An update of the curl package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-8ed627bb04 advisory.

    - fix more POST-after-PUT confusion (CVE-2023-28322)
    - fix IDN wildcard match (CVE-2023-28321)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of     wildcard patterns when listed as 'Subject Alternative Name' in TLS server certificates. curl can be built     to use its own name matching function for TLS rather than one provided by a TLS library. This private     wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a     result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before     used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to     pattern match, but the wildcard check in curl could still check for `x*`, which would match even though     the IDN name most likely contained nothing even resembling an `x`. (CVE-2023-28321)

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3692 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3692-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     December 19, 2023                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : curl     Version        : 7.64.0-4+deb10u8     CVE ID         : CVE-2023-28322 CVE-2023-46218     Debian Bug     : 926148 1036239 1057646

    Two security issues were found in Curl, an easy-to-use client-side URL     transfer library and command line tool.

    Additionally, the command line tool does now:
    - - display the Debian revision in curl --version, and
    - - does no longer output verbose Expire in messsages with curl -v

    CVE-2023-28322

        POST-after-PUT confusion.

    CVE-2023-46218

        Cookie mixed case PSL bypass.

    For Debian 10 buster, these problems have been fixed in version     7.64.0-4+deb10u8.

    We recommend that you upgrade your curl packages.

    For the detailed security status of curl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/curl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2023 CPU advisory.

  - Vulnerability in the Oracle Spatial and Graph (cURL) component of Oracle Database Server. Supported     versions that are affected are 19.3-19.20 and 21.3-21.11. Easily exploitable vulnerability allows low     privileged attacker having Authenticated User privilege with network access via HTTP to compromise Oracle     Spatial and Graph (cURL). Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Oracle Spatial and Graph (cURL).
    (CVE-2023-38039)

  - Vulnerability in the OML4Py (cryptography) component of Oracle Database Server. Supported versions that     are affected are 21.3-21.11. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via HTTP to compromise OML4Py (cryptography). Successful attacks of this vulnerability can     result in unauthorized creation, deletion or modification access to critical data or all     OML4Py (cryptography) accessible data. (CVE-2022-23491)

  - Vulnerability in the PL/SQL component of Oracle Database Server. Supported versions that are affected are     19.3-19.20 and 21.3-21.11. Easily exploitable vulnerability allows high privileged attacker having Create     Session, Execute on sys.utl_http privilege with network access via Oracle Net to compromise PL/SQL.
    Successful attacks require human interaction from a person other than the attacker and while the     vulnerability is in PL/SQL, attacks may significantly impact additional products (scope change).
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of PL/SQL accessible data as well as unauthorized read access to a subset of PL/SQL accessible data     and unauthorized ability to cause a partial denial of service (partial DOS) of PL/SQL. (CVE-2023-22071)

  - Security-in-depth update for non-exploitable vulnerabilities CVE-2020-25649, CVE-2020-36518, CVE-2021-34031,     CVE-2022-4899, CVE-2022-42003, CVE-2022-42004, CVE-2022-46908, CVE-2023-2976 and CVE-2023-35887.


Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers     for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting,     libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.
    Further, this error condition fails silently and is therefore not easily detected by an     application.(CVE-2024-2398)

    An information disclosure vulnerability exists in curl v8.1.0 when doing HTTP(S) transfers, libcurl     might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST.(CVE-2023-28322)

Tenable has extracted the preceding description block directly from the EulerOS curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may     allow an attacker to pass on maliciously crafted user name and 'telnet options' during server negotiation.
    The lack of proper input scrubbing allows an attacker to send content or perform option negotiation     without the application's intent. This vulnerability could be exploited if an application allows user     input, thereby enabling attackers to execute arbitrary code on the system. (CVE-2023-27533)

  - A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to     be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as     the first element to indicate a path relative to the user's home directory. Attackers can exploit this     flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a     server with a specific user. (CVE-2023-27534)

  - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that     can result in wrong credentials being used during subsequent transfers. Previously created connections are     kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as     CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not     included in the configuration match checks, causing them to match too easily. This could lead to libcurl     using the wrong credentials when performing a transfer, potentially allowing unauthorized access to     sensitive information. (CVE-2023-27535)

