The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2514 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302)

    * kernel: can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922)

    * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices     (CVE-2024-53197)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2483 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: Use-After-Free in libxml2 (CVE-2024-56171)

    * libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2 (CVE-2025-24928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2627 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ACPI: extlog: fix NULL pointer dereference check (CVE-2023-52605)

    * kernel: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (CVE-2024-50264)

    * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302)

    * kernel: can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922)

    * kernel: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (CVE-2024-53113)

    * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices     (CVE-2024-53197)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2675 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    Security Fix(es):

    * grub2: net: Out-of-bounds write in grub_net_search_config_file() (CVE-2025-0624)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2666 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.114 and .NET Runtime 8.0.14.Security Fix(es):

    * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method     (CVE-2025-24070)

    Bug Fix(es) and Enhancement(s):

    * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (BZ#2349733)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2489 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302)

    * kernel: can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922)

    * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices     (CVE-2024-53197)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2660 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: Use-After-Free in libxml2 (CVE-2024-56171)

    * libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2 (CVE-2025-24928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:2612 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2512 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302)

    * kernel: can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922)

    * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices     (CVE-2024-53197)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2615 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR8-FP40.

    Security Fix(es):

    * CVE-2025-21502

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2655 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    Security Fix(es):

    * grub2: net: Out-of-bounds write in grub_net_search_config_file() (CVE-2025-0624)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2670 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.114 and .NET Runtime 8.0.14.Security Fix(es):

    * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method     (CVE-2025-24070)

    Bug Fix(es) and Enhancement(s):

    * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (BZ#2349733)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2600 advisory.

    The rsync utility enables the users to copy and synchronize files locally or across a network.
    Synchronization with rsync is fast because rsync only sends the differences in files over the network     instead of sending whole files. The rsync utility is also used as a mirroring tool.

    Security Fix(es):

    * rsync: Path traversal vulnerability in rsync (CVE-2024-12087)

    * rsync: --safe-links option bypass leads to path traversal (CVE-2024-12088)

    * rsync: Race Condition in rsync Handling Symbolic Links (CVE-2024-12747)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2679 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: Use-After-Free in libxml2 (CVE-2024-56171)

    * libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2 (CVE-2025-24928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2528 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302)

    * kernel: can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922)

    * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices     (CVE-2024-53197)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2513 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: Use-After-Free in libxml2 (CVE-2024-56171)

    * libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2 (CVE-2025-24928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2521 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    Security Fix(es):

    * grub2: net: Out-of-bounds write in grub_net_search_config_file() (CVE-2025-0624)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2688 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * jinja2: Jinja sandbox breakout through attr filter selecting format method (CVE-2025-27516)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2456 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.15.47. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2025:2454

    Security Fix(es):

    * podman: buildah: Container breakout by using --jobs=2 and a race     condition when building a malicious Containerfile (CVE-2024-11218)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2653 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    Security Fix(es):

    * grub2: net: Out-of-bounds write in grub_net_search_config_file() (CVE-2025-0624)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2667 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 9.0.104 and .NET Runtime 9.0.3.Security Fix(es):

    * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method     (CVE-2025-24070)

    Bug Fix(es) and Enhancement(s):

    * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (BZ#2349733)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2480 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Use-after-free in WebTransportChild (CVE-2025-1931)

    * firefox: AudioIPC StreamData could trigger a use-after-free in the Browser process (CVE-2025-1930)

    * firefox: Unexpected GC during RegExp bailout processing (CVE-2025-1934)

    * firefox: Clickjacking the registerProtocolHandler info-bar  Reporter (CVE-2025-1935)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and     Thunderbird 128.8 (CVE-2025-1938)

    * firefox: JIT corruption of WASM i32 return values on 64-bit CPUs (CVE-2025-1933)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21,     Firefox ESR 128.8, and Thunderbird 128.8 (CVE-2025-1937)

    * firefox: Inconsistent comparator in XSLT sorting led to out-of-bounds access (CVE-2025-1932)

    * firefox: Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents     (CVE-2025-1936)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2482 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: Use-After-Free in libxml2 (CVE-2024-56171)

    * libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2 (CVE-2025-24928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:2699 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Use-after-free in WebTransportChild (CVE-2025-1931)

    * firefox: AudioIPC StreamData could trigger a use-after-free in the Browser process (CVE-2025-1930)

    * firefox: Unexpected GC during RegExp bailout processing (CVE-2025-1934)

    * firefox: Clickjacking the registerProtocolHandler info-bar  Reporter (CVE-2025-1935)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and     Thunderbird 128.8 (CVE-2025-1938)

    * firefox: JIT corruption of WASM i32 return values on 64-bit CPUs (CVE-2025-1933)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21,     Firefox ESR 128.8, and Thunderbird 128.8 (CVE-2025-1937)

    * firefox: Inconsistent comparator in XSLT sorting led to out-of-bounds access (CVE-2025-1932)

    * firefox: Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents     (CVE-2025-1936)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2686 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: Use-After-Free in libxml2 (CVE-2024-56171)

    * libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2 (CVE-2025-24928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2470 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2471 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * python-tornado: Tornado has HTTP cookie parsing DoS vulnerability (CVE-2024-52804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2488 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302)

    * kernel: can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922)

    * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices     (CVE-2024-53197)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2502 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594)

    * xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601)

    * xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600)

    * xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599)

    * xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598)

    * xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597)

    * xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596)

    * Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2668 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 9.0.104 and .NET Runtime 9.0.3.Security Fix(es):

    * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method     (CVE-2025-24070)

    Bug Fix(es) and Enhancement(s):

    * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (BZ#2349733)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2443 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.74. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2025:2441

    Security Fix(es):

    * podman: buildah: Container breakout by using --jobs=2 and a race     condition when building a malicious Containerfile (CVE-2024-11218)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2500 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594)

    * xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601)

    * xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600)

    * xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599)

    * xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598)

    * xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597)

    * xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596)

    * Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2479 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Use-after-free in WebTransportChild (CVE-2025-1931)

    * firefox: AudioIPC StreamData could trigger a use-after-free in the Browser process (CVE-2025-1930)

    * firefox: Unexpected GC during RegExp bailout processing (CVE-2025-1934)

    * firefox: Clickjacking the registerProtocolHandler info-bar  Reporter (CVE-2025-1935)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and     Thunderbird 128.8 (CVE-2025-1938)

    * firefox: JIT corruption of WASM i32 return values on 64-bit CPUs (CVE-2025-1933)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21,     Firefox ESR 128.8, and Thunderbird 128.8 (CVE-2025-1937)

    * firefox: Inconsistent comparator in XSLT sorting led to out-of-bounds access (CVE-2025-1932)

    * firefox: Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents     (CVE-2025-1936)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2476 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302)

    * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices     (CVE-2024-53197)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2517 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302)

    * kernel: can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922)

    * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices     (CVE-2024-53197)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:2708 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Use-after-free in WebTransportChild (CVE-2025-1931)

    * firefox: AudioIPC StreamData could trigger a use-after-free in the Browser process (CVE-2025-1930)

    * firefox: Unexpected GC during RegExp bailout processing (CVE-2025-1934)

    * firefox: Clickjacking the registerProtocolHandler info-bar  Reporter (CVE-2025-1935)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and     Thunderbird 128.8 (CVE-2025-1938)

    * firefox: JIT corruption of WASM i32 return values on 64-bit CPUs (CVE-2025-1933)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21,     Firefox ESR 128.8, and Thunderbird 128.8 (CVE-2025-1937)

    * firefox: Inconsistent comparator in XSLT sorting led to out-of-bounds access (CVE-2025-1932)

    * firefox: Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents     (CVE-2025-1936)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2669 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.114 and .NET Runtime 8.0.14.Security Fix(es):

    * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method     (CVE-2025-24070)

    Bug Fix(es) and Enhancement(s):

    * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (BZ#2349733)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:2484 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Use-after-free in WebTransportChild (CVE-2025-1931)

    * firefox: AudioIPC StreamData could trigger a use-after-free in the Browser process (CVE-2025-1930)

    * firefox: Unexpected GC during RegExp bailout processing (CVE-2025-1934)

