The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22369 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

    * firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

    * firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

    * firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

    * firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

    * firefox: Race condition in the Graphics component (CVE-2025-13012)

    * firefox: Spoofing issue in Firefox (CVE-2025-13015)

    * firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)

    * firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22205 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22364 advisory.

    X.Org is an open-source implementation of the X Window System. It provides the basic low-level     functionality that full-fledged graphical user interfaces are designed upon.

    Security Fix(es):

    * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)

    * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)

    * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22367 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

    * firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

    * firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

    * firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

    * firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

    * firefox: Race condition in the Graphics component (CVE-2025-13012)

    * firefox: Spoofing issue in Firefox (CVE-2025-13015)

    * firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)

    * firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22363 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

    * firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

    * firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

    * firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

    * firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

    * firefox: Race condition in the Graphics component (CVE-2025-13012)

    * firefox: Spoofing issue in Firefox (CVE-2025-13015)

    * firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)

    * firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22549 advisory.

    Qt 3D provides functionality for near-realtime simulation systems with support for 2D and 3D rendering in     both Qt C++ and Qt Quick applications).

    Security Fix(es):

    * assimp: Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile heap-based overflow     (CVE-2025-11277)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22607 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: internal entity expansion (CVE-2013-0340)

    * expat: integer overflow in the doProlog function (CVE-2022-23990)

    * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22571 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724)

    * kernel: e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898)

    * kernel: wifi: mt76: fix linked list corruption (CVE-2025-39918)

    * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)

    * kernel: i40e: fix idx validation in config queues msg (CVE-2025-39971)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:22255 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.20.6. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2025:22257

    Security Fix(es):

    * golang: archive/tar: Unbounded allocation when parsing GNU sparse map     (CVE-2025-58183)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    All OpenShift Container Platform 4.20 users are advised to upgrade to these     updated packages and images when they are available in the appropriate     release channel. To check for available updates, use the OpenShift CLI (oc)     or web console. Instructions for upgrading a cluster are available at     https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-     single/updating_clusters/index#updating-cluster-cli.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22393 advisory.

    Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt     provides classes for rendering and displaying SVG drawings in widgets and on other paint devices.

    Security Fix(es):

    * qtsvg: Uncontrolled recursion in Qt SVG module (CVE-2025-10728)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22413 advisory.

    Qt 3D provides functionality for near-realtime simulation systems with support for 2D and 3D rendering in     both Qt C++ and Qt Quick applications).

    Security Fix(es):

    * assimp: Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile heap-based overflow     (CVE-2025-11277)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22405 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724)

    * kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864)

    * kernel: e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898)

    * kernel: wifi: mt76: fix linked list corruption (CVE-2025-39918)

    * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955)

    * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)

    * kernel: iommu/vt-d: Disallow dirty tracking if incoherent page walk (CVE-2025-40058)

    * kernel: ice: ice_adapter: release xa entry on adapter allocation failure (CVE-2025-40185)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22394 advisory.

    Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt     provides classes for rendering and displaying SVG drawings in widgets and on other paint devices.

    Security Fix(es):

    * qtsvg: Uncontrolled recursion in Qt SVG module (CVE-2025-10728)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:22398 advisory.

    The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based     applications.

    Security Fix(es):

    * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22417 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability     (CVE-2025-10922)

    * gimp: GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVE-2025-10920)

    * gimp: GIMP WBMP File Parsing Integer Overflow Remote Code Execution Vulnerability (CVE-2025-10923)

    * gimp: GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability     (CVE-2025-10921)

    * gimp: GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability     (CVE-2025-10925)

    * gimp: GIMP FF File Parsing Integer Overflow Remote Code Execution Vulnerability (CVE-2025-10924)

    * gimp: GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability     (CVE-2025-10934)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22395 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ublk: make sure ubq->canceling is set when queue is frozen (CVE-2025-22068)

    * kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724)

    * kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CVE-2025-39883)

    * kernel: e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898)

    * kernel: wifi: mt76: fix linked list corruption (CVE-2025-39918)

    * kernel: i40e: fix idx validation in config queues msg (CVE-2025-39971)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22414 advisory.

    Qt 3D provides functionality for near-realtime simulation systems with support for 2D and 3D rendering in     both Qt C++ and Qt Quick applications).

    Security Fix(es):

    * assimp: Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile heap-based overflow     (CVE-2025-11277)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22497 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability     (CVE-2025-10922)

    * gimp: GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability     (CVE-2025-10934)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22449 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

    * firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

    * firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

    * firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

    * firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

    * firefox: Race condition in the Graphics component (CVE-2025-13012)

    * firefox: Spoofing issue in Firefox (CVE-2025-13015)

    * firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)

    * firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22445 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability     (CVE-2025-10922)

    * gimp: GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability     (CVE-2025-10934)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22451 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

    * firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

    * firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

    * firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

    * firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

    * firefox: Race condition in the Graphics component (CVE-2025-13012)

    * firefox: Spoofing issue in Firefox (CVE-2025-13015)

    * firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)

    * firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22496 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability     (CVE-2025-10922)

    * gimp: GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability     (CVE-2025-10934)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22427 advisory.

