The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:7504 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.5.0.

    Security Fix(es):

    * Mozilla: Out-of-bound memory access in WebGL2 blitFramebuffer (CVE-2023-6204)

    * Mozilla: Use-after-free in MessagePort::Entangled (CVE-2023-6205)

    * Mozilla: Clickjacking permission prompts using the fullscreen transition (CVE-2023-6206)

    * Mozilla: Use-after-free in ReadableByteStreamQueueEntry::Buffer (CVE-2023-6207)

    * Mozilla: Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5     (CVE-2023-6212)

    * Mozilla: Using Selection API would copy contents into X11 primary selection. (CVE-2023-6208)

    * Mozilla: Incorrect parsing of relative URLs starting with /// (CVE-2023-6209)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7730 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7786 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5993 advisory.

    Python is an interpreted, interactive, object-oriented programming language that supports modules,     classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a     stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and     PostgreSQL.

    Security Fix(es):

    * python: TLS handshake bypass (CVE-2023-40217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7579 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

    * postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)

    * postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)

    * postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0397 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    Bug Fix(es):

    * squid crashes in assertion when a parent peer exists (JIRA:RHEL-18256)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7533 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty (CVE-2023-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:7511 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.5.0 ESR.

    Security Fix(es):

    * Mozilla: Out-of-bound memory access in WebGL2 blitFramebuffer (CVE-2023-6204)

    * Mozilla: Use-after-free in MessagePort::Entangled (CVE-2023-6205)

    * Mozilla: Clickjacking permission prompts using the fullscreen transition (CVE-2023-6206)

    * Mozilla: Use-after-free in ReadableByteStreamQueueEntry::Buffer (CVE-2023-6207)

    * Mozilla: Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5     (CVE-2023-6212)

    * Mozilla: Using Selection API would copy contents into X11 primary selection. (CVE-2023-6208)

    * Mozilla: Incorrect parsing of relative URLs starting with /// (CVE-2023-6209)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0093 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Security Fix(es):

    * nss: timing attack against RSA decryption (CVE-2023-5388)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1551 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability     (CVE-2023-1393)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1548 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability     (CVE-2023-1393)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0399 advisory.

    The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements     cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

    Security Fix(es):

    * gnutls: timing side-channel in the RSA-PSK authentication (CVE-2023-5981)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7531 advisory.

    Pixman is a pixel manipulation library for the X Window System and Cairo.

    Security Fix(es):

    * pixman: Integer overflow in pixman_sample_floor_y leading to heap out-of-bounds write (CVE-2022-44638)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0011 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.6.0 ESR.

    Security Fix(es):

    * Mozilla: Heap-buffer-overflow affecting WebGL <code>DrawElementsInstanced</code> method with Mesa VM     driver (CVE-2023-6856)

    * Mozilla: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6     (CVE-2023-6864)

    * Mozilla: Potential exposure of uninitialized data in <code>EncryptingOutputStream</code> (CVE-2023-6865)

    * Mozilla: Symlinks may resolve to smaller than expected buffers (CVE-2023-6857)

    * Mozilla: Heap buffer overflow in <code>nsTextFragment</code> (CVE-2023-6858)

    * Mozilla: Use-after-free in PR_GetIdentitiesLayer (CVE-2023-6859)

    * Mozilla: Potential sandbox escape due to <code>VideoBridge</code> lack of texture validation     (CVE-2023-6860)

    * Mozilla: Heap buffer overflow affected <code>nsWindow::PickerOpen(void)</code> in headless mode     (CVE-2023-6861)

    * Mozilla: Use-after-free in <code>nsDNSService</code> (CVE-2023-6862)

    * Mozilla: Clickjacking permission prompts using the popup transition (CVE-2023-6867)

    * Mozilla: Undefined behavior in <code>ShutdownObserver()</code> (CVE-2023-6863)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0014 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions (CVE-2023-6377)

    * xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty     (CVE-2023-6478)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7539 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

    * kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and     cls_route (CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)

    * kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

    * kernel: use-after-free due to race condition occurring in dvb_register_device() (CVE-2022-45884)

    * kernel: use-after-free due to race condition occurring in dvb_net.c (CVE-2022-45886)

    * kernel: use-after-free due to race condition occurring in dvb_ca_en50221.c (CVE-2022-45919)

    * kernel: Race between task migrating pages and another task calling exit_mmap to release those same pages     getting invalid opcode BUG in include/linux/swapops.h (CVE-2023-4732)

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

    * kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Intel 8.8 BUG SPR IOMMU: QAT Device Address Translation Issue with Invalidation Completion Ordering     (BZ#2221097)

    * RHEL 8.9: intel_pstate may provide incorrect scaling values for hybrid capable systems with E-cores     disabled (BZ#2223403)

    * Bring MD code inline with upstream (BZ#2235655)

    * NAT sport clash in OCP causing 1 second TCP connection establishment delay. (BZ#2236514)

    * ibmvnic: NONFATAL reset causes dql BUG_ON crash (BZ#2236701)

    * PVT:1050:NXGZIP: LPM of RHEL client lpar got failed with error HSCLA2CF in 19th loops (BZ#2236703)

    * xfs: mount fails when device file name is long (BZ#2236813)

    * NFSv4.0 client hangs when server reboot while client had outstanding lock request to the server     (BZ#2237840)

    * i40e: backport selected bugfixes (BZ#2238305)

    * Updates for NFS/NFSD/SUNRPC for RHEL 8.9 (BZ#2238394)

    * SCSI updates for RHEL 8.9 (BZ#2238770)

    * kernel: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:35 at:
    sock_map_update_elem_sys+0x85/0x2a0 (BZ#2239475)

    * Random delay receiving packets after bringing up VLAN on top of VF with vf-vlan-pruning enabled     (BZ#2240751)

    * RHEL-8.9 RDMA/restrack: Release MR restrack when delete (BZ#2244423)

    Enhancement(s):

    * Intel 8.9 FEAT EMR power: Add EMR CPU support to intel_rapl driver (BZ#2230146)

    * Intel 8.9 FEAT EMR tools: Add EMR CPU support to turbostat (BZ#2230154)

    * Intel 8.9 FEAT EMR power: Add EMR support to the intel_idle driver (BZ#2230155)

    * Intel 8.9 FEAT EMR RAS: Add EDAC support for EMR (BZ#2230161)

    * Intel 8.9 FEAT general: intel-speed-select (ISST): Update to latest release (BZ#2230163)

    * Intel 8.9 FEAT cpufreq: intel_pstate: Enable HWP IO boost for all servers (BZ#2232123)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7840 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

    Security Fix(es):

    * gstreamer: MXF demuxer use-after-free vulnerability (CVE-2023-44446)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7656 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

    * postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)

    * postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)

    * postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7540 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: cookie injection with none file (CVE-2023-38546)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * libssh (curl sftp) not trying password auth (BZ#2240032)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7264 advisory.

    The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of     guest operating system virtualization components that enhance performance and user experience of virtual     machines.

    Security Fix(es):

    * open-vm-tools: SAML token signature bypass (CVE-2023-34058)

    * open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper (CVE-2023-34059)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7544 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: crafted xml can cause global buffer overflow (CVE-2023-39615)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0456 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    Security Fix(es):

    * grub2: bypass the GRUB password protection feature (CVE-2023-4001)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0452 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: information disclosure by exploiting a mixed case flaw (CVE-2023-46218)

    Bug Fix(es):

    * Cannot upload files bigger than 64K to SSH-2.0-9.99 sshlib server, transfer hangs (RHEL-14836)

    * curl: Incomplete patch for host name wildcard checking (RHEL-20618)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0474 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080)

    * tomcat: FileUpload: DoS due to accumulation of temporary files on Windows (CVE-2023-42794)

    * tomcat: improper cleaning of recycled objects could lead to information leak (CVE-2023-42795)

    * tomcat: incorrectly parsed http trailer headers can cause request smuggling (CVE-2023-45648)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0425 advisory.

    SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A     complete database is stored in a single disk file. The API is designed for convenience and ease of use.
    Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the     administrative hassles of supporting a separate database server.

    Security Fix(es):

    * sqlite: Crash due to misuse of window functions. (CVE-2020-24736)

    * sqlite: an array-bounds overflow if billions of bytes are used in a string argument to a C API     (CVE-2022-35737)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0454 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple     (CVE-2023-27043)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0500 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Security Fix(es):

    * openssl: Incorrect cipher key and IV length processing (CVE-2023-5363)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Backport implicit rejection mechanism for RSA PKCS#1 v1.5 to RHEL-9.2.z (RHEL-14578, BZ#2153471)
    * OpenSSL should provide FIPS-compliant RSA-OAEP (RHEL-14616)
    * NIST SP 800-56Arev3 Section 5.6.2.1 - Missing ECDH Public Key Check (RHEL-15992)
    * In FIPS mode, OpenSSL must not perform any cryptographic operations when rsa_keygen_pairwise_test fails     (RHEL-17110)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0417 advisory.

    The shadow-utils packages include programs for converting UNIX password files to the shadow password     format, as well as utilities for managing user and group accounts.

    Security Fix(es):

    * shadow-utils: possible password leak during passwd(1) change (CVE-2023-4641)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0451 advisory.

    The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements     cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

    Security Fix(es):

    * gnutls: timing side-channel in the RSA-PSK authentication (CVE-2023-5981)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0434 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: information disclosure by exploiting a mixed case flaw (CVE-2023-46218)

    Bug Fix(es):

    * Cannot upload files bigger than 64K to SSH-2.0-9.99 sshlib server, transfer hangs (RHEL-14835)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0433 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0423 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: out-of-bounds read in winbind AUTH_CRAP (CVE-2022-2127)

    * samba: infinite loop in mdssvc RPC service for spotlight (CVE-2023-34966)

    * samba: type confusion in mdssvc RPC service for spotlight (CVE-2023-34967)

    * samba: spotlight server-side share path disclosure (CVE-2023-34968)

    * samba: GnuTLS gnutls_rnd() can fail and give predictable random values (CVE-2022-1615)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0431 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: xfrm_expand_policies() in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice     (CVE-2022-36879)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)

    * kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

    * kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race (CVE-2023-3567)

    * kernel: use-after-free in netfilter: nf_tables (CVE-2023-3777)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest RHEL-9.0.z Batch 14 (RHEL-17273)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0477 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406)

    * ffr: Out of bounds read in bgpd/bgp_label.c (CVE-2023-38407)

    * frr: crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message (CVE-2023-47234)

    * frr: crash from malformed EOR-containing BGP UPDATE message (CVE-2023-47235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0449 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw: intel: Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi (CVE-2022-46329)

    * hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0419 advisory.

    The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving     API.

    Security Fix(es):

    * c-ares: Heap buffer over read in ares_parse_soa_reply (CVE-2020-22217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0406 advisory.

    The protobuf-c packages provide C bindings for Google's Protocol Buffers.

    Security Fix(es):

    * protobuf-c: unsigned integer overflow in parse_required_member (CVE-2022-48468)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0439 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: eBPF: insufficient stack type checks in dynptr (CVE-2023-39191)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: Race Condition leading to UAF in Unix Socket could happen in sk_receive_queue (BZ#2230094)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race (CVE-2023-3567)

    * kernel: use-after-free in netfilter: nf_tables (CVE-2023-3777)

    * kernel: use after free in nft_immediate_deactivate (CVE-2023-4015)

    * kernel: A heap out-of-bounds write (CVE-2023-5717)

    * hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    * kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    * kernel: NULL pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c     (CVE-2023-6679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0436 advisory.

    Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

    Security Fix(es):

    * libcap: Integer Overflow in _libcap_strdup() (CVE-2023-2603)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0432 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating     system.

