153034	Photon OS 4.0: Glibc PHSA-2021-4.0-0095	high
153033	Photon OS 3.0: Haproxy PHSA-2021-3.0-0293	high
153032	Photon OS 3.0: Dnsmasq PHSA-2021-3.0-0293	medium
153031	Photon OS 1.0: Dnsmasq PHSA-2021-1.0-0431	medium
152886	Photon OS 3.0: Openssl PHSA-2021-3.0-0290	high
152885	Photon OS 3.0: Nxtgn PHSA-2021-3.0-0290	critical
152884	Photon OS 1.0: Cpio PHSA-2021-1.0-0430	high
152883	Photon OS 1.0: Glibc PHSA-2021-1.0-0428	high
152882	Photon OS 2.0: Nxtgn PHSA-2021-2.0-0383	critical
152881	Photon OS 2.0: Openssl PHSA-2021-2.0-0383	high
152880	Photon OS 2.0: Glibc PHSA-2021-2.0-0383	high
152879	Photon OS 4.0: Cpio PHSA-2021-4.0-0089	high
152878	Photon OS 1.0: Openssl PHSA-2021-1.0-0429	high
152797	Photon OS 2.0: Nettle PHSA-2021-2.0-0380	high
152796	Photon OS 4.0: Ruby PHSA-2021-4.0-0084	high
152794	Photon OS 3.0: Rust PHSA-2021-3.0-0288	critical
152793	Photon OS 1.0: Mysql PHSA-2021-1.0-0427	medium
152792	Photon OS 2.0: Mysql PHSA-2021-2.0-0381	medium
152791	Photon OS 4.0: Nettle PHSA-2021-4.0-0083	high
152790	Photon OS 4.0: Redis PHSA-2021-4.0-0083	high
152789	Photon OS 2.0: Util PHSA-2021-2.0-0379	medium
152788	Photon OS 3.0: Nettle PHSA-2021-3.0-0286	high
152787	Photon OS 1.0: Util PHSA-2021-1.0-0424	medium
152786	Photon OS 4.0: Util PHSA-2021-4.0-0081	medium
152785	Photon OS 1.0: Nettle PHSA-2021-1.0-0426	high
152560	Photon OS 3.0: C PHSA-2021-3.0-0282	high
152559	Photon OS 4.0: C PHSA-2021-4.0-0079	high
152558	Photon OS 2.0: C PHSA-2021-2.0-0378	high
152557	Photon OS 3.0: Util PHSA-2021-3.0-0283	medium
152556	Photon OS 1.0: C PHSA-2021-1.0-0423	high
152502	Photon OS 3.0: Glibc PHSA-2021-3.0-0281	critical
152501	Photon OS 4.0: Mysql PHSA-2021-4.0-0077	medium
152500	Photon OS 4.0: Falco PHSA-2021-4.0-0077	high
152499	Photon OS 4.0: Glibc PHSA-2021-4.0-0077	critical
152492	Photon OS 4.0: Linux PHSA-2021-4.0-0078	high
152388	Photon OS 3.0: Linux PHSA-2021-3.0-0278	high
152387	Photon OS 4.0: Wireshark PHSA-2021-4.0-0076	high

PhotonOS Local Security Checks Family for Nessus

high

high

high

critical

high

high

high

high

medium

medium

high

high

high

high

high

medium

medium

high

critical

high

high

critical

high

high

high

high

high

high

critical

medium

medium

high

high

medium

high

medium

medium

high

high

high

high

medium

high

critical

medium

high

critical

high

high

high