The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3140 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.11.0 ESR.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3147 advisory.

    The Apache Portable Runtime (APR) is a portability library used by the     Apache HTTP Server and other projects. apr-util is a library which provides     additional utility interfaces for APR; including support for XML parsing,     LDAP, database interfaces, URI parsing, and more.

    Security Fix(es):

    * apr-util: out-of-bounds writes in the apr_base64 (CVE-2022-25147)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3141 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.11.0 ESR.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3145 advisory.

    The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other     projects. apr-util is a library which provides additional utility interfaces for APR; including support     for XML parsing, LDAP, database interfaces, URI parsing, and more.

    Security Fix(es):

    * apr-util: out-of-bounds writes in the apr_base64 (CVE-2022-25147)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3136 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR8.

    Security Fix(es):

    * OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504)     (CVE-2022-21426)

    * OpenJDK: improper restrictions in CORBA deserialization (Serialization, 8285021) (CVE-2023-21830)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3139 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.11.0 ESR.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3138 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.11.0 ESR.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3146 advisory.

    The Apache Portable Runtime (APR) is a portability library used by the     Apache HTTP Server and other projects. apr-util is a library which provides     additional utility interfaces for APR; including support for XML parsing,     LDAP, database interfaces, URI parsing, and more.

    Security Fix(es):

    * apr-util: out-of-bounds writes in the apr_base64 (CVE-2022-25147)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3149 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.11.0.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3152 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.11.0.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3150 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.11.0.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3142 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.11.0 ESR.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3151 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.11.0.

    Security Fix(es):

    * Mozilla: Browser prompts could have been obscured by popups (CVE-2023-32205)

    * Mozilla: Crash in RLBox Expat driver (CVE-2023-32206)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-32207)

    * Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 (CVE-2023-32215)

    * Mozilla: Content process crash due to invalid wasm code (CVE-2023-32211)

    * Mozilla: Potential spoof due to obscured address bar (CVE-2023-32212)

    * Mozilla: Potential memory corruption in FileReader::DoReadData() (CVE-2023-32213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3106 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: FTP too eager connection reuse (CVE-2023-27535)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Cannot upload files to Jscape SFTP server: file gets created empty (BZ#2188029)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:2863 advisory.

    Ctags is a C programming language indexing and cross-reference tool.

    Security Fix(es):

    * ctags: arbitrary command execution via a tag file with a crafted filename (CVE-2022-4515)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:2898 advisory.

    The libtar packages contain a C library for manipulating tar archives. The library supports both the     strict POSIX tar format and many of the commonly used GNU extensions.

    Security Fix(es):

    * libtar: out-of-bounds read in gnu_longlink (CVE-2021-33643)

    * libtar: out-of-bounds read in gnu_longname (CVE-2021-33644)

    * libtar: memory leak found in th_read() function (CVE-2021-33645)

    * libtar: memory leak found in th_read() function (CVE-2021-33646)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2969 advisory.

    The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol     (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from     SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses     SNMP, and a Tk/Perl Management Information Base (MIB) browser.

    Security Fix(es):

    * net-snmp: NULL Pointer Exception when handling ipDefaultTTL (CVE-2022-44792)

    * net-snmp: NULL Pointer Exception when handling pv6IpForwarding (CVE-2022-44793)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2951 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2122230,     BZ#2122267)

    Security Fix(es):

    * use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)

    * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)

    * when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds     (CVE-2021-33656)

    * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)

    * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)

    * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)

    * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)

    * media: em28xx: initialize refcount before kref_get (CVE-2022-3239)

    * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)

    * memory leak in ipv6_renew_options() (CVE-2022-3524)

    * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * data races around sk->sk_prot (CVE-2022-3567)

    * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)

    * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)

    * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)

    * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)

    * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)

    * Executable Space Protection Bypass (CVE-2022-25265)

    * Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

    * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)

    * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning     (CVE-2022-39189)

    * Report vmalloc UAF in dvb-core/dmxdev (CVE-2022-41218)

    * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)

    * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)

    * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)

    * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)

    * Denial of service in beacon protection for P2P-device (CVE-2022-42722)

    * memory corruption in usbmon driver (CVE-2022-43750)

    * NULL pointer dereference in traffic control subsystem (CVE-2022-47929)

    * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)

    * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)

    * Soft lockup occurred during __page_mapcount (CVE-2023-1582)

    * slab-out-of-bounds read vulnerabilities in cbq_classify (CVE-2023-23454)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3068 advisory.