    * firefox: Clickjacking the registerProtocolHandler info-bar  Reporter (CVE-2025-1935)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and     Thunderbird 128.8 (CVE-2025-1938)

    * firefox: JIT corruption of WASM i32 return values on 64-bit CPUs (CVE-2025-1933)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21,     Firefox ESR 128.8, and Thunderbird 128.8 (CVE-2025-1937)

    * firefox: Inconsistent comparator in XSLT sorting led to out-of-bounds access (CVE-2025-1932)

    * firefox: Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents     (CVE-2025-1936)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:2518 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-gateway: Mutation XSS in DOMPurify Due to Improper Template Literal Handling (CVE-2025-26791)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included:

    Automation Platform
    * Fixed an issue that would prevent some types of resources from getting synced if there was a naming     conflict (AAP-41241)
    * Fixed an issue where login would fail for users who were members of a team or organization that had a     naming conflict (AAP-41240)
    * Fixed an issue in the user collection module where running with state: present would cause a stack trace     (AAP-40887)
    * Fixed an issue preventing the controller admin password to get set for the gateway admin account during     upgrades (AAP-40839)
    * Fixed an issue that caused updates to SAML authenticators to ignore an updated public certificate     provided via UI or API and then fail with the message The certificate and private key do not match     (AAP-40767)
    * Allow services to request cloud.redhat.com settings from gateway using ServiceTokenAuth (AAP-39649)
    * Fixed ServiceAuthToken destroy method to allow HTTP delete via ServiceAuth to work properly (AAP-37630)
    * automation-gateway has been updated to 2.5.20250312
    * python3.11-django-ansible-base has been updated to 2.5.20250312

    Automation controller
    * Fixed the indirect host counting name to not record the hostname, but from the query result instead     (AAP-41033)
    * Fixed OpaClient to initialize properly after timeouts and retries (AAP-40997)
    * Added service account credentials for Analytics in controller (AAP-40769)
    * Added a helper method in the API for fetching the service account token from sso.redhat.com (AAP-39637)
    * automation-controller has been updated to 4.6.9

    Event-Driven Ansible
    * Fixed ansible-rulebook support for third party python libraries (AAP-41341)
    * Modified the behavior of the ansible-rulebook and Event-Driven Ansible to help with issues when the     activation correctly started was considered unresponsive and scheduled for restarting (AAP-41070)
    * Added support for editing and copying of rulebook activations in the API (AAP-40254)
    * Rulebook activations' log message field is separated into timestamps and message fields (AAP-39743)
    * Fixed a bug where the activation was incorrectly restarted with the error message Missing container for     running activation (AAP-39545)
    * Event streams now connect to PostgreSQL by using the certificates configured at the installation     (AAP-39294)
    * User is now required to give a user defined name when copying a credential. The new credential name must     be unique (AAP-39079)
    * Enhanced error messages related to Decision Environments (AAP-38941)
    * Decision environment urls are now validated against OCI specification to ensure successful     authentication to the container registry when pulling the image (AAP-38822)
    * ansible-rulebook has been updated to 1.1.3
    * automation-eda-controller has been updated to 1.1.6

    Receptor:
    * Fixed an issue where receptor was creating too many inotify processes, and where the user would     encounter a too many open files error (AAP-22605)
    * receptor has been updated to 1.5.3

    Container-based Ansible Automation Platform
    * Corrected the URL in the postinstall code for automation hub to use the gateway proxy URL (AAP-41306)
    * Deprecated the variables eda_main_url and hub_main_url in favor of the gateway proxy URL (AAP-41306)
    * Receptor mesh connections are now created between all automation controller nodes (AAP-41102)
    * Fixed receptor configuration related to the container group instances type (AAP-40431)
    * Fixed behavior that would hide the errors during EDA status validation (AAP-40021)
    * Ensure the polkit RPM package is installed in order to enable user lingering (AAP-39860)
    * containerized installer setup has been updated to 2.5-11