    X.Org is an open-source implementation of the X Window System. It provides the basic low-level     functionality that full-fledged graphical user interfaces are designed upon.

    Security Fix(es):

    * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)

    * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)

    * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22426 advisory.

    X.Org is an open-source implementation of the X Window System. It provides the basic low-level     functionality that full-fledged graphical user interfaces are designed upon.

    Security Fix(es):

    * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)

    * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)

    * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22498 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability     (CVE-2025-10922)

    * gimp: GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability     (CVE-2025-10934)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:22422 advisory.

    The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based     applications.

    Security Fix(es):

    * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22450 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

    * firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

    * firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

    * firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

    * firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

    * firefox: Race condition in the Graphics component (CVE-2025-13012)

    * firefox: Spoofing issue in Firefox (CVE-2025-13015)

    * firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)

    * firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:22399 advisory.

    The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based     applications.

    Security Fix(es):

    * haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22164 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)

    * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)

    * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22124 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)

    * kernel: smb: client: fix potential UAF in cifs_stats_proc_write() (CVE-2024-35868)

    * kernel: ethtool: check device is present when getting link settings (CVE-2024-46679)

    * kernel: ALSA: usb-audio: Validate UAC3 power domain descriptors, too (CVE-2025-38729)

    * kernel: ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)

    * kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)

    * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)

    * kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300)

    * kernel: wifi: mac80211: check S1G action frame size (CVE-2023-53257)

    * kernel: Bluetooth: L2CAP: fix bad unlock balance in l2cap_disconnect_rsp (CVE-2023-53297)

    * kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)

    * kernel: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    * kernel: Bluetooth: L2CAP: Fix user-after-free (CVE-2022-50386)

    * kernel: nbd: fix incomplete validation of ioctl arg (CVE-2023-53513)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22072 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ALSA: usb-audio: Validate UAC3 power domain descriptors, too (CVE-2025-38729)

    * kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718)

    * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)

    * kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300)

    * kernel: Bluetooth: L2CAP: fix bad unlock balance in l2cap_disconnect_rsp (CVE-2023-53297)

    * kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)

    * kernel: cifs: fix oops during encryption (CVE-2022-50341)

    * kernel: scsi: qla2xxx: Wait for io return on terminate rport (CVE-2023-53322)

    * kernel: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    * kernel: skbuff: skb_segment, Call zero copy functions before using skbuff frags (CVE-2023-53354)

    * kernel: Bluetooth: Fix potential use-after-free when clear keys (CVE-2023-53386)

    * kernel: ext4: fix undefined behavior in bit shift for ext4_check_flag_values (CVE-2022-50403)

    * kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CVE-2025-39883)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22096 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)

    * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)

    * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22087 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: ALSA: usb-audio: Validate UAC3 power domain descriptors, too (CVE-2025-38729)

    * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)

    * kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300)

    * kernel: Bluetooth: L2CAP: fix bad unlock balance in l2cap_disconnect_rsp (CVE-2023-53297)

    * kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)

    * kernel: cifs: fix oops during encryption (CVE-2022-50341)

    * kernel: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    * kernel: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device (CVE-2023-53393)

    * kernel: ext4: fix undefined behavior in bit shift for ext4_check_flag_values (CVE-2022-50403)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22095 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)

    * kernel: smb: client: fix potential UAF in cifs_stats_proc_write() (CVE-2024-35868)

    * kernel: ethtool: check device is present when getting link settings (CVE-2024-46679)

    * kernel: ALSA: usb-audio: Validate UAC3 power domain descriptors, too (CVE-2025-38729)

    * kernel: ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702)

    * kernel: NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CVE-2025-39730)

    * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)

    * kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300)

    * kernel: wifi: mac80211: check S1G action frame size (CVE-2023-53257)

    * kernel: Bluetooth: L2CAP: fix bad unlock balance in l2cap_disconnect_rsp (CVE-2023-53297)

    * kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)

    * kernel: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    * kernel: Bluetooth: L2CAP: Fix user-after-free (CVE-2022-50386)

    * kernel: nbd: fix incomplete validation of ioctl arg (CVE-2023-53513)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22063 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar     operating systems.

    Security Fix(es):

    * cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS (CVE-2025-58364)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22077 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)

    * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)

    * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22041 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)

    * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)

    * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22034 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22051 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)

    * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)

    * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22012 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

    * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22066 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: ALSA: usb-audio: Validate UAC3 power domain descriptors, too (CVE-2025-38729)

    * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)

    * kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300)

    * kernel: Bluetooth: L2CAP: fix bad unlock balance in l2cap_disconnect_rsp (CVE-2023-53297)

    * kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817)

    * kernel: cifs: fix oops during encryption (CVE-2022-50341)

    * kernel: ip6mr: Fix skb_under_panic in ip6mr_cache_report() (CVE-2023-53365)

    * kernel: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device (CVE-2023-53393)

    * kernel: ext4: fix undefined behavior in bit shift for ext4_check_flag_values (CVE-2022-50403)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22056 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)

    * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)

    * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22035 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: internal entity expansion (CVE-2013-0340)

    * expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)

    * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22055 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)

    * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)

    * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22030 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

    * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22011 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

    * golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:22040 advisory.