    Expat is a C library for parsing XML documents. The mingw-expat packages provide a port of the Expat     library for MinGW.

    Security Fix(es):

    * expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3087 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld)     and many client programs and libraries.

    The following packages have been upgraded to a later upstream version: mysql (8.0.32). (BZ#2177734,     BZ#2177735, BZ#2177736)

    Security Fix(es):

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2023) (CVE-2023-21912)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21594)

    * mysql: Server: Stored Procedure unspecified vulnerability (CPU Oct 2022) (CVE-2022-21599)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21604)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21608)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21611)

    * mysql: Server: Connection Handling unspecified vulnerability (CPU Oct 2022) (CVE-2022-21617)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21625)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Oct 2022) (CVE-2022-21632)

    * mysql: Server: Replication unspecified vulnerability (CPU Oct 2022) (CVE-2022-21633)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21637)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21640)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39400)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39408)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39410)

    * mysql: Server: DML unspecified vulnerability (CPU Jan 2023) (CVE-2023-21836)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21863)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21864)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21865)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21867)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21868)

    * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21869)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21870)

    * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21871)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21873)

    * mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2023) (CVE-2023-21875)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21876)

    * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21877)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21878)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21879)

    * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21880)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21881)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21883)

    * mysql: Server: GIS unspecified vulnerability (CPU Jan 2023) (CVE-2023-21887)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) (CVE-2023-21917)

    * mysql: Server: Thread Pooling unspecified vulnerability (CPU Jan 2023) (CVE-2023-21874)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21882)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL8 AppStream and Devel channels missing mecab-devel rpm (BZ#2180411)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:3107 advisory.

    Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and     uses strong cryptography to provide both authentication and encryption services. These services allow you     to build secure tunnels through untrusted networks such as virtual private network (VPN).

    Security Fix(es):

    * libreswan: Regression of CVE-2023-30570 fixes in the Red Hat Enterprise Linux (CVE-2023-2295)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2834 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkitgtk: use-after-free issue leading to arbitrary code execution (CVE-2022-42826)

    * webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-23517)

    * webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-23518)

    * webkitgtk: buffer overflow issue was addressed with improved memory handling (CVE-2022-32886)

    * webkitgtk: out-of-bounds write issue was addressed with improved bounds checking (CVE-2022-32888)

    * webkitgtk: correctness issue in the JIT was addressed with improved checks (CVE-2022-32923)

    * webkitgtk: issue was addressed with improved UI handling (CVE-2022-42799)

    * webkitgtk: type confusion issue leading to arbitrary code execution (CVE-2022-42823)

    * webkitgtk: sensitive information disclosure issue (CVE-2022-42824)

    * webkitgtk: memory disclosure issue was addressed with improved memory handling (CVE-2022-42852)

    * webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-42863)

    * webkitgtk: use-after-free issue leading to arbitrary code execution (CVE-2022-42867)

    * webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46691)

    * webkitgtk: Same Origin Policy bypass issue (CVE-2022-46692)

    * webkitgtk: logic issue leading to user information disclosure (CVE-2022-46698)

    * webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46699)

    * webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2022-46700)

    * webkitgtk: heap-use-after-free in WebCore::RenderLayer::addChild() (CVE-2023-25358)

    * webkitgtk: heap-use-after-free in WebCore::RenderLayer::renderer() (CVE-2023-25360)

    * webkitgtk: heap-use-after-free in WebCore::RenderLayer::setNextSibling() (CVE-2023-25361)

    * webkitgtk: heap-use-after-free in WebCore::RenderLayer::repaintBlockSelectionGaps() (CVE-2023-25362)

    * webkitgtk: heap-use-after-free in WebCore::RenderLayer::updateDescendantDependentFlags()     (CVE-2023-25363)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2830 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg-x11-server: XkbGetKbdByName use-after-free (CVE-2022-4283)

    * xorg-x11-server: XTestSwapFakeInput stack overflow (CVE-2022-46340)

    * xorg-x11-server: XIPassiveUngrab out-of-bounds access (CVE-2022-46341)

    * xorg-x11-server: XvdiSelectVideoNotify use-after-free (CVE-2022-46342)

    * xorg-x11-server: ScreenSaverSetAttributes use-after-free (CVE-2022-46343)

    * xorg-x11-server: XIChangeProperty out-of-bounds access (CVE-2022-46344)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3104 advisory.

    GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing     features, a scripting language (elisp), and the capability to read e-mail and news.

    Security Fix(es):

    * emacs: Regression of CVE-2023-28617 fixes in the Red Hat Enterprise Linux (CVE-2023-2491)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:2860 advisory.

    Python is an interpreted, interactive, object-oriented programming language that supports modules,     classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a     stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and     PostgreSQL.

    Security Fix(es):

    * Python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2859 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * git: On multi-user machines Git users might find themselves unexpectedly in a Git worktree     (CVE-2022-24765)

    * git: Bypass of safe.directory protections (CVE-2022-29187)

    * git: exposure of sensitive information to a malicious actor (CVE-2022-39253)

    * git: git shell function that splits command arguments can lead to arbitrary heap writes.
    (CVE-2022-39260)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3082 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)

    * rubygem-rack: denial of service in header parsing (CVE-2023-27539)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints     (BZ#2180700)

    * Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster     resources (BZ#2180706)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2806 advisory.

    X.Org is an open-source implementation of the X Window System. It provides the basic low-level     functionality that full-fledged graphical user interfaces are designed upon.

    Security Fix(es):

    * xorg-x11-server: buffer overflow in _GetCountedString() in xkb/xkb.c (CVE-2022-3550)

    * xorg-x11-server: XkbGetKbdByName use-after-free (CVE-2022-4283)

    * xorg-x11-server: XTestSwapFakeInput stack overflow (CVE-2022-46340)

    * xorg-x11-server: XIPassiveUngrab out-of-bounds access (CVE-2022-46341)

    * xorg-x11-server: XvdiSelectVideoNotify use-after-free (CVE-2022-46342)

    * xorg-x11-server: ScreenSaverSetAttributes use-after-free (CVE-2022-46343)

    * xorg-x11-server: XIChangeProperty out-of-bounds access (CVE-2022-46344)

    * xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation (CVE-2023-0494)

    * xorg-x11-server: memory leak in ProcXkbGetKbdByName() in xkb/xkb.c (CVE-2022-3551)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3108 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * WebKitGTK: Regression of CVE-2023-28205 fixes in the Red Hat Enterprise Linux (CVE-2023-2203)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:2784 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)

    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

    * grafana: using email as a username can block other users from signing in (CVE-2022-39229)

    * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2802 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

    * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

    * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

    * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

    * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

    * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

    * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

    * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

    * golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

    * podman: symlink exchange attack in podman export volume (CVE-2023-0778)

    * podman: possible information disclosure and modification (CVE-2022-2989)

    * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short,     potentially allowing a denial of service (CVE-2022-32189)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:2801 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * frr: out-of-bounds read in the BGP daemon may lead to information disclosure or denial of service     (CVE-2022-37032)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:2866 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)

    * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

    * golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2736 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341)

    * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)

    * when setting font with malicious data by ioctl PIO_FONT, kernel will write memory out of bounds     (CVE-2021-33656)

    * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462)

    * use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)

    * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789)

    * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196)

    * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663)

    * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028)

    * media: em28xx: initialize refcount before kref_get (CVE-2022-3239)

    * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522)

    * memory leak in ipv6_renew_options() (CVE-2022-3524)

    * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566)

    * data races around sk->sk_prot (CVE-2022-3567)

    * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619)

    * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623)

    * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)

    * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628)

    * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707)

    * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129)

    * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141)

    * Executable Space Protection Bypass (CVE-2022-25265)

    * Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594)

    * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188)

    * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning     (CVE-2022-39189)

    * Report vmalloc UAF in dvb-core/dmxdev (CVE-2022-41218)

    * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674)

    * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)

    * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720)

    * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721)

    * Denial of service in beacon protection for P2P-device (CVE-2022-42722)

    * memory corruption in usbmon driver (CVE-2022-43750)

    * NULL pointer dereference in traffic control subsystem (CVE-2022-47929)

    * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394)

    * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)

    * Soft lockup occurred during __page_mapcount (CVE-2023-1582)

    * slab-out-of-bounds read vulnerabilities in cbq_classify (CVE-2023-23454)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2851 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: clients using `/parallel` command line switch might read uninitialized data (CVE-2022-39282)

    * freerdp: clients using the `/video` command line switch might read uninitialized data (CVE-2022-39283)

    * freerdp: out of bounds read in zgfx decoder (CVE-2022-39316)

    * freerdp: undefined behaviour in zgfx decoder (CVE-2022-39317)

    * freerdp: division by zero in urbdrc channel (CVE-2022-39318)

    * freerdp: missing length validation in urbdrc channel (CVE-2022-39319)

    * freerdp: heap buffer overflow in urbdrc channel (CVE-2022-39320)

    * freerdp: missing path sanitation with `drive` channel (CVE-2022-39347)

    * freerdp: missing input length validation in `drive` channel (CVE-2022-41877)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2763 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    The following packages have been upgraded to a later upstream version: python38 (3.8.16).

