The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0972 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.8.0 ESR.

    Security Fix(es):

    * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546)

    * Mozilla: Alert dialog could have been spoofed on another site (CVE-2024-1547)

    * Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8     (CVE-2024-1553)

    * Mozilla: Fullscreen Notification could have been hidden by select element (CVE-2024-1548)

    * Mozilla: Custom cursor could obscure the permission dialog (CVE-2024-1549)

    * Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants     (CVE-2024-1550)

    * Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts (CVE-2024-1551)

    * Mozilla: Incorrect code generation on 32-bit ARM devices (CVE-2024-1552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0970 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.8.0 ESR.

    Security Fix(es):

    * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546)

    * Mozilla: Alert dialog could have been spoofed on another site (CVE-2024-1547)

    * Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8     (CVE-2024-1553)

    * Mozilla: Fullscreen Notification could have been hidden by select element (CVE-2024-1548)

    * Mozilla: Custom cursor could obscure the permission dialog (CVE-2024-1549)

    * Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants     (CVE-2024-1550)

    * Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts (CVE-2024-1551)

    * Mozilla: Incorrect code generation on 32-bit ARM devices (CVE-2024-1552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0963 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.8.0.

    Security Fix(es):

    * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546)

    * Mozilla: Alert dialog could have been spoofed on another site (CVE-2024-1547)

    * Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8     (CVE-2024-1553)

    * Mozilla: Fullscreen Notification could have been hidden by select element (CVE-2024-1548)

    * Mozilla: Custom cursor could obscure the permission dialog (CVE-2024-1549)

    * Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants     (CVE-2024-1550)

    * Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts (CVE-2024-1551)

    * Mozilla: Incorrect code generation on 32-bit ARM devices (CVE-2024-1552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0955 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.8.0 ESR.

    Security Fix(es):

    * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546)

    * Mozilla: Alert dialog could have been spoofed on another site (CVE-2024-1547)

    * Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8     (CVE-2024-1553)

    * Mozilla: Fullscreen Notification could have been hidden by select element (CVE-2024-1548)

    * Mozilla: Custom cursor could obscure the permission dialog (CVE-2024-1549)

    * Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants     (CVE-2024-1550)

    * Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts (CVE-2024-1551)

    * Mozilla: Incorrect code generation on 32-bit ARM devices (CVE-2024-1552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0967 advisory.

    The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on     cards that support cryptographic operations and enables their use for authentication, mail encryption, or     digital signatures.

    Security Fix(es):

    * OpenSC: Side-channel leaks while stripping encryption PKCS#1 padding (CVE-2023-5992)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0962 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.8.0.

    Security Fix(es):

    * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546)

    * Mozilla: Alert dialog could have been spoofed on another site (CVE-2024-1547)

    * Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8     (CVE-2024-1553)

    * Mozilla: Fullscreen Notification could have been hidden by select element (CVE-2024-1548)

    * Mozilla: Custom cursor could obscure the permission dialog (CVE-2024-1549)

    * Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants     (CVE-2024-1550)

    * Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts (CVE-2024-1551)

    * Mozilla: Incorrect code generation on 32-bit ARM devices (CVE-2024-1552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0961 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.8.0.

    Security Fix(es):

    * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546)

    * Mozilla: Alert dialog could have been spoofed on another site (CVE-2024-1547)

    * Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8     (CVE-2024-1553)

    * Mozilla: Fullscreen Notification could have been hidden by select element (CVE-2024-1548)

    * Mozilla: Custom cursor could obscure the permission dialog (CVE-2024-1549)

    * Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants     (CVE-2024-1550)

    * Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts (CVE-2024-1551)

    * Mozilla: Incorrect code generation on 32-bit ARM devices (CVE-2024-1552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0958 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.8.0.

