The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5465 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * frr: Incorrect handling of a error in parsing of an invalid section of a BGP update can de-peer a router     (CVE-2023-38802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5459 advisory.

    The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript     translates PostScript code to common bitmap formats so that the code can be displayed or printed.

    Security Fix(es):

    * ghostscript: vulnerable to OS command injection due to mishandles permission validation for pipe devices     (CVE-2023-36664)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5477 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.3.1 ESR.

    Security Fix(es):

    * firefox: use-after-free in workers (CVE-2023-3600)

    * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

    * Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

    * Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (CVE-2023-5176)

    * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5473 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: stack exhaustion in control channel code may lead to DoS (CVE-2023-3341)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5474 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: stack exhaustion in control channel code may lead to DoS (CVE-2023-3341)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5438 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.3.1.

    Security Fix(es):

    * firefox: use-after-free in workers (CVE-2023-3600)

    * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

    * Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

    * Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (CVE-2023-5176)

    * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5432 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.3.1.

    Security Fix(es):

    * firefox: use-after-free in workers (CVE-2023-3600)

    * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

    * Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

    * Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (CVE-2023-5176)

    * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5430 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.3.1.

    Security Fix(es):

    * firefox: use-after-free in workers (CVE-2023-3600)

    * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

    * Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

    * Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (CVE-2023-5176)

    * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5437 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.3.1 ESR.

    Security Fix(es):

    * firefox: use-after-free in workers (CVE-2023-3600)

    * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

    * Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

    * Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (CVE-2023-5176)

    * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5426 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.3.1 ESR.

    Security Fix(es):

    * firefox: use-after-free in workers (CVE-2023-3600)

    * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

    * Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

    * Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (CVE-2023-5176)

    * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5439 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.3.1.

    Security Fix(es):

    * firefox: use-after-free in workers (CVE-2023-3600)

    * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

    * Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

    * Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (CVE-2023-5176)

    * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5436 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.3.1 ESR.

    Security Fix(es):

    * firefox: use-after-free in workers (CVE-2023-3600)

    * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

    * Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

    * Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (CVE-2023-5176)

    * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5434 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.3.1 ESR.

    Security Fix(es):

    * firefox: use-after-free in workers (CVE-2023-3600)

    * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

    * Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

    * Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (CVE-2023-5176)

    * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5428 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.3.1.

    Security Fix(es):

    * firefox: use-after-free in workers (CVE-2023-3600)

    * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

    * Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

    * Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (CVE-2023-5176)

    * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5427 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.3.1 ESR.

    Security Fix(es):

    * firefox: use-after-free in workers (CVE-2023-3600)

    * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

    * Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

    * Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (CVE-2023-5176)

    * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5429 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.3.1.

    Security Fix(es):

    * firefox: use-after-free in workers (CVE-2023-3600)

    * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

    * Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

    * Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (CVE-2023-5176)

    * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5433 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.3.1 ESR.

    Security Fix(es):

    * firefox: use-after-free in workers (CVE-2023-3600)

    * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

    * Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

    * Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (CVE-2023-5176)

    * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5435 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.3.1.

    Security Fix(es):

    * firefox: use-after-free in workers (CVE-2023-3600)

    * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

    * Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

    * Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (CVE-2023-5176)

    * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5440 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.3.1 ESR.

    Security Fix(es):

    * firefox: use-after-free in workers (CVE-2023-3600)

    * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)

    * Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)

    * Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3     (CVE-2023-5176)

    * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5419 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege     escalation (CVE-2023-32233)

    * hw: amd: Cross-Process Information Leak (CVE-2023-20593)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5414 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5405 advisory.

    The Advanced Virtualization module provides the user-space component for running virtual machines that use     KVM in environments managed by Red Hat products.

    Security Fix(es):

    * NTFS-3G: buffer overflow issue in NTFS-3G can cause code execution via crafted metadata in an NTFS image     (CVE-2022-40284)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5362 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (18). (BZ#2234409)

    Security Fix(es):

    * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()     (CVE-2023-32006)

    * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5361 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (16). (BZ#2223679,     BZ#2223681, BZ#2223683, BZ#2223685, BZ#2223687, BZ#2233892)

    Security Fix(es):

    * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * nodejs: mainModule.proto bypass experimental policy mechanism (CVE-2023-30581)

    * nodejs: process interuption due to invalid Public Key information in x509 certificates (CVE-2023-30588)

    * nodejs: HTTP Request Smuggling via Empty headers separated by CR (CVE-2023-30589)

    * nodejs: DiffieHellman do not generate keys after setting a private key (CVE-2023-30590)

    * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()     (CVE-2023-32006)

    * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * nodejs:16/nodejs: nodejs.prov doesn't generate the bundled dependency for modules starting @ like     @colors/colors (BZ#2237395)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5353 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF)     files.