    Security Fix(es):

    * kernel: xfrm_expand_policies() in net/xfrm/xfrm_policy.c can cause a refcount     to be dropped twice (CVE-2022-36879)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip     (CVE-2022-41858)

    * kernel: use-after-free caused by invalid pointer hostname in fs/cifs/connect.c     (CVE-2023-1195)

    * kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

    * kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race     (CVE-2023-3567)

    * kernel: use-after-free in netfilter: nf_tables (CVE-2023-3777)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU     (CVE-2023-45871)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    Bug Fix(es):

    * RHEL 9 Hyper-V: Excessive hv_storvsc driver logging with srb_status     SRB_STATUS_INTERNAL_ERROR  (0x30)

    * RHEL9.0 - s390/qeth: NET2016 - fix use-after-free in HSCI

    * DM multipath showing failed path for an nvme-o-FC LUN when performing I/O     operations

    * XFS: sync to upstream v5.15

    * AMDSERVER 9.4 Bug, Turin: Support larger microcode patches

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0410 advisory.

    The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can     capture and display the packet headers on a particular network interface or on all interfaces.

    Security Fix(es):

    * tcpslice: use-after-free in extract_slice() (CVE-2021-41043)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0455 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)

    * openssh: potential command injection via shell metacharacters (CVE-2023-51385)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0428 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: FTP too eager connection reuse (CVE-2023-27535)

    * curl: GSS delegation too eager connection re-use (CVE-2023-27536)

    * curl: information disclosure by exploiting a mixed case flaw (CVE-2023-46218)

    * curl: Incorrect handling of control code characters in cookies (CVE-2022-35252)

    * curl: Use-after-free triggered by an HTTP proxy deny response (CVE-2022-43552)

    * curl: more POST-after-PUT confusion (CVE-2023-28322)

    Bug Fix(es):

    * Cannot upload files bigger than 64K to SSH-2.0-9.99 sshlib server, transfer hangs (RHEL-5483)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0408 advisory.

    EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package     contains a sample 64-bit UEFI firmware for QEMU and KVM.

    Security Fix(es):

    * edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler()     (CVE-2019-14560)

    * openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0420 advisory.

    FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType     loads, hints, and renders individual glyphs efficiently.

    Security Fix(es):

    * FreeType: Buffer overflow in sfnt_init_face (CVE-2022-27404)

    * FreeType: Segmentation violation via FNT_Size_Request (CVE-2022-27405)

    * Freetype: Segmentation violation via FT_Request_Size (CVE-2022-27406)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0437 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    Security Fix(es):

    * grub2: bypass the GRUB password protection feature (CVE-2023-4001)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0429 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)

    * openssh: potential command injection via shell metacharacters (CVE-2023-51385)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0421 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate     (CVE-2022-43680)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0464 advisory.

    The python-urllib3 package provides the Python HTTP module with connection pooling and file POST     abilities.

    Security Fix(es):

    * python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

    * urllib3: Request body not stripped after redirect from 303 status changes request method to GET     (CVE-2023-45803)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0418 advisory.

    Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero     Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware     applications allow you to plug your computer into a network and, with no configuration, view other people     to chat with, view printers to print with, and find shared files on other computers.

    Security Fix(es):

    * avahi: Local DoS by event-busy-loop from writing long lines to /run/avahi-daemon/socket (CVE-2021-3468)

    * avahi: Reachable assertion in avahi_dns_packet_append_record (CVE-2023-38469)

    * avahi: Reachable assertion in avahi_escape_label (CVE-2023-38470)

    * avahi: Reachable assertion in dbus_set_host_name (CVE-2023-38471)

    * avahi: Reachable assertion in avahi_rdata_parse (CVE-2023-38472)