    Security Fix(es):

    * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546)

    * Mozilla: Alert dialog could have been spoofed on another site (CVE-2024-1547)

    * Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8     (CVE-2024-1553)

    * Mozilla: Fullscreen Notification could have been hidden by select element (CVE-2024-1548)

    * Mozilla: Custom cursor could obscure the permission dialog (CVE-2024-1549)

    * Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants     (CVE-2024-1550)

    * Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts (CVE-2024-1551)

    * Mozilla: Incorrect code generation on 32-bit ARM devices (CVE-2024-1552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0956 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0959 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.8.0.

    Security Fix(es):

    * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546)

    * Mozilla: Alert dialog could have been spoofed on another site (CVE-2024-1547)

    * Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8     (CVE-2024-1553)

    * Mozilla: Fullscreen Notification could have been hidden by select element (CVE-2024-1548)

    * Mozilla: Custom cursor could obscure the permission dialog (CVE-2024-1549)

    * Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants     (CVE-2024-1550)

    * Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts (CVE-2024-1551)

    * Mozilla: Incorrect code generation on 32-bit ARM devices (CVE-2024-1552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0960 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.8.0.

    Security Fix(es):

    * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546)

    * Mozilla: Alert dialog could have been spoofed on another site (CVE-2024-1547)

    * Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8     (CVE-2024-1553)

    * Mozilla: Fullscreen Notification could have been hidden by select element (CVE-2024-1548)

    * Mozilla: Custom cursor could obscure the permission dialog (CVE-2024-1549)

    * Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants     (CVE-2024-1550)

    * Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts (CVE-2024-1551)

    * Mozilla: Incorrect code generation on 32-bit ARM devices (CVE-2024-1552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0964 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.8.0.

    Security Fix(es):

    * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546)

    * Mozilla: Alert dialog could have been spoofed on another site (CVE-2024-1547)

    * Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8     (CVE-2024-1553)

    * Mozilla: Fullscreen Notification could have been hidden by select element (CVE-2024-1548)

    * Mozilla: Custom cursor could obscure the permission dialog (CVE-2024-1549)

    * Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants     (CVE-2024-1550)

    * Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts (CVE-2024-1551)

    * Mozilla: Incorrect code generation on 32-bit ARM devices (CVE-2024-1552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0969 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.8.0 ESR.

    Security Fix(es):

    * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546)

    * Mozilla: Alert dialog could have been spoofed on another site (CVE-2024-1547)

    * Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8     (CVE-2024-1553)

    * Mozilla: Fullscreen Notification could have been hidden by select element (CVE-2024-1548)

    * Mozilla: Custom cursor could obscure the permission dialog (CVE-2024-1549)

    * Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants     (CVE-2024-1550)

    * Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts (CVE-2024-1551)

    * Mozilla: Incorrect code generation on 32-bit ARM devices (CVE-2024-1552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0968 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.8.0 ESR.

    Security Fix(es):

    * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546)

    * Mozilla: Alert dialog could have been spoofed on another site (CVE-2024-1547)

    * Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8     (CVE-2024-1553)

    * Mozilla: Fullscreen Notification could have been hidden by select element (CVE-2024-1548)

    * Mozilla: Custom cursor could obscure the permission dialog (CVE-2024-1549)

    * Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants     (CVE-2024-1550)

    * Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts (CVE-2024-1551)

    * Mozilla: Incorrect code generation on 32-bit ARM devices (CVE-2024-1552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0965 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387)

    * bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0937 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0950 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0951 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0952 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.8.0 ESR.

    Security Fix(es):

    * Mozilla: Out-of-bounds memory read in networking channels (CVE-2024-1546)

    * Mozilla: Alert dialog could have been spoofed on another site (CVE-2024-1547)

    * Mozilla: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8     (CVE-2024-1553)

    * Mozilla: Fullscreen Notification could have been hidden by select element (CVE-2024-1548)

    * Mozilla: Custom cursor could obscure the permission dialog (CVE-2024-1549)

    * Mozilla: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants     (CVE-2024-1550)

    * Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts (CVE-2024-1551)

    * Mozilla: Incorrect code generation on 32-bit ARM devices (CVE-2024-1552)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0934 advisory.