    RPM-based Ansible Automation Platform
    * Fixed an issue where SELinux relabeling didn't happen when fcontext rules were changed (AAP-40489)
    * Fixed an issue where the credentials for execution environments and decision environments hosted in     automation hub were incorrectly configured (AAP-40419)
    * Fixed an issue where projects failed to sync due to incorrectly configured credentials for ansible     collections hosted in automation hub (AAP-40418)
    * Managed CA will now correctly assign eligible groups during discovery during installation, backup and     restore (AAP-40277)
    * Implemented argument to collect sosreport using the setup script (AAP-40085)
    * EDA Activation logging is now provided via the journald driver (AAP-39745)
    * ansible-automation-platform-installer and installer setup have been updated to 2.5-9

    Additional changes:
    * ansible-creator has been updated to 25.0.0
    * ansible-dev-environment has been updated to 25.1.0
    * ansible-dev-tools has been updated to 25.2.0
    * ansible-lint has been updated to 25.1.2
    * ansible-navigator has been updated to 25.1.0
    * automation-hub has been updated to 4.10.2
    * molecule has been updated to 25.2.0
    * python3.11-ansible-compat has been updated to 25.1.2
    * python3.11-galaxy-importer has been updated to 0.4.28
    * python3.11-galaxy-ng has been updated to 4.10.2
    * python3.11-jsonschema-path has been updated to 0.3.4
    * python3.11-podman has been updated to 5.2.0
    * python3.11-pytest-ansible has been updated to 25.1.0
    * python3.11-referencing has been updated to 0.36.2
    * python3.11-tox-ansible has been updated to 25.1.0
    * python3.11-typing-extensions has been updated to 4.9.0

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2475 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302)

    * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices     (CVE-2024-53197)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2654 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: Use-After-Free in libxml2 (CVE-2024-56171)

    * libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2 (CVE-2025-24928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2510 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302)

    * kernel: can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922)

    * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices     (CVE-2024-53197)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2507 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml: use-after-free in xmlXIncludeAddNode (CVE-2022-49043)

    * libxml2: Use-After-Free in libxml2 (CVE-2024-56171)

    * libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2 (CVE-2025-24928)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2784 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    Security Fix(es):

    * grub2: net: Out-of-bounds write in grub_net_search_config_file() (CVE-2025-0624)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2799 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    Security Fix(es):

    * grub2: net: Out-of-bounds write in grub_net_search_config_file() (CVE-2025-0624)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2524 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302)

    * kernel: can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922)

    * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices     (CVE-2024-53197)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:2486 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Use-after-free in WebTransportChild (CVE-2025-1931)

    * firefox: AudioIPC StreamData could trigger a use-after-free in the Browser process (CVE-2025-1930)

    * firefox: Unexpected GC during RegExp bailout processing (CVE-2025-1934)

    * firefox: Clickjacking the registerProtocolHandler info-bar  Reporter (CVE-2025-1935)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and     Thunderbird 128.8 (CVE-2025-1938)

    * firefox: JIT corruption of WASM i32 return values on 64-bit CPUs (CVE-2025-1933)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21,     Firefox ESR 128.8, and Thunderbird 128.8 (CVE-2025-1937)

    * firefox: Inconsistent comparator in XSLT sorting led to out-of-bounds access (CVE-2025-1932)

    * firefox: Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents     (CVE-2025-1936)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:2722 advisory.

    Kerberos is a network authentication system, which can improve the security of your network by eliminating     the insecure practice of sending passwords over the network in unencrypted form. It allows clients and     servers to authenticate to each other with the help of a trusted third party, the Kerberos key     distribution center (KDC).

    Security Fix:

    * CVE-2025-24528 krb5: overflow when calculating ulog block size

    Bug fix:

    * kdb5_util: fix DB entry flags on modification

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2474 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302)

    * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices     (CVE-2024-53197)

    * kernel: scsi: megaraid_sas: Fix for a potential deadlock (CVE-2024-57807)

    * kernel: pps: Fix a use-after-free (CVE-2024-57979)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2501 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302)

    * kernel: can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922)

    * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices     (CVE-2024-53197)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
232819	RHEL 7 : kernel (RHSA-2025:2514)	medium
232818	RHEL 9 : libxml2 (RHSA-2025:2483)	high
232817	RHEL 9 : kernel (RHSA-2025:2627)	high
232816	RHEL 9 : grub2 (RHSA-2025:2675)	high
232815	RHEL 9 : .NET 8.0 (RHSA-2025:2666)	high
232814	RHEL 8 : kernel (RHSA-2025:2489)	medium
232813	RHEL 8 : libxml2 (RHSA-2025:2660)	high
232812	RHEL 8 : python-jinja2 (RHSA-2025:2612)	medium
232811	RHEL 9 : kernel-rt (RHSA-2025:2512)	medium
232810	RHEL 8 : java-1.8.0-ibm (RHSA-2025:2615)	medium
232809	RHEL 8 : grub2 (RHSA-2025:2655)	high
232808	RHEL 8 : .NET 8.0 (RHSA-2025:2670)	high
232807	RHEL 8 : rsync (RHSA-2025:2600)	medium
232806	RHEL 9 : libxml2 (RHSA-2025:2679)	high
232805	RHEL 8 : kernel (RHSA-2025:2528)	medium
232804	RHEL 8 : libxml2 (RHSA-2025:2513)	high
232803	RHEL 8 : grub2 (RHSA-2025:2521)	high
232802	RHEL 9 : fence-agents (RHSA-2025:2688)	medium
232801	RHEL 8 / 9 : OpenShift Container Platform 4.15.47 (RHSA-2025:2456)	high
232800	RHEL 8 : grub2 (RHSA-2025:2653)	high
232799	RHEL 8 : .NET 9.0 (RHSA-2025:2667)	high
232798	RHEL 9 : firefox (RHSA-2025:2480)	high
232797	RHEL 9 : libxml2 (RHSA-2025:2482)	high
232796	RHEL 7 : firefox (RHSA-2025:2699)	high
232795	RHEL 8 : libxml2 (RHSA-2025:2686)	high
232794	RHEL 9 : pcs (RHSA-2025:2470)	high
232793	RHEL 9 : pcs (RHSA-2025:2471)	high
232792	RHEL 9 : kernel (RHSA-2025:2488)	medium
232791	RHEL 8 : tigervnc (RHSA-2025:2502)	high
232790	RHEL 9 : .NET 9.0 (RHSA-2025:2668)	high
232789	RHEL 8 / 9 : OpenShift Container Platform 4.12.74 (RHSA-2025:2443)	high
232788	RHEL 9 : tigervnc (RHSA-2025:2500)	high
232787	RHEL 9 : firefox (RHSA-2025:2479)	high
232786	RHEL 9 : kernel-rt (RHSA-2025:2476)	medium
232785	RHEL 6 : kernel (RHSA-2025:2517)	medium
232784	RHEL 8 : firefox (RHSA-2025:2708)	high
232783	RHEL 9 : .NET 8.0 (RHSA-2025:2669)	high
232782	RHEL 8 : firefox (RHSA-2025:2484)	high
232781	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Moderate) (RHSA-2025:2518)	medium
232780	RHEL 9 : kernel (RHSA-2025:2475)	medium
232779	RHEL 8 : libxml2 (RHSA-2025:2654)	high
232778	RHEL 7 : kernel-rt (RHSA-2025:2510)	medium
232777	RHEL 8 : libxml2 (RHSA-2025:2507)	high
232776	RHEL 8 : grub2 (RHSA-2025:2784)	high
232775	RHEL 9 : grub2 (RHSA-2025:2799)	high
232774	RHEL 8 : kernel-rt (RHSA-2025:2524)	medium
232773	RHEL 8 : firefox (RHSA-2025:2486)	high
232772	RHEL 8 : krb5 (RHSA-2025:2722)	medium
232771	RHEL 8 : kernel-rt (RHSA-2025:2474)	medium
232770	RHEL 7 : kernel (RHSA-2025:2501)	medium

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

medium

high

high

high

high

medium

high

medium

medium

medium

high

high

medium

high

medium

high

high

medium

high

high

high

high

high

high

high

high

high

medium

high

high

high

high

high

medium

medium

high

high

high

medium

medium

high

medium

high

high

high

medium

high

medium

medium

medium