    Security Fix(es):

    * python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading     to DoS (CVE-2020-10735)

    * python: open redirection vulnerability in lib/http/server.py may lead to information disclosure     (CVE-2021-28861)

    * python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2903 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: php (7.4.33).

    Security Fix(es):

    * XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

    * php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications     (CVE-2022-31629)

    * php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

    * php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)

    * php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2764 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    The following packages have been upgraded to a later upstream version: python39 (3.9.16).

    Security Fix(es):

    * python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading     to DoS (CVE-2020-10735)

    * python: open redirection vulnerability in lib/http/server.py may lead to information disclosure     (CVE-2021-28861)

    * python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2870 advisory.

    FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service     (RADIUS) server, designed to allow centralized authentication and authorization for a network.

    Security Fix(es):

    * freeradius: Information leakage in EAP-PWD (CVE-2022-41859)

    * freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860)

    * freeradius: Crash on invalid abinary data (CVE-2022-41861)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2883 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF)     files.

    Security Fix(es):

    * libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c (CVE-2022-3627)

    * libtiff: integer overflow in function TIFFReadRGBATileExt of the file (CVE-2022-3970)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2963 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: Incorrect handling of control code characters in cookies (CVE-2022-35252)

    * curl: Use-after-free triggered by an HTTP proxy deny response (CVE-2022-43552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3000 advisory.

    The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP     network to get their own network configuration information, including an IP address, a subnet mask, and a     broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and     administer DHCP on a network.

    Security Fix(es):

    * dhcp: option refcount overflow when leasequery is enabled leading to dhcpd abort (CVE-2022-2928)

    * dhcp: DHCP memory leak (CVE-2022-2929)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2792 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: processing large delegations may severely degrade resolver performance (CVE-2022-2795)

    * bind: flooding with UPDATE requests may lead to DoS (CVE-2022-3094)

    * bind: sending specific queries to the resolver may cause a DoS (CVE-2022-3736)

    * bind: sending specific queries to the resolver may cause a DoS (CVE-2022-3924)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3002 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: processing large delegations may severely degrade resolver performance (CVE-2022-2795)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:3067 advisory.

    AutoTrace is a program for converting bitmaps to vector graphics.

    Security Fix(es):

    * autotrace: heap-buffer overflow via the ReadImage() at input-bmp.c (CVE-2022-32323)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3083 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

    * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Backport fix for https://github.com/golang/go/issues/56891 (BZ#2167412)

    * Update Go to 1.19.6 (BZ#2174430)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:3095 advisory.

    Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and     uses strong cryptography to provide both authentication and encryption services. These services allow you     to build secure tunnels through untrusted networks such as virtual private network (VPN).

    Security Fix(es):

    * libreswan: remote DoS via crafted TS payload with an incorrect selector length (CVE-2023-23009)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * authby=rsasig fails in FIPS policy (BZ#2187647)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3042 advisory.

    GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing     features, a scripting language (elisp), and the capability to read e-mail and news.

    Security Fix(es):

    * emacs: ctags local command execution vulnerability (CVE-2022-45939)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:2987 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    The following packages have been upgraded to a later upstream version: samba (4.17.5). (BZ#2132051)

    Security Fix(es):

    * samba: GnuTLS gnutls_rnd() can fail and give predictable random values (CVE-2022-1615)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3097 advisory.

    The gssntlmssp is a GSSAPI NTLM mechanism that allows to perform NTLM authentication in GSSAPI programs.