    Security fixes:
     * ovirt: authentication bypass (CVE-2024-0822)

    Bug fixes:
     * During the storage domain import, the engine will fail to find OVF_STORE if there is also a     ConnectStoragePoolVDSCommand request (BZ#2244641)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0930 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)

    * kernel: malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655)

    * kernel: KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks     (CVE-2022-2196)

    * kernel: media: em28xx: initialize refcount before kref_get (CVE-2022-3239)

    * kernel: use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625)

    * kernel: net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

    * hw: cpu: arm64: Spectre-BHB (CVE-2022-23960)

    * kernel: use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

    * kernel: vmwgfx: integer overflow in vmwgfx_execbuf.c (CVE-2022-36402)

    * kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

    * kernel: vmwgfx: use-after-free in vmw_cmd_res_check (CVE-2022-38457)

    * kernel: vmwgfx: use-after-free in vmw_execbuf_tie_context (CVE-2022-40133)

    * kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074)

    * kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size     (CVE-2023-6931)

    * kernel: KVM: nVMX: missing consistency checks for CR0 and CR4 (CVE-2023-30456)

    * kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084)

    * kernel: use-after-free in amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c     (CVE-2023-51042)

    * kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0887 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests     (CVE-2023-39326)

    * golang: cmd/go: Protocol Fallback when fetching modules (CVE-2023-45285)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0888 advisory.

    EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package     contains a sample 64-bit UEFI firmware for QEMU and KVM.

    Security Fix(es):

    * openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0881 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073)

    * kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() (CVE-2023-1838)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller     than its child's sibling_list (CVE-2023-5717)

    * kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356)

    * kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535)

    * kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536)

    * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)

    * kernel: OOB Access in smb2_dump_detail (CVE-2023-6610)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0893 advisory.

    The python-pillow packages contain a Python image processing library that provides extensive file format     support, an efficient internal representation, and powerful image-processing capabilities.

    Security Fix(es):

    * pillow: Arbitrary Code Execution via the environment parameter (CVE-2023-50447)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0897 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073)

    * kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() (CVE-2023-1838)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller     than its child's sibling_list (CVE-2023-5717)

    * kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356)

    * kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535)

    * kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536)

    * kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)

    * kernel: OOB Access in smb2_dump_detail (CVE-2023-6610)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0889 advisory.

    Oniguruma is a regular expressions library that supports a variety of character encodings.

    Security Fix(es):

    * oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

    * oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

    * oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read     (CVE-2019-19012)

    * oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c     (CVE-2019-19203)

    * oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c     (CVE-2019-19204)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0894 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld)     and many client programs and libraries.

    Security Fix(es):

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2023) (CVE-2023-21911)

    * mysql: Server: DDL unspecified vulnerability (CPU Apr 2023) (CVE-2023-21919, CVE-2023-21929,     CVE-2023-21933)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) (CVE-2023-21920, CVE-2023-21935,     CVE-2023-21945, CVE-2023-21946, CVE-2023-21976, CVE-2023-21977, CVE-2023-21982)

    * mysql: Server: Components Services unspecified vulnerability (CPU Apr 2023) (CVE-2023-21940,     CVE-2023-21947, CVE-2023-21962)

    * mysql: Server: Partition unspecified vulnerability (CPU Apr 2023) (CVE-2023-21953, CVE-2023-21955)

    * mysql: Server: JSON unspecified vulnerability (CPU Apr 2023) (CVE-2023-21966)

    * mysql: Server: DML unspecified vulnerability (CPU Apr 2023) (CVE-2023-21972)

    * mysql: Client programs unspecified vulnerability (CPU Apr 2023) (CVE-2023-21980)

    * mysql: Server: Replication unspecified vulnerability (CPU Jul 2023) (CVE-2023-22005, CVE-2023-22007,     CVE-2023-22057)

    * mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22008)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023) (CVE-2023-22032, CVE-2023-22059,     CVE-2023-22064, CVE-2023-22065, CVE-2023-22070, CVE-2023-22078, CVE-2023-22079, CVE-2023-22092,     CVE-2023-22103, CVE-2023-22110, CVE-2023-22112)

    * mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22033)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2023) (CVE-2023-22046, CVE-2023-22054,     CVE-2023-22056)

    * mysql: Client programs unspecified vulnerability (CPU Jul 2023) (CVE-2023-22053)

    * mysql: Server: DDL unspecified vulnerability (CPU Jul 2023) (CVE-2023-22058)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2023) (CVE-2023-22066, CVE-2023-22068, CVE-2023-22084,     CVE-2023-22097, CVE-2023-22104, CVE-2023-22114)

    * mysql: Server: UDF unspecified vulnerability (CPU Oct 2023) (CVE-2023-22111)

    * mysql: Server: DML unspecified vulnerability (CPU Oct 2023) (CVE-2023-22115)

    * mysql: Server: RAPID unspecified vulnerability (CPU Jan 2024) (CVE-2024-20960)

    * mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2024) (CVE-2024-20963)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jan 2024) (CVE-2024-20964)

    * mysql: Server: Replication unspecified vulnerability (CPU Jan 2024) (CVE-2024-20967)

    * mysql: Server: Options unspecified vulnerability (CPU Jan 2024) (CVE-2024-20968)

    * mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20969)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2024) (CVE-2024-20961, CVE-2024-20962,     CVE-2024-20965, CVE-2024-20966, CVE-2024-20970, CVE-2024-20971, CVE-2024-20972, CVE-2024-20973,     CVE-2024-20974, CVE-2024-20976, CVE-2024-20977, CVE-2024-20978, CVE-2024-20982)

    * mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20981)

    * mysql: Server: DML unspecified vulnerability (CPU Jan 2024) (CVE-2024-20983)

    * mysql: Server : Security : Firewall unspecified vulnerability (CPU Jan 2024) (CVE-2024-20984)

    * mysql: Server: UDF unspecified vulnerability (CPU Jan 2024) (CVE-2024-20985)

    * zstd: mysql: buffer overrun in util.c (CVE-2022-4899)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2023) (CVE-2023-22038)

    * mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2023) (CVE-2023-22048)

    * mysql: Server: Security: Encryption unspecified vulnerability (CPU Oct 2023) (CVE-2023-22113)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Fix for MySQL bug #33630199 in 8.0.32 introduces regression when --set-gtid-purged=OFF (RHEL-22452)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0876 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0862 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: PSD buffer overflow RCE (CVE-2023-44442)

    * gimp: psp off-by-one RCE (CVE-2023-44444)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0866 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR8-FP15.

    Security Fix(es):

    * IBM JDK: Eclipse OpenJ9 JVM denial of service (CVE-2023-5676)

    * OpenJDK: IOR deserialization issue in CORBA (8303384) (CVE-2023-22067)

    * OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0863 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: PSD buffer overflow RCE (CVE-2023-44442)

    * gimp: psp off-by-one RCE (CVE-2023-44444)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0861 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: PSD buffer overflow RCE (CVE-2023-44442)

    * gimp: psp off-by-one RCE (CVE-2023-44444)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0850 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0851 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as     destination (CVE-2024-0646)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0848 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.102 and .NET Runtime 8.0.2.

    Security Fix(es):

    * dotnet: Denial of Service in SignalR server (CVE-2024-21386)

    * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0827 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.102 and .NET Runtime 8.0.2.

    Security Fix(es):

    * dotnet: Denial of Service in SignalR server (CVE-2024-21386)

    * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0811 advisory.

    The sudo packages contain the sudo utility which allows system     administrators to provide certain users with the permission to execute     privileged commands, which are used for system management purposes, without     having to log in as root.

    Bug Fix(es) and Enhancement(s):

    * CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output
    * CVE-2023-28486 sudo: Sudo does not escape control characters in log messages
    * CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0814 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.127 and .NET Runtime 6.0.27.

    The following packages have been upgraded to a later upstream version: rh-dotnet60-dotnet (6.0.127).
    (BZ#2262321)

    Security Fix(es):

    * dotnet: Denial of Service in SignalR server (CVE-2024-21386)

    * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0799 advisory.

    Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.6.7 on RHEL 8 serves as a replacement for Red Hat Single Sign-On     7.6.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):
    * redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts     (CVE-2023-6291)
    * guava: insecure temporary directory creation (CVE-2023-2976)
    * jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()     (CVE-2023-26048)
    * jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies (CVE-2023-26049)
    * reflected XSS via wildcard in OIDC redirect_uri (CVE-2023-6134)
    * open redirect via form_post.jwt JARM response mode (CVE-2023-6927)
    * santuario: Private Key disclosure in debug-log output (CVE-2023-44483)
    * Log Injection during WebAuthn authentication or registration (CVE-2023-6484)3-44483)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0806 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.116 and .NET Runtime 7.0.16.

    Security Fix(es):

    * dotnet: Denial of Service in SignalR server (CVE-2024-21386)

    * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0798 advisory.

    Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.6.7 on RHEL 7 serves as a replacement for Red Hat Single Sign-On     7.6.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):
    * redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts     (CVE-2023-6291)
    * guava: insecure temporary directory creation (CVE-2023-2976)
    * jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()     (CVE-2023-26048)
    * jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies (CVE-2023-26049)
    * reflected XSS via wildcard in OIDC redirect_uri (CVE-2023-6134)
    * open redirect via form_post.jwt JARM response mode (CVE-2023-6927)
    * santuario: Private Key disclosure in debug-log output (CVE-2023-44483)
    * Log Injection during WebAuthn authentication or registration (CVE-2023-6484)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0808 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.127 and .NET Runtime 6.0.27.

    Security Fix(es):

    * dotnet: Denial of Service in SignalR server (CVE-2024-21386)

    * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0807 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.127 and .NET Runtime 6.0.27.

    Security Fix(es):

    * dotnet: Denial of Service in SignalR server (CVE-2024-21386)

    * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0800 advisory.

    Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.6.7 on RHEL 9 serves as a replacement for Red Hat Single Sign-On     7.6.6, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):
    * redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts     (CVE-2023-6291)
    * guava: insecure temporary directory creation (CVE-2023-2976)
    * jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()     (CVE-2023-26048)
    * jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies (CVE-2023-26049)
    * reflected XSS via wildcard in OIDC redirect_uri (CVE-2023-6134)
    * open redirect via form_post.jwt JARM response mode (CVE-2023-6927)
    * santuario: Private Key disclosure in debug-log output (CVE-2023-44483)
    * Log Injection during WebAuthn authentication or registration (CVE-2023-6484)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0805 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.116 and .NET Runtime 7.0.16.

    Security Fix(es):

    * dotnet: Denial of Service in SignalR server (CVE-2024-21386)

    * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0796 advisory.

    The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements     cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

    Security Fix(es):

    * gnutls: incomplete fix for CVE-2023-5981 (CVE-2024-0553)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0790 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Security Fix(es):

    * nss: vulnerable to Minerva side-channel information leak (CVE-2023-6135)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0791 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Security Fix(es):

    * nss: vulnerable to Minerva side-channel information leak (CVE-2023-6135)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0786 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Security Fix(es):