  - An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can     reuse previously established connections with incorrect user permissions due to a failure to check for     changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI     transfers and could potentially result in unauthorized access to sensitive information. The safest option     is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. (CVE-2023-27536)

  - An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously     established SSH connection despite the fact that an SSH option was modified, which should have prevented     reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if     the configurations match. However, two SSH settings were omitted from the configuration check, allowing     them to match easily, potentially leading to the reuse of an inappropriate connection. (CVE-2023-27538)

  - An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of     wildcard patterns when listed as 'Subject Alternative Name' in TLS server certificates. curl can be built     to use its own name matching function for TLS rather than one provided by a TLS library. This private     wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a     result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before     used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to     pattern match, but the wildcard check in curl could still check for `x*`, which would match even though     the IDN name most likely contained nothing even resembling an `x`. (CVE-2023-28321)

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may     allow an attacker to pass on maliciously crafted user name and 'telnet options' during server negotiation.
    The lack of proper input scrubbing allows an attacker to send content or perform option negotiation     without the application's intent. This vulnerability could be exploited if an application allows user     input, thereby enabling attackers to execute arbitrary code on the system. (CVE-2023-27533)

  - A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to     be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as     the first element to indicate a path relative to the user's home directory. Attackers can exploit this     flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a     server with a specific user. (CVE-2023-27534)

  - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that     can result in wrong credentials being used during subsequent transfers. Previously created connections are     kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as     CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not     included in the configuration match checks, causing them to match too easily. This could lead to libcurl     using the wrong credentials when performing a transfer, potentially allowing unauthorized access to     sensitive information. (CVE-2023-27535)

  - An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can     reuse previously established connections with incorrect user permissions due to a failure to check for     changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI     transfers and could potentially result in unauthorized access to sensitive information. The safest option     is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed. (CVE-2023-27536)

  - An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously     established SSH connection despite the fact that an SSH option was modified, which should have prevented     reuse. libcurl maintains a pool of previously used connections to reuse them for subsequent transfers if     the configurations match. However, two SSH settings were omitted from the configuration check, allowing     them to match easily, potentially leading to the reuse of an inappropriate connection. (CVE-2023-27538)

  - An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of     wildcard patterns when listed as 'Subject Alternative Name' in TLS server certificates. curl can be built     to use its own name matching function for TLS rather than one provided by a TLS library. This private     wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a     result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before     used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to     pattern match, but the wildcard check in curl could still check for `x*`, which would match even though     the IDN name most likely contained nothing even resembling an `x`. (CVE-2023-28321)

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.2024 advisory.

  - This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in     curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a     cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though     `co.uk` is listed as a PSL domain. (CVE-2023-46218)

  - Use after free in tcpslice triggers AddressSanitizer, no other confirmed impact. (CVE-2021-41043)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (CVE-2022-48624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1601 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: information disclosure by exploiting a mixed case flaw (CVE-2023-46218)

    * curl: more POST-after-PUT confusion (CVE-2023-28322)

    * curl: cookie injection with none file (CVE-2023-38546)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * libssh (curl sftp) not trying password auth (BZ#2240033)

    * libssh: cap SFTP packet size sent (RHEL-5485)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1601 advisory.

    - unify the upload/method handling (CVE-2023-28322)
    - fix cookie injection with none file (CVE-2023-38546)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.6.8. It is, therefore, affected by multiple vulnerabilities:

  - A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in     macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8. An app may be able to read     sensitive location information. (CVE-2023-40442)

  - The issue was addressed with improved memory handling. This issue is fixed in watchOS 9.6, macOS Monterey     12.6.8, iOS 15.7.8 and iPadOS 15.7.8, macOS Big Sur 11.7.9, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5.
    An app may be able to execute arbitrary code with kernel privileges. (CVE-2023-34425)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Ventura 13.5. A     sandboxed process may be able to circumvent sandbox restrictions. (CVE-2023-32364)

  - This issue was addressed with improved data protection. This issue is fixed in macOS Monterey 12.6.8,     macOS Ventura 13.5, macOS Big Sur 11.7.9. An app may be able to modify protected parts of the file system.
    (CVE-2023-35983)