    Security Fix(es):

    * libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0800)

    * libtiff: out-of-bounds write in _TIFFmemcpy() in libtiff/tif_unix.c when called by functions in     tools/tiffcrop.c (CVE-2023-0801)

    * libtiff: out-of-bounds write in extractContigSamplesShifted32bits() in tools/tiffcrop.c (CVE-2023-0802)

    * libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0803)

    * libtiff: out-of-bounds write in extractContigSamplesShifted24bits() in tools/tiffcrop.c (CVE-2023-0804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5363 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (18). (BZ#2223313,     BZ#2234404)

    Security Fix(es):

    * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()     (CVE-2023-32006)

    * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5360 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (16). (BZ#2233891)

    Security Fix(es):

    * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire()     (CVE-2023-32006)

    * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * nodejs:16/nodejs: nodejs.prov doesn't generate the bundled dependency for modules starting @ like     @colors/colors (BZ#2237394)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5309 advisory.

    The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format     with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format,     and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and     browser developers can use WebP to compress, archive, and distribute digital images more efficiently.

    Security Fix(es):

    * libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5312 advisory.

    The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of     guest operating system virtualization components that enhance performance and user experience of virtual     machines.

    Security Fix(es):

    * open-vm-tools: SAML token signature bypass (CVE-2023-20900)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5313 advisory.

    The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of     guest operating system virtualization components that enhance performance and user experience of virtual     machines.

    Security Fix(es):

    * open-vm-tools: SAML token signature bypass (CVE-2023-20900)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:5252 advisory.

    The dmidecode packages provide utilities for extracting Intel 64 and Intel Itanium hardware information     from the system BIOS or Extensible Firmware Interface (EFI), depending on the SMBIOS/DMI standard. This     information typically includes system manufacturer, model name, serial number, BIOS version, and asset     tag, as well as other details, depending on the manufacturer.

    Security Fix(es):

    * dmidecode: dump-bin to overwrite a local file (CVE-2023-30630)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5255 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-     tuning for systems with extremely high determinism requirements.

    Security Fix(es):

    * kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)

    * kernel: UAF in nftables when nft_set_lookup_global triggered after handling     named and anonymous sets in batch requests (CVE-2023-3390)

    * kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt()     (CVE-2023-35788)

    * hw: amd: Cross-Process Information Leak (CVE-2023-20593,zenbleed)

    * kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090)

    * kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval()     (CVE-2023-35001,ZDI-CAN-20721)

    * kernel: net/sched: cls_fw component can be exploited as result of failure in     tcf_change_indev function (CVE-2023-3776)

    * kernel: netfilter: use-after-free due to improper element removal in     nft_pipapo_remove() (CVE-2023-4004)

    Bug Fix(es):

    * kernel-rt: update RT source tree to the RHEL-8.8.z3 source tree (BZ#2227068)

    * pods get restarted due to failed probes (BZ#2227238)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5264 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * QEMU: VNC: improper I/O watch removal in TLS handshake can lead to remote unauthenticated denial of     service (CVE-2023-3354)

    * NTFS-3G: buffer overflow issue in NTFS-3G can cause code execution via crafted metadata in an NTFS image     (CVE-2022-40284)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * No bootable device with OS boot disk interface VirtIO-SCSI and with more than 9 VirtIO disks.
    (BZ#2228485)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5236 advisory.

    The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format     with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format,     and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and     browser developers can use WebP to compress, archive, and distribute digital images more efficiently.

    Security Fix(es):

    * libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5245 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw: amd: Cross-Process Information Leak (CVE-2023-20593)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5235 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)

    * kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and     cls_route (CVE-2023-4128)

    * kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5244 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090)

    * kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)

    * kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function     (CVE-2023-3776)

    * kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004)

    * kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

    * kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788)

    * kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)

    * hw: amd: Cross-Process Information Leak (CVE-2023-20593)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * low memory deadlock with md devices and external (imsm) metadata handling - requires a kernfs     notification backport (BZ#2208540)

    * Intel 8.9 BUG, SPR EMR FHF ACPI: Fix system hang during S3 wakeup (BZ#2218025)

    * OCS 4.8, cephfs kernel crash:  mds_dispatch ceph_handle_snap unable to handle kernel NULL (BZ#2218271)

    * st_gmac: tx-checksum offload on vlan is not consistent with st_gmac interface (BZ#2219907)

    * refcount_t overflow often happens in mem_cgroup_id_get_online() (BZ#2221010)

    * avoid unnecessary page fault retires on shared memory types (BZ#2221100)

    * enable conntrack clash resolution for GRE (BZ#2223542)

    * ice: avoid bonding causing auxiliary plug/unplug under RTNL lock (BZ#2224515)

    * libceph: harden msgr2.1 frame segment length checks [8.x] (BZ#2227073)

    * Important iavf bug fixes July 2023 (BZ#2228161)

    * i40e error: Cannot set interface MAC/vlanid to 1e:b7:e2:02:b1:aa/0 for ifname ens4f0 vf 0: Resource     temporarily unavailable (BZ#2228163)

    * oops on cifs_mount due to null tcon (BZ#2229128)

    * iptables argument --suppl-groups in extension owner does not work in RHEL8 (BZ#2229715)

    * Hyper-V RHEL 8: incomplete fc_transport implementation in storvsc causes null dereference in     fc_timed_out() (BZ#2230743)

    * Withdrawal: GFS2: could not freeze filesystem: -16 (BZ#2231825)

    * RHEL 8 Hyper-V: Excessive hv_storvsc driver logging with srb_status  SRB_STATUS_INTERNAL_ERROR  (0x30)     (BZ#2231988)

    * RHEL-8: crypto: rng - Fix lock imbalance in crypto_del_rng (BZ#2232215)

    * Intel 8.9 iavf: Driver Update (BZ#2232399)

    * Hyper-V RHEL-8 hv_storvsc driver logging excessive storvsc_log events for storvsc_on_io_completion()     function (BZ#2233227)

    Enhancement(s):

    * Intel 8.9 FEAT, EMR perf: Add EMR CPU PMU support (BZ#2230152)

    * Intel 8.9 FEAT, SPR EMR power: Add uncore frequency control driver (BZ#2230158)

    * Intel 8.9 FEAT EMR perf: RAPL PMU support on EMR (BZ#2230162)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5269 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: schema_element defeats protective search_path changes (CVE-2023-2454)

    * postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5249 advisory.

    The ncurses (new curses) library routines are a terminal-independent method of updating character screens     with reasonable optimization. The ncurses packages contain support utilities including a terminfo compiler     tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo.

    Security Fix(es):

    * ncurses: Local users can trigger security-relevant memory corruption via malformed data (CVE-2023-29491)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5239 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * QEMU: VNC: improper I/O watch removal in TLS handshake can lead to remote unauthenticated denial of     service (CVE-2023-3354)

    * NTFS-3G: buffer overflow issue in NTFS-3G can cause code execution via crafted metadata in an NTFS image     (CVE-2022-40284)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5238 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in     batch requests (CVE-2023-3390)

    * Kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and     cls_route (CVE-2023-4128)

    * kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5259 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    The following packages have been upgraded to a later upstream version: mariadb (10.3). (BZ#2223572,     BZ#2223574, BZ#2223962, BZ#2223965)

    Security Fix(es):

    * mariadb: segmentation fault via the component sub_select (CVE-2022-32084)

    * mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091)

    * mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791)

    * mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [MariaDB 10.3.32] socat: E Failed to set SNI host  (SST failure) (BZ#2223961)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5220 advisory.

    The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of     guest operating system virtualization components that enhance performance and user experience of virtual     machines.

    Security Fix(es):

    * open-vm-tools: SAML token signature bypass (CVE-2023-20900)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5213 advisory.

    The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of     guest operating system virtualization components that enhance performance and user experience of virtual     machines.

    Security Fix(es):

    * open-vm-tools: SAML token signature bypass (CVE-2023-20900)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5216 advisory.

    The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of     guest operating system virtualization components that enhance performance and user experience of virtual     machines.

    Security Fix(es):

    * open-vm-tools: SAML token signature bypass (CVE-2023-20900)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5223 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.15.1.

    Security Fix(es):

    * libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5214 advisory.

    The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format     with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format,     and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and     browser developers can use WebP to compress, archive, and distribute digital images more efficiently.

    Security Fix(es):

    * libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5210 advisory.

    The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of     guest operating system virtualization components that enhance performance and user experience of virtual     machines.

    Security Fix(es):

    * open-vm-tools: SAML token signature bypass (CVE-2023-20900)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5217 advisory.

