In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-d19ccfc5b0 advisory.

    Automatic update for godot-4.1.2-1.fc40.

    ##### **Changelog**

    ```
    * Thu Oct 12 2023 Rmi Verschelde <akien@fedoraproject.org> - 4.1.2-1
    - Version 4.1.2-stable
    - Updates tinyexr to 1.0.7, fixes CVE-2022-34300 (rhbz#2233637)
    - Preconfigure Blender path for .blend file import (rhbz#2177897)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-5410d30cc9 advisory.

    This updates provides Godot 4.1.2 as the latest stable release for this free and open source game engine.

    It fixes many bugs, improves features and usability.

    For Fedora 37 and 38, it updates from Godot 4.0.x to 4.1.x, so the release notes for the minor 4.1 release     are worth reviewing.

    This update also improves the .blend file import integration by pre-filling the path to system packaged     Blender.
    It also fixes a security vulnerability in the EXR importer.

    Release notes:
    - https://godotengine.org/article/godot-4-1-is-here/
    - https://godotengine.org/article/maintenance-release-godot-4-1-1/
    - https://godotengine.org/article/maintenance-release-godot-4-1-2/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-5225a85559 advisory.

    This updates provides Godot 4.1.2 as the latest stable release for this free and open source game engine.

    It fixes many bugs, improves features and usability.

    For Fedora 37 and 38, it updates from Godot 4.0.x to 4.1.x, so the release notes for the minor 4.1 release     are worth reviewing.

    This update also improves the .blend file import integration by pre-filling the path to system packaged     Blender.
    It also fixes a security vulnerability in the EXR importer.

    Release notes:
    - https://godotengine.org/article/godot-4-1-is-here/
    - https://godotengine.org/article/maintenance-release-godot-4-1-1/
    - https://godotengine.org/article/maintenance-release-godot-4-1-2/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-59e4f4c9bb advisory.

    This updates provides Godot 4.1.2 as the latest stable release for this free and open source game engine.

    It fixes many bugs, improves features and usability.

    For Fedora 37 and 38, it updates from Godot 4.0.x to 4.1.x, so the release notes for the minor 4.1 release     are worth reviewing.

    This update also improves the .blend file import integration by pre-filling the path to system packaged     Blender.
    It also fixes a security vulnerability in the EXR importer.

    Release notes:
    - https://godotengine.org/article/godot-4-1-is-here/
    - https://godotengine.org/article/maintenance-release-godot-4-1-1/
    - https://godotengine.org/article/maintenance-release-godot-4-1-2/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-3e092b3938 advisory.

    Upstream patch to fix CVE-2022-34300     Fixes rhbz#2233636

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194518	Fedora 40 : godot (2023-d19ccfc5b0)	Nessus	Fedora Local Security Checks	high
185312	Fedora 39 : godot (2023-5410d30cc9)	Nessus	Fedora Local Security Checks	high
184312	Fedora 37 : godot (2023-5225a85559)	Nessus	Fedora Local Security Checks	high
184304	Fedora 38 : godot (2023-59e4f4c9bb)	Nessus	Fedora Local Security Checks	high
180595	Fedora 38 : tinyexr (2023-3e092b3938)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2022-34300

high

Tenable Plugins

high

high

high

high

high