    * avahi: Reachable assertion in avahi_alternative_host_name (CVE-2023-38473)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
189657	RHEL 8 : thunderbird (RHSA-2023:7504)	high
189656	RHEL 8 : tracker-miners (RHSA-2023:7730)	high
189655	RHEL 8 : postgresql:10 (RHSA-2023:7786)	high
189654	RHEL 8 : python27:2.7 (RHSA-2023:5993)	critical
189653	RHEL 8 : postgresql:13 (RHSA-2023:7579)	high
189652	RHEL 8 : squid:4 (RHSA-2024:0397)	critical
189651	RHEL 8 : tigervnc (RHSA-2023:7533)	high
189650	RHEL 8 : firefox (RHSA-2023:7511)	high
189649	RHEL 8 : nss (RHSA-2024:0093)	medium
189648	RHEL 8 : tigervnc (RHSA-2023:1551)	high
189647	RHEL 8 : tigervnc (RHSA-2023:1548)	high
189646	RHEL 8 : gnutls (RHSA-2024:0399)	critical
189645	RHEL 8 : pixman (RHSA-2023:7531)	high
189644	RHEL 8 : firefox (RHSA-2024:0011)	high
189643	RHEL 8 : tigervnc (RHSA-2024:0014)	high
189642	RHEL 8 : kernel (RHSA-2023:7539)	high
189641	RHEL 8 : gstreamer1-plugins-bad-free (RHSA-2023:7840)	high
189640	RHEL 8 : postgresql:12 (RHSA-2023:7656)	high
189639	RHEL 8 : curl (RHSA-2023:7540)	low
189638	RHEL 8 : open-vm-tools (RHSA-2023:7264)	high
189637	RHEL 8 : libxml2 (RHSA-2023:7544)	medium
189588	RHEL 9 : grub2 (RHSA-2024:0456)	medium
189587	RHEL 9 : curl (RHSA-2024:0452)	critical
189586	RHEL 9 : tomcat (RHSA-2024:0474)	medium
189585	RHEL 8 : sqlite (RHSA-2024:0425)	high
189584	RHEL 9 : python3.9 (RHSA-2024:0454)	critical
189583	RHEL 9 : openssl (RHSA-2024:0500)	high
189582	RHEL 8 : shadow-utils (RHSA-2024:0417)	medium
189581	RHEL 9 : gnutls (RHSA-2024:0451)	critical
189580	RHEL 9 : curl (RHSA-2024:0434)	critical
189579	RHEL 9 : linux-firmware (RHSA-2024:0433)	medium
189578	RHEL 8 : samba (RHSA-2024:0423)	medium
189577	RHEL 9 : kernel-rt (RHSA-2024:0431)	high
189576	RHEL 9 : frr (RHSA-2024:0477)	critical
189575	RHEL 9 : linux-firmware (RHSA-2024:0449)	medium
189574	RHEL 8 : c-ares (RHSA-2024:0419)	medium
189573	RHEL 8 : protobuf-c (RHSA-2024:0406)	medium
189572	RHEL 9 : kernel-rt (RHSA-2024:0439)	high
189571	RHEL 9 : libcap (RHSA-2024:0436)	critical
189570	RHEL 9 : kernel (RHSA-2024:0432)	high
189569	RHEL 8 : tcpdump (RHSA-2024:0410)	medium
189568	RHEL 9 : openssh (RHSA-2024:0455)	critical
189567	RHEL 8 : curl (RHSA-2024:0428)	critical
189566	RHEL 8 : edk2 (RHSA-2024:0408)	medium
189565	RHEL 8 : freetype (RHSA-2024:0420)	critical
189564	RHEL 9 : grub2 (RHSA-2024:0437)	medium
189563	RHEL 8 : openssh (RHSA-2024:0429)	critical
189562	RHEL 8 : expat (RHSA-2024:0421)	high
189561	RHEL 9 : python-urllib3 (RHSA-2024:0464)	critical
189560	RHEL 8 : avahi (RHSA-2024:0418)	medium

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

high

high

critical

high

critical

high

high

medium

high

high

critical

high

high

high

high

high

high

low

high

medium

medium

critical

medium

high

critical

high

medium

critical

critical

medium

medium

high

critical

medium

medium

medium

high

critical

high

medium

critical

critical

medium

critical

medium

critical

high

critical

medium