GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).

The remote host is affected by the vulnerability described in GLSA-202210-15 (GDAL: Heap Buffer Overflow)

  - GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called     from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).
    (CVE-2021-45943)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3129 advisory.

  - GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB     threshold is exceeded. (CVE-2019-17545)

  - GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called     from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).
    (CVE-2021-45943)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5239 advisory.

  - GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called     from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).
    (CVE-2021-45943)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 12.1.0.2, 19c, 21c, All Supported Versions, and None versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory.

  - Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server.
    For supported versions that are affected see note. Easily exploitable vulnerability allows low privileged     attacker having Local Logon privilege with logon to the infrastructure where Oracle Database - Enterprise     Edition Sharding executes to compromise Oracle Database - Enterprise Edition Sharding. While the     vulnerability is in Oracle Database - Enterprise Edition Sharding, attacks may significantly impact     additional products (scope change). Successful attacks of this vulnerability can result in takeover of     Oracle Database - Enterprise Edition Sharding. (CVE-2022-21510)

  - Vulnerability in the Oracle Database - Enterprise Edition Recovery component of Oracle Database Server. For     supported versions that are affected see note. Easily exploitable vulnerability allows high privileged     attacker having EXECUTE ON DBMS_IR.EXECUTESQLSCRIPT privilege with network access via Oracle Net to compromise Oracle     Database - Enterprise Edition Recovery. Successful attacks of this vulnerability can result in takeover of     Oracle Database - Enterprise Edition Recovery. Note: None of the supported versions are affected. (CVE-2022-21511)

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are     12.1.0.2, 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure     privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this vulnerability     can result in unauthorized creation, deletion or modification access to critical data or all Java VM accessible     data. (CVE-2022-21565)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2877 advisory.

  - GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB     threshold is exceeded. (CVE-2019-17545)

  - GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called     from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).
    (CVE-2021-45943)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
166727	GLSA-202210-15 : GDAL: Heap Buffer Overflow	Nessus	Gentoo Local Security Checks	medium
165604	Debian DLA-3129-1 : gdal - LTS security update	Nessus	Debian Local Security Checks	critical
165512	Debian DSA-5239-1 : gdal - security update	Nessus	Debian Local Security Checks	medium
163408	Oracle Database Server (Jul 2022 CPU)	Nessus	Databases	critical
156691	Debian DLA-2877-1 : gdal - LTS security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2021-45943

medium

Tenable Plugins

medium

critical

medium

critical

critical