The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3394 advisory.

    The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate     System.

    Security Fix(es):

    * pki-core: access to external entities when parsing XML can lead to XXE (CVE-2022-2414)

    * pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by     entering name in Subject field (CVE-2022-2393)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3397 advisory.

    QATzip is a user space library which builds on top of the Intel QuickAssist Technology user space library,     to provide extended accelerated compression and decompression services by offloading the actual     compression and decompression request(s) to the Intel Chipset Series. QATzip produces data using the     standard gzip* format (RFC1952) with extended headers. The data can be decompressed with a compliant gzip*     implementation. QATzip is designed to take full advantage of the performance provided by Intel QuickAssist     Technology.

    Security Fix(es):

    * qatzip: local privilege escalation (CVE-2022-36369)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Intel QAT Update - QATzip (User Space Changes) (BZ#2178769)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3319 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3323 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

    * golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

    * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

    * golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

    * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3318 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    The golang packages provide the Go programming language compiler.

    Security Fix(es):

    * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3436 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: powerpc: KVM guest OS users can cause host OS memory corruption (CVE-2021-37576)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3292 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: HTTP request splitting with mod_rewrite and mod_proxy (CVE-2023-25690)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3269 advisory.

    The binutils packages provide a collection of binary utilities for the manipulation of object code in     various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf,     size, strings, strip, and addr2line utilities.

    Security Fix(es):

    * binutils: NULL pointer dereference in _bfd_elf_get_symbol_version_string leads to segfault     (CVE-2022-4285)

    * libiberty: Heap/stack buffer overflow in the dlang_lname function in d-demangle.c (CVE-2021-3826)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3291 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: rh-ruby27-ruby (2.7.8).
    (BZ#2149267)

    Security Fix(es):

    * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)

    * ruby: ReDoS vulnerability in URI (CVE-2023-28755)

    * ruby: ReDoS vulnerability in Time (CVE-2023-28756)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3280 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be     overwritten with partially controlled contents (CVE-2023-25652)

    * git: arbitrary configuration injection when renaming or deleting a section from a configuration file     (CVE-2023-29007)

    * git: malicious placement of crafted messages when git was compiled with runtime prefix (CVE-2023-25815)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3276 advisory.

    The sudo packages contain the sudo utility which allows system administrators to provide certain users     with the permission to execute privileged commands, which are used for system management purposes, without     having to log in as root.

    Security Fix(es):

    * sudo: arbitrary file write with privileges of the RunAs user (CVE-2023-22809)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3277 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3263 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be     overwritten with partially controlled contents (CVE-2023-25652)

    * git: arbitrary configuration injection when renaming or deleting a section from a configuration file     (CVE-2023-29007)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:3278 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3262 advisory.

    The sudo packages contain the sudo utility which allows system administrators to provide certain users     with the permission to execute privileged commands, which are used for system management purposes, without     having to log in as root.

    Security Fix(es):

    * sudo: arbitrary file write with privileges of the RunAs user (CVE-2023-22809)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3264 advisory.

    The sudo packages contain the sudo utility which allows system administrators to provide certain users     with the permission to execute privileged commands, which are used for system management purposes, without     having to log in as root.

    Security Fix(es):

    * sudo: arbitrary file write with privileges of the RunAs user (CVE-2023-22809)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3243 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be     overwritten with partially controlled contents (CVE-2023-25652)

    * git: arbitrary configuration injection when renaming or deleting a section from a configuration file     (CVE-2023-29007)

    * git: malicious placement of crafted messages when git was compiled with runtime prefix (CVE-2023-25815)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3247 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be     overwritten with partially controlled contents (CVE-2023-25652)

    * git: arbitrary configuration injection when renaming or deleting a section from a configuration file     (CVE-2023-29007)

    * git: malicious placement of crafted messages when git was compiled with runtime prefix (CVE-2023-25815)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3248 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be     overwritten with partially controlled contents (CVE-2023-25652)

    * git: arbitrary configuration injection when renaming or deleting a section from a configuration file     (CVE-2023-29007)

    * git: malicious placement of crafted messages when git was compiled with runtime prefix (CVE-2023-25815)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3245 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be     overwritten with partially controlled contents (CVE-2023-25652)

    * git: arbitrary configuration injection when renaming or deleting a section from a configuration file     (CVE-2023-29007)

    * git: data exfiltration with maliciously crafted repository (CVE-2023-22490)

    * git: git apply: a path outside the working tree can be overwritten with crafted input (CVE-2023-23946)

    * git: malicious placement of crafted messages when git was compiled with runtime prefix (CVE-2023-25815)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3246 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be     overwritten with partially controlled contents (CVE-2023-25652)

    * git: arbitrary configuration injection when renaming or deleting a section from a configuration file     (CVE-2023-29007)

    * git: data exfiltration with maliciously crafted repository (CVE-2023-22490)

    * git: git apply: a path outside the working tree can be overwritten with crafted input (CVE-2023-23946)

    * git: malicious placement of crafted messages when git was compiled with runtime prefix (CVE-2023-25815)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2780 advisory.

    Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits,     that uses osbuild under the hood.

    Security Fix(es):

    * golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)

    * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)

    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

    * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

    * golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests     (CVE-2022-41717)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2758 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

    * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

    * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

    * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

    * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

    * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

    * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

    * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

    * golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

    * podman: symlink exchange attack in podman export volume (CVE-2023-0778)

    * golang: crypto/tls: session tickets lack random ticket_age_add (CVE-2022-30629)

    * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short,     potentially allowing a denial of service (CVE-2022-32189)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:2805 advisory.

    Xwayland is an X server for running X clients under Wayland.

    Security Fix(es):

    * xorg-x11-server: buffer overflow in _GetCountedString() in xkb/xkb.c (CVE-2022-3550)

    * xorg-x11-server: XkbGetKbdByName use-after-free (CVE-2022-4283)

    * xorg-x11-server: XTestSwapFakeInput stack overflow (CVE-2022-46340)

    * xorg-x11-server: XIPassiveUngrab out-of-bounds access (CVE-2022-46341)

    * xorg-x11-server: XvdiSelectVideoNotify use-after-free (CVE-2022-46342)

    * xorg-x11-server: ScreenSaverSetAttributes use-after-free (CVE-2022-46343)

    * xorg-x11-server: XIChangeProperty out-of-bounds access (CVE-2022-46344)

    * xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation (CVE-2023-0494)

    * xorg-x11-server: memory leak in ProcXkbGetKbdByName() in xkb/xkb.c (CVE-2022-3551)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3220 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.11.0 ESR.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3221 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.11.0.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3177 advisory.

    The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other     projects. apr-util is a library which provides additional utility interfaces for APR; including support     for XML parsing, LDAP, database interfaces, URI parsing, and more.

    Security Fix(es):

    * apr-util: out-of-bounds writes in the apr_base64 (CVE-2022-25147)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3190 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * kernel: remote DoS in TIPC kernel module (CVE-2023-1390)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3189 advisory.

    GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing     features, a scripting language (elisp), and the capability to read e-mail and news.

    Security Fix(es):

    * emacs: command injection vulnerability in org-mode (CVE-2023-28617)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3191 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * kernel: remote DoS in TIPC kernel module (CVE-2023-1390)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3192 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * git: by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be     overwritten with partially controlled contents (CVE-2023-25652)

    * git: arbitrary configuration injection when renaming or deleting a section from a configuration file     (CVE-2023-29007)

    * git: malicious placement of crafted messages when git was compiled with runtime prefix (CVE-2023-25815)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3178 advisory.

    The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other     projects. apr-util is a library which provides additional utility interfaces for APR; including support     for XML parsing, LDAP, database interfaces, URI parsing, and more.

    Security Fix(es):

    * apr-util: out-of-bounds writes in the apr_base64 (CVE-2022-25147)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:3148 advisory.

    Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and     uses strong cryptography to provide both authentication and encryption services. These services allow you     to build secure tunnels through untrusted networks such as virtual private network (VPN).

    Security Fix(es):

    * libreswan: Regression of CVE-2023-30570 fixes in the Red Hat Enterprise Linux (CVE-2023-2295)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3155 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.11.0.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3143 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.11.0 ESR.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3154 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.11.0.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3137 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.11.0 ESR.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3153 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.11.0.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3140 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.11.0 ESR.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3147 advisory.

    The Apache Portable Runtime (APR) is a portability library used by the     Apache HTTP Server and other projects. apr-util is a library which provides     additional utility interfaces for APR; including support for XML parsing,     LDAP, database interfaces, URI parsing, and more.

    Security Fix(es):

    * apr-util: out-of-bounds writes in the apr_base64 (CVE-2022-25147)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3141 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.11.0 ESR.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3145 advisory.

    The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other     projects. apr-util is a library which provides additional utility interfaces for APR; including support     for XML parsing, LDAP, database interfaces, URI parsing, and more.

    Security Fix(es):

    * apr-util: out-of-bounds writes in the apr_base64 (CVE-2022-25147)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3136 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR8.

    Security Fix(es):

    * OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504)     (CVE-2022-21426)

    * OpenJDK: improper restrictions in CORBA deserialization (Serialization, 8285021) (CVE-2023-21830)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3139 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.11.0 ESR.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3138 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.11.0 ESR.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3146 advisory.