    Security Fix(es):

    * gssntlmssp: multiple out-of-bounds read when decoding NTLM fields (CVE-2023-25563)

    * gssntlmssp: memory corruption when decoding UTF16 strings (CVE-2023-25564)

    * gssntlmssp: incorrect free when decoding target information (CVE-2023-25565)

    * gssntlmssp: memory leak when parsing usernames (CVE-2023-25566)

    * gssntlmssp: out-of-bounds read when decoding target information (CVE-2023-25567)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
175936	RHEL 8 : firefox (RHSA-2023:3140)	high
175935	RHEL 9 : apr-util (RHSA-2023:3147)	medium
175934	RHEL 8 : firefox (RHSA-2023:3141)	high
175933	RHEL 7 : apr-util (RHSA-2023:3145)	medium
175932	RHEL 7 : java-1.8.0-ibm (RHSA-2023:3136)	medium
175930	RHEL 8 : firefox (RHSA-2023:3139)	high
175924	RHEL 8 : firefox (RHSA-2023:3138)	high
175923	RHEL 9 : apr-util (RHSA-2023:3146)	medium
175922	RHEL 9 : thunderbird (RHSA-2023:3149)	high
175921	RHEL 8 : thunderbird (RHSA-2023:3152)	high
175920	RHEL 9 : thunderbird (RHSA-2023:3150)	high
175918	RHEL 9 : firefox (RHSA-2023:3142)	high
175917	RHEL 7 : thunderbird (RHSA-2023:3151)	high
175908	RHEL 8 : curl (RHSA-2023:3106)	medium
175903	RHEL 8 : ctags (RHSA-2023:2863)	high
175902	RHEL 8 : libtar (RHSA-2023:2898)	critical
175901	RHEL 8 : net-snmp (RHSA-2023:2969)	medium
175900	RHEL 8 : kernel (RHSA-2023:2951)	high
175899	RHEL 8 : mingw-expat (RHSA-2023:3068)	high
175895	RHEL 8 : mysql:8.0 (RHSA-2023:3087)	medium
175894	RHEL 8 : libreswan (RHSA-2023:3107)	high
175882	RHEL 8 : webkit2gtk3 (RHSA-2023:2834)	high
175881	RHEL 8 : tigervnc (RHSA-2023:2830)	high
175880	RHEL 8 : emacs (RHSA-2023:3104)	high
175879	RHEL 8 : python27:2.7 (RHSA-2023:2860)	high
175878	RHEL 8 : git (RHSA-2023:2859)	high
175875	RHEL 8 : pcs (RHSA-2023:3082)	high
175874	RHEL 8 : xorg-x11-server (RHSA-2023:2806)	high
175873	RHEL 8 : webkit2gtk3 (RHSA-2023:3108)	high
175872	RHEL 8 : grafana (RHSA-2023:2784)	high
175871	RHEL 8 : container-tools:4.0 (RHSA-2023:2802)	high
175870	RHEL 8 : frr (RHSA-2023:2801)	critical
175867	RHEL 8 : git-lfs (RHSA-2023:2866)	high
175866	RHEL 8 : kernel-rt (RHSA-2023:2736)	high
175865	RHEL 8 : freerdp (RHSA-2023:2851)	high
175864	RHEL 8 : python38:3.8 and python38-devel:3.8 (RHSA-2023:2763)	high
175863	RHEL 8 : php:7.4 (RHSA-2023:2903)	critical
175862	RHEL 8 : python39:3.9 and python39-devel:3.9 (RHSA-2023:2764)	high
175861	RHEL 8 : freeradius:3.0 (RHSA-2023:2870)	high
175859	RHEL 8 : libtiff (RHSA-2023:2883)	high
175857	RHEL 8 : curl (RHSA-2023:2963)	medium
175855	RHEL 8 : dhcp (RHSA-2023:3000)	medium
175854	RHEL 8 : bind9.16 (RHSA-2023:2792)	medium
175853	RHEL 8 : bind (RHSA-2023:3002)	medium
175851	RHEL 8 : autotrace (RHSA-2023:3067)	high
175849	RHEL 8 : go-toolset:rhel8 (RHSA-2023:3083)	high
175846	RHEL 8 : libreswan (RHSA-2023:3095)	medium
175844	RHEL 8 : emacs (RHSA-2023:3042)	high
175843	RHEL 8 : samba (RHSA-2023:2987)	medium
175842	RHEL 8 : gssntlmssp (RHSA-2023:3097)	high

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

medium

high

medium

medium

high

high

medium

high

high

high

high

high

medium

high

critical

medium

high

high

medium

high

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

high

critical

high

high

high

medium

medium

medium

medium

high

high

medium

high

medium

high