  - A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in     macOS Ventura 13.5. An app may be able to read sensitive location information. (CVE-2023-40392)

  - OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like     operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to     the logging service AFTER the connection has been closed, when it should have logged the data right     before. This is a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue     is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose     always, provided its argument is not null, frees the pointer at the end of the call, only for     cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient`     if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address     (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP     wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`. Version     2.4.6 has a patch for this issue. (CVE-2023-34241)

  - A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH     server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the     fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting     sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and     revealed. (CVE-2023-28319)

  - A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different     backends for resolving host names, selected at build time. If it is built to use the synchronous resolver,     it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this,     libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore     crash or otherwise misbehave. (CVE-2023-28320)

  - An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of     wildcard patterns when listed as Subject Alternative Name in TLS server certificates. curl can be built     to use its own name matching function for TLS rather than one provided by a TLS library. This private     wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a     result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before     used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to     pattern match, but the wildcard check in curl could still check for `x*`, which would match even though     the IDN name most likely contained nothing even resembling an `x`. (CVE-2023-28321)

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.6.8, iOS     15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5, watchOS 9.6. An app may be able to     read sensitive location information. (CVE-2023-32416)

  - The issue was addressed with improved handling of caches. This issue is fixed in tvOS 16.3, iOS 16.3 and     iPadOS 16.3, macOS Monterey 12.6.8, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Ventura     13.2, watchOS 9.3. Processing a font file may lead to arbitrary code execution. Apple is aware of a report     that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.
    (CVE-2023-41990)

  - The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.8, macOS Ventura     13.5, macOS Big Sur 11.7.9. Processing a file may lead to unexpected app termination or arbitrary code     execution. (CVE-2023-32418, CVE-2023-36854)

  - The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, macOS     Ventura 13.5. A remote user may be able to cause a denial-of-service. (CVE-2023-38603)

  - A buffer overflow issue was addressed with improved memory handling. This issue is fixed in watchOS 9.6,     macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, tvOS 16.6, iOS 16.6 and iPadOS     16.6, macOS Ventura 13.5. A remote user may be able to cause unexpected system termination or corrupt     kernel memory. (CVE-2023-38590)

  - A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.6,     macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, tvOS 16.6, iOS 16.6 and iPadOS     16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
    (CVE-2023-38598)

  - An integer overflow was addressed with improved input validation. This issue is fixed in watchOS 9.6,     macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura     13.5. An app may be able to execute arbitrary code with kernel privileges. (CVE-2023-36495)

  - An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 15.7.8 and     iPadOS 15.7.8, macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to     execute arbitrary code with kernel privileges. (CVE-2023-37285)

  - An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in watchOS     9.6, macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, tvOS 16.6, iOS 16.6 and     iPadOS 16.6, macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.
    (CVE-2023-38604)

  - A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS     Monterey 12.6.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS     9.6. An app may be able to execute arbitrary code with kernel privileges. (CVE-2023-32381)

  - A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS     Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9,     macOS Ventura 13.5, watchOS 9.6. An app may be able to execute arbitrary code with kernel privileges.
    (CVE-2023-32433, CVE-2023-35993)

  - This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS     15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5,     watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this     issue may have been actively exploited against versions of iOS released before iOS 15.7.1.
    (CVE-2023-38606)

  - The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.8, iOS     15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5,     watchOS 9.6. An app may be able to execute arbitrary code with kernel privileges. (CVE-2023-32441)

  - A path handling issue was addressed with improved validation. This issue is fixed in macOS Monterey     12.6.8, iOS 16.6 and iPadOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be     able to gain root privileges. (CVE-2023-38565)

  - A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.8, iOS 16.6     and iPadOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to cause a     denial-of-service. (CVE-2023-38593)

  - This issue was addressed with improved state management of S/MIME encrypted emails. This issue is fixed in     macOS Monterey 12.6.8. A S/MIME encrypted email may be inadvertently sent unencrypted. (CVE-2023-40440)

  - This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Big Sur     11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to bypass Privacy preferences.
    (CVE-2023-38571)