    The Apache Portable Runtime (APR) is a portability library used by the     Apache HTTP Server and other projects. apr-util is a library which provides     additional utility interfaces for APR; including support for XML parsing,     LDAP, database interfaces, URI parsing, and more.

    Security Fix(es):

    * apr-util: out-of-bounds writes in the apr_base64 (CVE-2022-25147)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3149 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.11.0.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3152 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.11.0.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3150 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.11.0.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3142 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.11.0 ESR.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
176536	RHEL 8 : pki-core:10.6 (RHSA-2023:3394)	high
176535	RHEL 8 : qatzip (RHSA-2023:3397)	high
176392	RHEL 8 : go-toolset:rhel8 (RHSA-2023:3319)	critical
176391	RHEL 7 : go-toolset-1.19 and go-toolset-1.19-golang (RHSA-2023:3323)	critical
176357	RHEL 9 : go-toolset and golang (RHSA-2023:3318)	critical
176330	RHEL 8 : kpatch-patch (RHSA-2021:3436)	high
176322	RHEL 7 : httpd24-httpd (RHSA-2023:3292)	critical
176321	RHEL 7 : devtoolset-12-binutils (RHSA-2023:3269)	medium
176320	RHEL 7 : rh-ruby27-ruby (RHSA-2023:3291)	high
176256	RHEL 7 : rh-git227-git (RHSA-2023:3280)	high
176250	RHEL 7 : sudo (RHSA-2023:3276)	high
176247	RHEL 7 : kernel (RHSA-2023:3277)	high
176246	RHEL 7 : git (RHSA-2023:3263)	high
176245	RHEL 7 : kpatch-patch (RHSA-2023:3278)	high
176233	RHEL 7 : sudo (RHSA-2023:3262)	high
176232	RHEL 7 : sudo (RHSA-2023:3264)	high
176205	RHEL 8 : git (RHSA-2023:3243)	high
176204	RHEL 8 : git (RHSA-2023:3247)	high
176203	RHEL 9 : git (RHSA-2023:3248)	high
176202	RHEL 9 : git (RHSA-2023:3245)	high
176201	RHEL 8 : git (RHSA-2023:3246)	high
176147	RHEL 8 : Image Builder (RHSA-2023:2780)	high
176146	RHEL 8 : container-tools:rhel8 (RHSA-2023:2758)	medium
176145	RHEL 8 : xorg-x11-server-Xwayland (RHSA-2023:2805)	high
176068	RHEL 8 : firefox (RHSA-2023:3220)	high
176065	RHEL 8 : thunderbird (RHSA-2023:3221)	high
175984	RHEL 8 : apr-util (RHSA-2023:3177)	medium
175983	RHEL 8 : kernel (RHSA-2023:3190)	high
175982	RHEL 8 : emacs (RHSA-2023:3189)	high
175981	RHEL 8 : kpatch-patch (RHSA-2023:3191)	high
175980	RHEL 8 : git (RHSA-2023:3192)	high
175979	RHEL 8 : apr-util (RHSA-2023:3178)	medium
175943	RHEL 9 : libreswan (RHSA-2023:3148)	high
175942	RHEL 8 : thunderbird (RHSA-2023:3155)	high
175941	RHEL 9 : firefox (RHSA-2023:3143)	high
175940	RHEL 8 : thunderbird (RHSA-2023:3154)	high
175938	RHEL 7 : firefox (RHSA-2023:3137)	high
175937	RHEL 8 : thunderbird (RHSA-2023:3153)	high
175936	RHEL 8 : firefox (RHSA-2023:3140)	high
175935	RHEL 9 : apr-util (RHSA-2023:3147)	medium
175934	RHEL 8 : firefox (RHSA-2023:3141)	high
175933	RHEL 7 : apr-util (RHSA-2023:3145)	medium
175932	RHEL 7 : java-1.8.0-ibm (RHSA-2023:3136)	medium
175930	RHEL 8 : firefox (RHSA-2023:3139)	high
175924	RHEL 8 : firefox (RHSA-2023:3138)	high
175923	RHEL 9 : apr-util (RHSA-2023:3146)	medium
175922	RHEL 9 : thunderbird (RHSA-2023:3149)	high
175921	RHEL 8 : thunderbird (RHSA-2023:3152)	high
175920	RHEL 9 : thunderbird (RHSA-2023:3150)	high
175918	RHEL 9 : firefox (RHSA-2023:3142)	high

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

high

critical

critical

critical

high

critical

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high

high

high

medium

high

high

high

high

medium

high

high

high

high

high

high

high

medium

high

medium

medium

high

high

medium

high

high

high

high