The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9314 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: Multiple use after free in XCF parser (CVE-2025-48798)

    * gimp: Multiple heap buffer overflows in TGA parser (CVE-2025-48797)

    * gimp: GIMP ICO File Parsing Integer Overflow (CVE-2025-5473)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9315 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: Multiple use after free in XCF parser (CVE-2025-48798)

    * gimp: Multiple heap buffer overflows in TGA parser (CVE-2025-48797)

    * gimp: GIMP ICO File Parsing Integer Overflow (CVE-2025-5473)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9312 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9309 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: Multiple use after free in XCF parser (CVE-2025-48798)

    * gimp: Multiple heap buffer overflows in TGA parser (CVE-2025-48797)

    * gimp: GIMP ICO File Parsing Integer Overflow (CVE-2025-5473)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9332 advisory.

    The MPFR library is a C library for multiple-precision floating-point computations with correct     rounding. The MPFR is efficient and also has a well-defined semantics. It copies the good ideas from the     ANSI/IEEE-754 standard for double-precision floating-point arithmetic (53-bit mantissa). MPFR is based on     the GMP multiple-precision library.

    Security Fix(es):

    * mpfr: buffer overflow in mpfr_strtofr (CVE-2014-9474)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9318 advisory.

    The javapackages-tools packages provide macros and scripts to support Java packaging.

    Security Fix(es):

    * apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default     (CVE-2019-10086)

    * commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's     declaredClass property by default (CVE-2025-48734)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9326 advisory.

    The libblockdev packages provide a C library with GObject introspection support used for low-level     operations on block devices. The library serves as a thin wrapper around plug-ins for specific     functionality, such as LVM, Btrfs, LUKS, or MD RAID.

    Security Fix(es):

    * libblockdev: LPE from allow_active to root in libblockdev via udisks (CVE-2025-6019)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9307 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * gnome-remote-desktop: freerdp: Unauthenticated RDP Packet Causes Segfault in FreeRDP Leading to Denial     of Service (CVE-2025-4478)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9328 advisory.

    The libblockdev packages provide a C library with GObject introspection support used for low-level     operations on block devices. The library serves as a thin wrapper around plug-ins for specific     functionality, such as LVM, Btrfs, LUKS, or MD RAID.

    Security Fix(es):

    * libblockdev: LPE from allow_active to root in libblockdev via udisks (CVE-2025-6019)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9336 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9327 advisory.

    The libblockdev packages provide a C library with GObject introspection support used for low-level     operations on block devices. The library serves as a thin wrapper around plug-ins for specific     functionality, such as LVM, Btrfs, LUKS, or MD RAID.

    Security Fix(es):

    * libblockdev: LPE from allow_active to root in libblockdev via udisks (CVE-2025-6019)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9185 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:9199 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:9177 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9186 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9184 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:9203 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * cjson: segmentation violation trigger through the second parameter of     function     cJSON_SetValuestring at cJSON.c (CVE-2024-31755)

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9191 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9192 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9190 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9187 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9189 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:9205 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9194 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:9207 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:9200 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9188 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9193 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:9206 advisory.

    The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries     and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9166 advisory.

    The Apache Commons BeanUtils library provides utility methods for accessing and modifying properties of     arbitrary JavaBeans.

    Security Fix(es):

    * commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's     declaredClass property by default (CVE-2025-48734)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9165 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: Multiple use after free in XCF parser (CVE-2025-48798)

    * gimp: Multiple heap buffer overflows in TGA parser (CVE-2025-48797)

    * gimp: GIMP ICO File Parsing Integer Overflow (CVE-2025-5473)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9179 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)

    * libsoup: Denial of Service attack to websocket server (CVE-2025-32049)

    * libsoup: Out of bounds reads in soup_headers_parse_request() (CVE-2025-32906)

    * libsoup: Double free on  soup_message_headers_get_content_disposition() through  soup-message-     headers.c via params GHashTable value (CVE-2025-32911)

    * libsoup: NULL pointer dereference in  soup_message_headers_get_content_disposition when filename     parameter  is present, but has no value in Content-Disposition header (CVE-2025-32913)

    * libsoup: OOB Read on libsoup through function  soup_multipart_new_from_message in soup-multipart.c     leads to crash or  exit of process (CVE-2025-32914)

    * libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup     (CVE-2025-4948)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9172 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:9156 advisory.

    HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables      driverless support for USB devices capable of using IPP-over-USB protocol.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:9155 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * libvpx: Double-free in libvpx encoder (CVE-2025-5283)

    * firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details     (CVE-2025-5267)

    * firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264)

    * firefox: thunderbird: Memory safety bugs (CVE-2025-5268)

    * firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266)

    * firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content     (CVE-2025-5263)

    * firefox: thunderbird: Memory safety bug (CVE-2025-5269)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9178 advisory.

    DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6     and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal,     rebinding and release. The DHCPv6 server supports prefix delegation. Both servers support DNS Update     mechanism, using stand-alone DDNS daemon.

    Security Fix(es):

    * kea: Loading a malicious hook library can lead to local privilege escalation (CVE-2025-32801)

    * kea: Insecure handling of file paths allows multiple local attacks (CVE-2025-32802)

    * kea: Insecure file permissions can result in confidential information leakage (CVE-2025-32803)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9162 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: Multiple use after free in XCF parser (CVE-2025-48798)

    * gimp: Multiple heap buffer overflows in TGA parser (CVE-2025-48797)

    * gimp: GIMP ICO File Parsing Integer Overflow (CVE-2025-5473)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9144 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:9143 advisory.