    X.Org is an open-source implementation of the X Window System. It provides the basic low-level     functionality that full-fledged graphical user interfaces are designed upon.

    Security Fix(es):

    * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)

    * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)

    * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22019 advisory.

    Pluggable Authentication Modules (PAM) provide a system to set up authentication policies without the need     to recompile programs to handle authentication.

    Security Fix(es):

    * linux-pam: Linux-pam directory Traversal (CVE-2025-6020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22033 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22005 advisory.

    This package provides build-stage rpm automation to simplify the creation of Go language (golang)     packages.  It does not need to be included in the default build root: go-srpm-macros will pull it in for     Go packages only.

    Security Fix(es):

    * os/exec: Unexpected paths returned from LookPath in os/exec (CVE-2025-47906)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
277203	RHEL 8 : firefox (RHSA-2025:22369)	high
277202	RHEL 7 : bind (RHSA-2025:22205)	high
277201	RHEL 9 : xorg-x11-server (RHSA-2025:22364)	high
277200	RHEL 8 : firefox (RHSA-2025:22367)	high
277199	RHEL 8 : firefox (RHSA-2025:22363)	high
277138	RHEL 9 : qt5-qt3d (RHSA-2025:22549)	medium
277137	RHEL 8 : expat (RHSA-2025:22607)	high
277127	RHEL 10 : kernel (RHSA-2025:22571)	high
277126	RHEL 9 : OpenShift Container Platform 4.20.6 (RHSA-2025:22255)	medium
277067	RHEL 10 : qt6-qtsvg (RHSA-2025:22393)	critical
277066	RHEL 9 : qt5-qt3d (RHSA-2025:22413)	medium
277065	RHEL 9 : kernel (RHSA-2025:22405)	high
277064	RHEL 10 : qt6-qtsvg (RHSA-2025:22394)	critical
277063	RHEL 9 : haproxy (RHSA-2025:22398)	high
277062	RHEL 8 : gimp:2.8 (RHSA-2025:22417)	high
277061	RHEL 10 : kernel (RHSA-2025:22395)	high
277060	RHEL 9 : qt5-qt3d (RHSA-2025:22414)	medium
277047	RHEL 9 : gimp (RHSA-2025:22497)	high
277044	RHEL 9 : thunderbird (RHSA-2025:22449)	high
276995	RHEL 9 : gimp (RHSA-2025:22445)	high
276994	RHEL 9 : thunderbird (RHSA-2025:22451)	high
276993	RHEL 9 : gimp (RHSA-2025:22496)	high
276950	RHEL 8 : xorg-x11-server (RHSA-2025:22427)	high
276949	RHEL 8 : xorg-x11-server (RHSA-2025:22426)	high
276948	RHEL 9 : gimp (RHSA-2025:22498)	high
276947	RHEL 9 : haproxy (RHSA-2025:22422)	high
276946	RHEL 9 : thunderbird (RHSA-2025:22450)	high
276934	RHEL 9 : haproxy (RHSA-2025:22399)	high
276900	RHEL 8 : tigervnc (RHSA-2025:22164)	high
276880	RHEL 9 : kernel-rt (RHSA-2025:22124)	high
276781	RHEL 8 : kernel (RHSA-2025:22072)	high
276780	RHEL 7 : tigervnc (RHSA-2025:22096)	high
276779	RHEL 9 : kernel-rt (RHSA-2025:22087)	high
276778	RHEL 9 : kernel (RHSA-2025:22095)	high
276777	RHEL 8 : cups (RHSA-2025:22063)	medium
276776	RHEL 8 : tigervnc (RHSA-2025:22077)	high
276727	RHEL 8 : tigervnc (RHSA-2025:22041)	high
276726	RHEL 9 : expat (RHSA-2025:22034)	high
276725	RHEL 9 : tigervnc (RHSA-2025:22051)	high
276724	RHEL 10 : buildah (RHSA-2025:22012)	high
276723	RHEL 9 : kernel (RHSA-2025:22066)	high
276722	RHEL 9 : tigervnc (RHSA-2025:22056)	high
276721	RHEL 9 : expat (RHSA-2025:22035)	high
276720	RHEL 9 : tigervnc (RHSA-2025:22055)	high
276719	RHEL 9 : podman (RHSA-2025:22030)	high
276718	RHEL 9 : buildah (RHSA-2025:22011)	high
276717	RHEL 7 : xorg-x11-server (RHSA-2025:22040)	high
276716	RHEL 10 : pam (RHSA-2025:22019)	high
276715	RHEL 9 : expat (RHSA-2025:22033)	high
276688	RHEL 9 : go-rpm-macros (RHSA-2025:22005)	medium

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

high

high

high

high

medium

high

high

medium

critical

medium

high

critical

high

high

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium