The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7389 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7433 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

    * SQLite: integer overflow in SQLite (CVE-2025-3277)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7417 advisory.

    The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a     large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and     anti-aliasing, and conversions, all with multi-level undo.

    Security Fix(es):

    * gimp: dds buffer overflow RCE (CVE-2023-44441)

    * gimp: PSD buffer overflow RCE (CVE-2023-44442)

    * gimp: psp integer overflow RCE (CVE-2023-44443)

    * gimp: psp off-by-one RCE (CVE-2023-44444)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7422 advisory.

    The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript     translates PostScript code to common bitmap formats so that the code can be displayed or printed.

    Security Fix(es):

    * ghostscript: dangling pointer in gdev_prn_open_printer_seekable() (CVE-2023-46751)

    * ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling (CVE-2024-46952)

    * ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space (CVE-2024-46951)

    * ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding (CVE-2024-46954)

    * ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript (CVE-2024-46953)

    * ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution (CVE-2024-46956)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7426 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * c-ares: c-ares has a use-after-free in read_answers() (CVE-2025-31498)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:6990 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    Security Fix(es):

    * grub2: reader/jpeg: Heap OOB Write during JPEG parsing (CVE-2024-45774)

    * grub2: commands/extcmd: Missing check for failed allocation (CVE-2024-45775)

    * grub2: grub-core/gettext: Integer overflow leads to Heap OOB Write and Read. (CVE-2024-45776)

    * grub2: fs/ufs: OOB write in the heap (CVE-2024-45781)

    * grub2: fs/hfs+: refcount can be decremented twice (CVE-2024-45783)

    * grub2: command/gpg: Use-after-free due to hooks not being removed on module unload (CVE-2025-0622)

    * grub2: UFS: Integer overflow may lead to heap based out-of-bounds write when handling symlinks     (CVE-2025-0677)

    * grub2: read: Integer overflow may lead to out-of-bounds write (CVE-2025-0690)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7427 advisory.

    The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014     compatible terminals for programs that can't use the window system directly.

    Security Fix(es):

    * xterm: code execution via OSC 50 input sequences (CVE-2022-45063)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7431 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

    * php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

    * php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

    * php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

    * php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7402 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: Memory corruption in the ngx_http_mp4_module (CVE-2022-41741)

    * nginx: Memory disclosure in the ngx_http_mp4_module (CVE-2022-41742)

    * nginx: specially crafted MP4 file may cause denial of service (CVE-2024-7347)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7428 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * firefox: thunderbird: Privilege escalation in Firefox Updater (CVE-2025-2817)

    * firefox: thunderbird: Unsafe attribute access during XPath parsing (CVE-2025-4087)

    * firefox: thunderbird: Process isolation bypass using javascript: URI links in cross-origin frames     (CVE-2025-4083)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and     Thunderbird 128.10 (CVE-2025-4091)

    * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10     (CVE-2025-4093)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:7419 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data     (CVE-2025-31492)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:7317 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * rust-openssl: rust openssl ssl::select_next_proto use after free (CVE-2025-24898)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7432 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * php: Leak partial content of the heap through heap buffer over-read in mysqlnd (CVE-2024-8929)

    * php: Single byte overread with convert.quoted-printable-decode filter (CVE-2024-11233)

    * php: Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVE-2024-11234)

    * php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

    * php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

    * php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

    * php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

    * php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7440 advisory.

    Vim (Vi IMproved) is an updated and improved version of the vi editor.

    Security Fix(es):

    * vim: use-after-free in function ins_compl_get_exp in vim/vim (CVE-2023-4752)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:7256 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

    * golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

    * golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

    * golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

    * net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

    * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7438 advisory.

    Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can     contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data     set. You can persist it either by dumping the data set to disk every once in a while, or by appending each     command to a log.

    Security Fix(es):

    * redis: Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated     client (CVE-2025-21605)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7201 advisory.

    The corosync packages provide the Corosync Cluster Engine and C APIs for Red Hat Enterprise Linux cluster     software.

    Security Fix(es):

    * corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7532 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CVE-2022-49011)

    * kernel: netfilter: ipset: add missing range check in bitmap_ip_uadt (CVE-2024-53141)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8194 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkitgtk: Processing maliciously crafted web content may lead to an     unexpected process crash (CVE-2024-44192)

    * webkitgtk: A malicious website may exfiltrate data cross-origin     (CVE-2024-54467)

    * webkitgtk: Processing web content may lead to a denial-of-service     (CVE-2024-54551)

    * webkitgtk: Loading a malicious iframe may lead to a cross-site scripting     attack (CVE-2025-24208)

    * webkitgtk: Processing maliciously crafted web content may lead to an     unexpected process crash (CVE-2025-24209)

    * webkitgtk: Processing maliciously crafted web content may lead to an     unexpected Safari crash (CVE-2025-24216)

    * webkitgtk: Processing maliciously crafted web content may lead to an     unexpected Safari crash (CVE-2025-30427)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8195 advisory.

    MinGW Windows Freetype library.

    Security Fix(es):

    * freetype: OOB write when attempting to parse font subglyph structures related to TrueType GX and     variable font files (CVE-2025-27363)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8181 advisory.

    OpenLDAP is an open-source suite of Lightweight Directory Access Protocol (LDAP) applications and     development tools. LDAP is a set of protocols used to access and maintain distributed directory     information services over an IP network.

    Security Fix(es):

    * openldap: null pointer dereference in  ber_memalloc_x  function (CVE-2023-2953)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8183 advisory.

    GStreamer is a streaming media framework based on graphs of filters which operate on media data. The     gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

    Security Fix(es):

    * GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability     (CVE-2025-3887)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8176 advisory.

    OpenLDAP is an open-source suite of Lightweight Directory Access Protocol (LDAP) applications and     development tools. LDAP is a set of protocols used to access and maintain distributed directory     information services over an IP network.

    Security Fix(es):

    * openldap: null pointer dereference in  ber_memalloc_x  function (CVE-2023-2953)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8142 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: cifs: Fix integer overflow while processing acregmax mount option (CVE-2025-21964)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8133 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: veth: Fix use after free in XDP_REDIRECT (CVE-2023-53107)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:8136 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8140 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)

    * libsoup: Denial of Service attack to websocket server (CVE-2025-32049)

    * libsoup: OOB Read on libsoup through function  soup_multipart_new_from_message in soup-multipart.c     leads to crash or  exit of process (CVE-2025-32914)

    * libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup     (CVE-2025-4948)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8132 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)

    * libsoup: Denial of Service attack to websocket server (CVE-2025-32049)

    * libsoup: OOB Read on libsoup through function  soup_multipart_new_from_message in soup-multipart.c     leads to crash or  exit of process (CVE-2025-32914)

    * libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup     (CVE-2025-4948)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8126 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)

    * libsoup: Denial of Service attack to websocket server (CVE-2025-32049)

    * libsoup: OOB Read on libsoup through function  soup_multipart_new_from_message in soup-multipart.c     leads to crash or  exit of process (CVE-2025-32914)

    * libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup     (CVE-2025-4948)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8134 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: veth: Fix use after free in XDP_REDIRECT (CVE-2023-53107)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8139 advisory.

    The libsoup packages provide an HTTP client and server library for GNOME.

    Security Fix(es):

    * libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)

    * libsoup: Denial of Service attack to websocket server (CVE-2025-32049)

    * libsoup: OOB Read on libsoup through function  soup_multipart_new_from_message in soup-multipart.c     leads to crash or  exit of process (CVE-2025-32914)

    * libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup     (CVE-2025-4948)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7589 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.116 and .NET Runtime 8.0.16.Security Fix(es):

    * dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7571 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 9.0.106 and .NET Runtime 9.0.5.Security Fix(es):

    * dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7549 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: specially crafted MP4 file may cause denial of service (CVE-2024-7347)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7548 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: specially crafted MP4 file may cause denial of service (CVE-2024-7347)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7542 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: specially crafted MP4 file may cause denial of service (CVE-2024-7347)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7586 advisory.

    The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript     translates PostScript code to common bitmap formats so that the code can be displayed or printed.

    Security Fix(es):

    * Ghostscript: NPDL device: Compression buffer overflow (CVE-2025-27832)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8075 advisory.

    A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild     under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It     is compatible with composer-cli and cockpit-composer clients.

    Security Fix(es):

    * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:4228 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data     (CVE-2025-31492)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4238 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous security and bug fixes. Space precludes documenting all of these     changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on     the most significant of these changes:

    https://docs.redhat.com/en/documentation/red_hat_ceph_storage/6/html/6.1_release_notes/index

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:4226 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.1.10 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 7.1.9, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 7.1.9 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8057 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: net/mlx5: Always stop health timer during driver removal (CVE-2024-40906)

    * kernel: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (CVE-2024-44970)

    * kernel: vsock: Keep the binding until socket destruction (CVE-2025-21756)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:8056 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/mlx5: Always stop health timer during driver removal (CVE-2024-40906)

    * kernel: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (CVE-2024-44970)

    * kernel: vsock: Keep the binding until socket destruction (CVE-2025-21756)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7967 advisory.

    A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild     under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It     is compatible with composer-cli and cockpit-composer clients.

    Security Fix(es):

    * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:7733 advisory.

    The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL     package contains only the libraries from the 1.1.1 version and is provided for compatibility with previous     releases.

    Security Fix(es):

    * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:7695 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Privilege escalation in Firefox Updater (CVE-2025-2817)

    * firefox: thunderbird: Unsafe attribute access during XPath parsing (CVE-2025-4087)

    * firefox: thunderbird: Process isolation bypass using javascript: URI links in cross-origin frames     (CVE-2025-4083)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and     Thunderbird 128.10 (CVE-2025-4091)

    * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10     (CVE-2025-4093)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7682 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: netfilter: ipset: add missing range check in bitmap_ip_uadt (CVE-2024-53141)

    * kernel: vsock: Keep the binding until socket destruction (CVE-2025-21756)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:7690 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Privilege escalation in Firefox Updater (CVE-2025-2817)

    * firefox: thunderbird: Unsafe attribute access during XPath parsing (CVE-2025-4087)