    The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of     guest operating system virtualization components that enhance performance and user experience of virtual     machines.

    Security Fix(es):

    * open-vm-tools: SAML token signature bypass (CVE-2023-20900)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5218 advisory.

    The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of     guest operating system virtualization components that enhance performance and user experience of virtual     machines.

    Security Fix(es):

    * open-vm-tools: SAML token signature bypass (CVE-2023-20900)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
182596	RHEL 8 : frr (RHSA-2023:5465)	high
182595	RHEL 9 : ghostscript (RHSA-2023:5459)	high
182594	RHEL 7 : firefox (RHSA-2023:5477)	critical
182593	RHEL 8 : bind (RHSA-2023:5473)	high
182592	RHEL 8 : bind (RHSA-2023:5474)	high
182555	RHEL 8 : thunderbird (RHSA-2023:5438)	critical
182554	RHEL 8 : thunderbird (RHSA-2023:5432)	critical
182553	RHEL 8 : thunderbird (RHSA-2023:5430)	critical
182552	RHEL 8 : firefox (RHSA-2023:5437)	critical
182551	RHEL 8 : firefox (RHSA-2023:5426)	critical
182540	RHEL 9 : thunderbird (RHSA-2023:5439)	critical
182539	RHEL 8 : firefox (RHSA-2023:5436)	critical
182538	RHEL 9 : firefox (RHSA-2023:5434)	critical
182537	RHEL 8 : thunderbird (RHSA-2023:5428)	critical
182536	RHEL 9 : firefox (RHSA-2023:5427)	critical
182535	RHEL 8 : thunderbird (RHSA-2023:5429)	critical
182534	RHEL 8 : firefox (RHSA-2023:5433)	critical
182533	RHEL 9 : thunderbird (RHSA-2023:5435)	critical
182532	RHEL 8 : firefox (RHSA-2023:5440)	critical
182439	RHEL 7 : kernel (RHSA-2023:5419)	critical
182429	RHEL 7 : kernel (RHSA-2023:5414)	critical
182166	RHEL 8 : virt:av and virt-devel:av (RHSA-2023:5405)	high
181893	RHEL 8 : nodejs:18 (RHSA-2023:5362)	critical
181892	RHEL 8 : nodejs:16 (RHSA-2023:5361)	critical
181891	RHEL 8 : libtiff (RHSA-2023:5353)	medium
181890	RHEL 9 : nodejs:18 (RHSA-2023:5363)	critical
181889	RHEL 8 : nodejs:16 (RHSA-2023:5360)	critical
181695	RHEL 8 : libwebp (RHSA-2023:5309)	high
181694	RHEL 8 : open-vm-tools (RHSA-2023:5312)	high
181693	RHEL 9 : open-vm-tools (RHSA-2023:5313)	high
181633	RHEL 8 : dmidecode (RHSA-2023:5252)	high
181632	RHEL 8 : kernel-rt (RHSA-2023:5255)	critical
181631	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2023:5264)	high
181624	RHEL 8 : libwebp: critical (RHSA-2023:5236)	high
181623	RHEL 8 : linux-firmware (RHSA-2023:5245)	critical
181622	RHEL 8 : kpatch-patch (RHSA-2023:5235)	high
181621	RHEL 8 : kernel (RHSA-2023:5244)	critical
181620	RHEL 8 : postgresql:15 (RHSA-2023:5269)	high
181619	RHEL 8 : ncurses (RHSA-2023:5249)	critical
181618	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2023:5239)	high
181617	RHEL 8 : kernel (RHSA-2023:5238)	high
181616	RHEL 8 : mariadb:10.3 (RHSA-2023:5259)	high
181610	RHEL 8 : open-vm-tools (RHSA-2023:5220)	high
181609	RHEL 8 : open-vm-tools (RHSA-2023:5213)	high
181608	RHEL 8 : open-vm-tools (RHSA-2023:5216)	high
181607	RHEL 9 : thunderbird (RHSA-2023:5223)	high
181606	RHEL 9 : libwebp (RHSA-2023:5214)	high
181605	RHEL 8 : open-vm-tools (RHSA-2023:5210)	high
181604	RHEL 7 : open-vm-tools (RHSA-2023:5217)	high
181603	RHEL 9 : open-vm-tools (RHSA-2023:5218)	high

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

high

critical

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

medium

critical

critical

high

high

high

high

critical

high

high

critical

high

critical

high

critical

high

high

high

high

high

high

high

high

high

high

high