    * nss: vulnerable to Minerva side-channel information leak (CVE-2023-6135)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
190985	RHEL 8 : firefox (RHSA-2024:0972)	high
190984	RHEL 8 : firefox (RHSA-2024:0970)	high
190983	RHEL 9 : thunderbird (RHSA-2024:0963)	high
190982	RHEL 8 : firefox (RHSA-2024:0955)	high
190981	RHEL 8 : opensc (RHSA-2024:0967)	medium
190980	RHEL 9 : thunderbird (RHSA-2024:0962)	high
190979	RHEL 8 : thunderbird (RHSA-2024:0961)	high
190978	RHEL 8 : thunderbird (RHSA-2024:0958)	high
190977	RHEL 8 : postgresql:10 (RHSA-2024:0956)	high
190976	RHEL 8 : thunderbird (RHSA-2024:0959)	high
190975	RHEL 8 : thunderbird (RHSA-2024:0960)	high
190974	RHEL 8 : thunderbird (RHSA-2024:0964)	high
190973	RHEL 8 : firefox (RHSA-2024:0969)	high
190972	RHEL 9 : firefox (RHSA-2024:0968)	high
190971	RHEL 8 : unbound (RHSA-2024:0965)	high
190928	RHEL 8 : kpatch-patch (RHSA-2024:0937)	high
190908	RHEL 9 : postgresql:15 (RHSA-2024:0950)	high
190907	RHEL 9 : postgresql (RHSA-2024:0951)	high
190906	RHEL 9 : firefox (RHSA-2024:0952)	high
190869	RHEL 8 : Red Hat Virtualization (RHSA-2024:0934)	high
190828	RHEL 8 : kernel (RHSA-2024:0930)	high
190773	RHEL 8 : go-toolset:rhel8 (RHSA-2024:0887)	high
190772	RHEL 8 : edk2 (RHSA-2024:0888)	critical
190771	RHEL 8 : kernel-rt (RHSA-2024:0881)	high
190770	RHEL 8 : python-pillow (RHSA-2024:0893)	high
190769	RHEL 8 : kernel (RHSA-2024:0897)	high
190768	RHEL 8 : oniguruma (RHSA-2024:0889)	critical
190767	RHEL 8 : mysql:8.0 (RHSA-2024:0894)	high
190750	RHEL 8 : kpatch-patch (RHSA-2024:0876)	high
190719	RHEL 8 : gimp:2.8 (RHSA-2024:0862)	high
190718	RHEL 8 : java-1.8.0-ibm (RHSA-2024:0866)	medium
190717	RHEL 8 : gimp:2.8 (RHSA-2024:0863)	high
190716	RHEL 8 : gimp:2.8 (RHSA-2024:0861)	high
190597	RHEL 9 : kpatch-patch (RHSA-2024:0850)	high
190596	RHEL 8 : kpatch-patch (RHSA-2024:0851)	high
190595	RHEL 9 : .NET 8.0 (RHSA-2024:0848)	high
190561	RHEL 8 : .NET 8.0 (RHSA-2024:0827)	high
190517	RHEL 8 / 9 : sudo (RHSA-2024:0811)	high
190516	RHEL 7 : .NET 6.0 (RHSA-2024:0814)	high
190501	RHEL 8 : Red Hat Single Sign-On 7.6.7 security update on RHEL 8 (Important) (RHSA-2024:0799)	high
190500	RHEL 8 : dotnet7.0 (RHSA-2024:0806)	critical
190499	RHEL 7 : Red Hat Single Sign-On 7.6.7 security update on RHEL 7 (Important) (RHSA-2024:0798)	high
190498	RHEL 8 : dotnet6.0 (RHSA-2024:0808)	high
190497	RHEL 9 : dotnet6.0 (RHSA-2024:0807)	high
190496	RHEL 9 : Red Hat Single Sign-On 7.6.7 security update on RHEL 9 (Important) (RHSA-2024:0800)	high
190495	RHEL 9 : dotnet7.0 (RHSA-2024:0805)	critical
190464	RHEL 8 : gnutls (RHSA-2024:0796)	high
190418	RHEL 9 : nss (RHSA-2024:0790)	medium
190417	RHEL 9 : nss (RHSA-2024:0791)	medium
190409	RHEL 8 : nss (RHSA-2024:0786)	medium

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

high

high

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

critical

high

high

high

medium

high

high

high

high

high

high

high

high

high

critical

high

high

high

high

critical

high

medium

medium

medium