    The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-     ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI     concerns itself only with network connectivity of containers and removing allocated resources when the     container is deleted.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9145 advisory.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9142 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9149 advisory.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9148 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9150 advisory.

    A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor.
    Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9146 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9151 advisory.

    A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor.
    Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9147 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9122 advisory.

    The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec,     commonly used with the WebM multimedia container file format.

    Security Fix(es):

    * libvpx: Double-free in libvpx encoder (CVE-2025-5283)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9120 advisory.

    The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec,     commonly used with the WebM multimedia container file format.

    Security Fix(es):

    * libvpx: Double-free in libvpx encoder (CVE-2025-5283)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:9128 advisory.

    The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec,     commonly used with the WebM multimedia container file format.

    Security Fix(es):

    * libvpx: Double-free in libvpx encoder (CVE-2025-5283)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
240252	RHEL 9 : gimp (RHSA-2025:9314)	high
240251	RHEL 9 : gimp (RHSA-2025:9315)	high
240250	RHEL 8 : container-tools:rhel8 (RHSA-2025:9312)	critical
240249	RHEL 8 : gimp:2.8 (RHSA-2025:9309)	high
240248	RHEL 7 : mpfr (RHSA-2025:9332)	critical
240247	RHEL 8 : javapackages-tools:201801 (RHSA-2025:9318)	high
240246	RHEL 9 : libblockdev (RHSA-2025:9326)	high
240245	RHEL 10 : freerdp (RHSA-2025:9307)	high
240244	RHEL 10 : libblockdev (RHSA-2025:9328)	high
240243	RHEL 9 : glibc (RHSA-2025:9336)	high
240242	RHEL 9 : libblockdev (RHSA-2025:9327)	high
240142	RHEL 9 : ipa (RHSA-2025:9185)	critical
240141	RHEL 8 : git-lfs (RHSA-2025:9199)	critical
240140	RHEL 9 : git-lfs (RHSA-2025:9177)	critical
240139	RHEL 9 : ipa (RHSA-2025:9186)	critical
240138	RHEL 9 : ipa (RHSA-2025:9184)	critical
240137	RHEL 8 / 9 : Satellite 6.16.5.2 Async Update (Moderate) (RHSA-2025:9203)	high
240136	RHEL 8 : idm:DL1 (RHSA-2025:9191)	critical
240135	RHEL 8 : idm:DL1 (RHSA-2025:9192)	critical
240134	RHEL 10 : ipa (RHSA-2025:9190)	critical
240133	RHEL 9 : ipa (RHSA-2025:9187)	critical
240132	RHEL 7 : ipa (RHSA-2025:9189)	critical
240131	RHEL 9 : git-lfs (RHSA-2025:9205)	critical
240130	RHEL 8 : idm:DL1 (RHSA-2025:9194)	critical
240129	RHEL 8 : grafana (RHSA-2025:9207)	critical
240128	RHEL 8 : git-lfs (RHSA-2025:9200)	critical
240127	RHEL 8 : idm:DL1 (RHSA-2025:9188)	critical
240126	RHEL 8 : idm:client (RHSA-2025:9193)	critical
240125	RHEL 8 : grafana-pcp (RHSA-2025:9206)	critical
240105	RHEL 10 : apache-commons-beanutils (RHSA-2025:9166)	high
240104	RHEL 8 : gimp:2.8 (RHSA-2025:9165)	high
240103	RHEL 7 : libsoup (RHSA-2025:9179)	critical
240102	RHEL 8 : go-toolset:rhel8 (RHSA-2025:9172)	critical
240101	RHEL 10 : golang-github-openprinting-ipp-usb (RHSA-2025:9156)	critical
240100	RHEL 8 : firefox (RHSA-2025:9155)	high
240099	RHEL 10 : kea (RHSA-2025:9178)	high
240098	RHEL 9 : gimp (RHSA-2025:9162)	high
240088	RHEL 9 : podman (RHSA-2025:9144)	critical
240087	RHEL 9 : containernetworking-plugins (RHSA-2025:9143)	critical
240086	RHEL 9 : skopeo (RHSA-2025:9145)	critical
240085	RHEL 8 : container-tools:rhel8 (RHSA-2025:9142)	critical
240084	RHEL 10 : skopeo (RHSA-2025:9149)	critical
240083	RHEL 10 : buildah (RHSA-2025:9148)	critical
240082	RHEL 9 : gvisor-tap-vsock (RHSA-2025:9150)	critical
240081	RHEL 10 : podman (RHSA-2025:9146)	critical
240080	RHEL 10 : gvisor-tap-vsock (RHSA-2025:9151)	critical
240079	RHEL 9 : buildah (RHSA-2025:9147)	critical
240075	RHEL 9 : libvpx (RHSA-2025:9122)	medium
240074	RHEL 10 : libvpx (RHSA-2025:9120)	medium
240073	RHEL 8 : libvpx (RHSA-2025:9128)	medium

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

high

critical

high

critical

high

high

high

high

high

high

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

critical

critical

critical

high

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

medium

medium