    * firefox: thunderbird: Process isolation bypass using javascript: URI links in cross-origin frames     (CVE-2025-4083)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and     Thunderbird 128.10 (CVE-2025-4091)

    * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10     (CVE-2025-4093)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7675 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: netfilter: ipset: add missing range check in bitmap_ip_uadt (CVE-2024-53141)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:7691 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * firefox: thunderbird: Privilege escalation in Firefox Updater (CVE-2025-2817)

    * firefox: thunderbird: Unsafe attribute access during XPath parsing (CVE-2025-4087)

    * firefox: thunderbird: Process isolation bypass using javascript: URI links in cross-origin frames     (CVE-2025-4083)

    * firefox: thunderbird: Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and     Thunderbird 128.10 (CVE-2025-4091)

    * firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10     (CVE-2025-4093)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
237322	RHEL 9 : buildah (RHSA-2025:7389)	high
237321	RHEL 9 : nodejs:22 (RHSA-2025:7433)	high
237320	RHEL 9 : gimp (RHSA-2025:7417)	high
237319	RHEL 9 : ghostscript (RHSA-2025:7422)	high
237318	RHEL 9 : nodejs:20 (RHSA-2025:7426)	high
237317	RHEL 9 : grub2 (RHSA-2025:6990)	medium
237316	RHEL 9 : xterm (RHSA-2025:7427)	critical
237315	RHEL 9 : php (RHSA-2025:7431)	medium
237314	RHEL 9 : nginx (RHSA-2025:7402)	medium
237313	RHEL 9 : firefox (RHSA-2025:7428)	critical
237312	RHEL 9 : mod_auth_openidc (RHSA-2025:7419)	high
237311	RHEL 9 : python3.12-cryptography (RHSA-2025:7317)	medium
237310	RHEL 9 : php:8.2 (RHSA-2025:7432)	medium
237309	RHEL 9 : vim (RHSA-2025:7440)	high
237308	RHEL 9 : git-lfs (RHSA-2025:7256)	high
237307	RHEL 9 : redis (RHSA-2025:7438)	high
237306	RHEL 9 : corosync (RHSA-2025:7201)	critical
237305	RHEL 8 : kernel-rt (RHSA-2025:7532)	high
237293	RHEL 8 : webkit2gtk3 (RHSA-2025:8194)	medium
237292	RHEL 8 : mingw-freetype and spice-client-win (RHSA-2025:8195)	high
237268	RHEL 9 : openldap (RHSA-2025:8181)	high
237267	RHEL 9 : gstreamer1-plugins-bad-free (RHSA-2025:8183)	high
237266	RHEL 9 : openldap (RHSA-2025:8176)	high
237253	RHEL 9 : kernel (RHSA-2025:8142)	medium
237244	RHEL 9 : kernel (RHSA-2025:8133)	high
237243	RHEL 9 : python-tornado (RHSA-2025:8136)	high
237242	RHEL 9 : libsoup (RHSA-2025:8140)	high
237241	RHEL 8 : libsoup (RHSA-2025:8132)	high
237240	RHEL 9 : libsoup (RHSA-2025:8126)	high
237239	RHEL 9 : kernel-rt (RHSA-2025:8134)	high
237238	RHEL 9 : libsoup (RHSA-2025:8139)	high
237144	RHEL 8 : .NET 8.0 (RHSA-2025:7589)	high
237143	RHEL 8 : .NET 9.0 (RHSA-2025:7571)	high
237142	RHEL 9 : nginx:1.22 (RHSA-2025:7549)	medium
237141	RHEL 9 : nginx:1.22 (RHSA-2025:7548)	medium
237140	RHEL 9 : nginx:1.24 (RHSA-2025:7542)	medium
237139	RHEL 9 : ghostscript (RHSA-2025:7586)	critical
237029	RHEL 8 : osbuild-composer (RHSA-2025:8075)	high
237015	RHEL 8 : mod_auth_openidc:2.3 (RHSA-2025:4228)	high
237014	RHEL 8 / 9 : Red Hat Ceph Storage 6.1 update (Important) (RHSA-2025:4238)	high
237013	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 (RHSA-2025:4226)	high
236991	RHEL 8 : kernel-rt (RHSA-2025:8057)	high
236990	RHEL 8 : kernel (RHSA-2025:8056)	high
236943	RHEL 8 : osbuild-composer (RHSA-2025:7967)	high
236817	RHEL 9 : compat-openssl11 (RHSA-2025:7733)	high
236816	RHEL 9 : thunderbird (RHSA-2025:7695)	critical
236811	RHEL 8 : kernel (RHSA-2025:7682)	high
236810	RHEL 8 : thunderbird (RHSA-2025:7690)	critical
236809	RHEL 8 : kernel (RHSA-2025:7675)	high
236808	RHEL 8 : thunderbird (RHSA-2025:7691)	critical

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

high

high

high

high

medium

critical

medium

medium

critical

high

medium

medium

high

high

high

critical

high

medium

high

high

high

high

medium

high

high

high

high

high

high

high

high

high

medium

medium

medium

critical

high

high

high

high

high

high

high

high

critical

high

critical

high

critical