  - The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5, macOS Monterey     12.6.8. Processing a 3D model may result in disclosure of process memory. (CVE-2023-38258, CVE-2023-38421)

  - A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file     can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a     denial of service and limited information disclosure. This issue affects libtiff versions 4.x.
    (CVE-2023-1916)

  - ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-     relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo     or reached via the TERMINFO or TERM environment variable. (CVE-2023-29491)

  - This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.7.9,     macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to modify protected parts of the file     system. (CVE-2023-38601)

  - A logic issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.7.9, macOS     Monterey 12.6.8, macOS Ventura 13.5. A sandboxed process may be able to circumvent sandbox restrictions.
    (CVE-2023-32444)

  - A vulnerability was found in openldap. This security flaw causes a null pointer dereference in     ber_memalloc_x() function. (CVE-2023-2953)

  - The issue was addressed with additional restrictions on the observability of app states. This issue is     fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to access SSH     passphrases. (CVE-2023-42829)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.6.8,     macOS Ventura 13.5, macOS Big Sur 11.7.9. An app may be able to access user-sensitive data.
    (CVE-2023-38259)

  - A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey     12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. An app may be able to modify protected parts of the file     system. (CVE-2023-38602)

  - This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Big Sur 11.7.9, iOS     15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to fingerprint the     user. (CVE-2023-42831)

  - An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura     13.5, macOS Monterey 12.6.8. A shortcut may be able to modify sensitive Shortcuts app settings.
    (CVE-2023-32442)

  - An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Monterey     12.6.8, macOS Ventura 13.5, macOS Big Sur 11.7.9. Processing a file may lead to a denial-of-service or     potentially disclose memory contents. (CVE-2023-32443)

  - A race condition was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.7.9,     macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to gain root privileges. (CVE-2023-42832)

  - This issue was addressed by adding additional SQLite logging restrictions. This issue is fixed in iOS 16.5     and iPadOS 16.5, tvOS 16.5, macOS Ventura 13.4. An app may be able to bypass Privacy preferences.
    (CVE-2023-32422)

  - The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5. An app may be     able to bypass Privacy preferences. (CVE-2023-32429)

  - The SMB protocol decoder in tcpdump version 4.99.3 can perform an out-of-bounds write when decoding a     crafted network packet. (CVE-2023-1801)

  - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. (CVE-2023-2426)

  - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. (CVE-2023-2609)

  - Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. (CVE-2023-2610)

  - This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS     Ventura 13.5. An app may be able to determine a user's current location. (CVE-2023-38605)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

The version of Siemens SINEC NMS installed on the remote host is prior to 2.0.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA-943925 advisory.

  - coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type     request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload,     aka Content-Type confusion between the WAF and the backend application. This occurs when the web     application relies on only the last Content-Type header. Other platforms may reject the additional     Content-Type header or merge conflicting headers, leading to detection as a malformed header.
    (CVE-2023-38199)

  - Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request     Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of     RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied     request-target (URL) data and is then re-inserted into the proxied request-target using variable     substitution. For example, something like: RewriteEngine on RewriteRule ^/here/(.*)     http://example.com:8080/elsewhere?$1; [P] ProxyPassReverse /here/ http://example.com:8080/ Request     splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended     URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version     2.4.56 of Apache HTTP Server. (CVE-2023-25690)

  - The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module. This vulnerability affects all users using the experimental policy     mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js. (CVE-2023-32002)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.8.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.8.1 advisory.

  - There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are     affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the     pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that     attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not     believed likely. Attacks against DH are considered just feasible (although very difficult) because most of     the work necessary to deduce information about a private key may be performed offline. The amount of     resources required for such an attack would be significant. However, for an attack on TLS to be     meaningful, the server would have to share the DH private key among multiple clients, which is no longer     an option since CVE-2016-0701. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.0. It was     addressed in the releases of 1.1.1m and 3.0.1 on the 15th of December 2021. For the 1.0.2 release it is     addressed in git commit 6fc1aaaf3 that is available to premium support customers only. It will be made     available in 1.0.2zc when it is released. The issue only affects OpenSSL on MIPS platforms. Fixed in     OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l). Fixed in OpenSSL 1.0.2zc-     dev (Affected 1.0.2-1.0.2zb). (CVE-2021-4160)

  - CVE-2023-38545 is a heap-based buffer overflow vulnerability in the SOCKS5 proxy handshake in libcurl and     curl.  When curl is given a hostname to pass along to a SOCKS5 proxy that is greater than 255 bytes in     length, it will switch to local name resolution in order to resolve the address before passing it on to     the SOCKS5 proxy. However, due to a bug introduced in 2020, this local name resolution could fail due to a     slow SOCKS5 handshake, causing curl to pass on the hostname greater than 255 bytes in length into the     target buffer, leading to a heap overflow.  The advisory for CVE-2023-38545 gives an example exploitation     scenario of a malicious HTTPS server redirecting to a specially crafted URL. While it might seem that an     attacker would need to influence the slowness of the SOCKS5 handshake, the advisory states that server     latency is likely slow enough to trigger this bug. (CVE-2023-38545)

  - This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to     pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting     done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected     to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due     to this bug, the local variable that means let the host resolve the name could get the wrong value     during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target     buffer instead of copying just the resolved address there. The target buffer being a heap based buffer,     and the host name coming from the URL that curl has been told to operate with. (CVE-2023-38545)

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

  - This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the     specific series of conditions are met. libcurl performs transfers. In its API, an application creates     easy handles that are the individual handles for single transfers. libcurl provides a function call that     duplicates en easy handle called     [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies     enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the     actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned     version of the handle would instead store the file name as `none` (using the four ASCII letters, no     quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from     would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in     the current directory of the program using libcurl. And if using the correct file format of course.
    (CVE-2023-38546)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
203251	Photon OS 4.0: Curl PHSA-2023-4.0-0399	Nessus	PhotonOS Local Security Checks	7/23/2024	7/23/2024	low
226158	Linux Distros Unpatched Vulnerability : CVE-2023-28322	Nessus	Misc.	3/5/2025	9/1/2025	low
176909	Fedora 37 : curl (2023-8ed627bb04)	Nessus	Fedora Local Security Checks	6/8/2023	11/14/2024	medium
178378	EulerOS 2.0 SP10 : curl (EulerOS-SA-2023-2350)	Nessus	Huawei Local Security Checks	7/18/2023	7/20/2023	medium
187271	Debian dla-3692 : curl - security update	Nessus	Debian Local Security Checks	12/22/2023	1/22/2025	critical
183503	Oracle Database Server (October 2023 CPU)	Nessus	Databases	10/20/2023	1/18/2024	medium
202949	EulerOS 2.0 SP8 : curl (EulerOS-SA-2024-2022)	Nessus	Huawei Local Security Checks	7/22/2024	7/26/2024	low
188928	EulerOS Virtualization 2.11.0 : curl (EulerOS-SA-2023-2750)	Nessus	Huawei Local Security Checks	1/16/2024	1/16/2024	high
189027	EulerOS 2.0 SP11 : curl (EulerOS-SA-2023-2677)	Nessus	Huawei Local Security Checks	1/16/2024	1/16/2024	high
206822	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.2024)	Nessus	Misc.	9/9/2024	3/28/2025	critical
192856	RHEL 8 : curl (RHSA-2024:1601)	Nessus	Red Hat Local Security Checks	4/2/2024	3/17/2025	critical
192907	Oracle Linux 8 : curl (ELSA-2024-1601)	Nessus	Oracle Linux Local Security Checks	4/3/2024	9/23/2024	critical
178752	macOS 12.x < 12.6.8 Multiple Vulnerabilities (HT213844)	Nessus	MacOS X Local Security Checks	7/24/2023	6/14/2024	critical
191429	Siemens SINEC NMS < V2.0 SP1 Multiple Vulnerabilities	Nessus	Windows	2/29/2024	11/5/2025	critical
202829	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.8.1)	Nessus	Misc.	7/22/2024	11/5/2025	medium

Detections

Analytics

Plugins Search

low

low

medium

medium

critical

medium

low

high

high

critical

critical

critical

critical

critical

medium