Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the lou_logFile function at logginc.c endpoint.

The remote host is affected by the vulnerability described in GLSA-202409-18 (liblouis: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in liblouis. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - liblouis: invalid free in compileRule function in compileTranslationTable.c (CVE-2018-11410)

  - Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c.
    (CVE-2018-11440)

  - The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the     input string's length, allowing attackers to cause a denial of service (application crash via out-of-     bounds read) by crafting an input file with certain translation dictionaries. (CVE-2018-17294)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the liblouis-3.16.1-5.el9 build changelog.

  - Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of     service via the lou_logFile function at logginc.c endpoint. (CVE-2023-26767)

  - Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of     service via the compileTranslationTable.c and lou_setDataPath functions. (CVE-2023-26768)

  - Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a     denial of service via the resolveSubtable function at compileTranslationTabel.c. (CVE-2023-26769)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6385 advisory.

    - Fix CVE-2023-26767 (#2181147)
    - Fix CVE-2023-26768 (#2181151)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6385 advisory.

    Liblouis is an open source braille translator and back-translator named in honor of Louis Braille. It     features support for computer and literary braille, supports contracted and uncontracted translation for     many languages and has support for hyphenation. New languages can easily be added through tables that     support a rule or dictionary based approach. Liblouis also supports math braille (Nemeth and Marburg).

    Security Fix(es):

    * liblouis: buffer overflow in lou_logFile function at logginc.c (CVE-2023-26767)

    * liblouis: buffer overflow in lou_setDataPath (CVE-2023-26768)

    * liblouis: buffer overflow in Lou_Trace (CVE-2023-26769)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This Solaris system is missing necessary patches to address critical security updates :

  - Vulnerability in the MySQL Enterprise Monitor product of     Oracle MySQL (component: Monitoring: General (Apache     Tomcat)). Supported versions that are affected are     8.0.34 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise MySQL Enterprise     Monitor. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Enterprise Monitor. CVSS 3.1 Base Score 7.5     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-28709)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Client programs). Supported versions     that are affected are 5.7.41 and prior and 8.0.32 and     prior. Difficult to exploit vulnerability allows low     privileged attacker with network access via multiple     protocols to compromise MySQL Server. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in takeover of MySQL Server. CVSS 3.1 Base Score     7.1 (Confidentiality, Integrity and Availability     impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
    (CVE-2023-21980)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows low privileged attacker     with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.1 Base Score 6.5 (Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21946)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: DDL). Supported versions that     are affected are 8.0.32 and prior. Easily exploitable     vulnerability allows high privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server as well as unauthorized update, insert or delete     access to some of MySQL Server accessible data. CVSS 3.1     Base Score 5.5 (Integrity and Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).
    (CVE-2023-21929)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: InnoDB). Supported versions that are     affected are 8.0.32 and prior. Easily exploitable     vulnerability allows high privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.1 Base Score 4.9 (Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21911)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Components Services).
    Supported versions that are affected are 8.0.32 and     prior. Easily exploitable vulnerability allows high     privileged attacker with network access via multiple     protocols to compromise MySQL Server. Successful attacks     of this vulnerability can result in unauthorized ability     to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21962)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: DDL). Supported versions that     are affected are 8.0.32 and prior. Easily exploitable     vulnerability allows high privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.1 Base Score 4.9 (Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21919)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: DDL). Supported versions that     are affected are 8.0.32 and prior. Easily exploitable     vulnerability allows high privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.1 Base Score 4.9 (Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21933)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: DML). Supported versions that     are affected are 8.0.32 and prior. Easily exploitable     vulnerability allows high privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.1 Base Score 4.9 (Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21972)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: JSON). Supported versions that     are affected are 8.0.32 and prior. Easily exploitable     vulnerability allows high privileged attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.1 Base Score 4.9 (Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21966)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21920)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21935)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21945)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21976)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21977)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21982)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Partition). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21953)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Partition). Supported versions     that are affected are 8.0.32 and prior. Easily     exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to     compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.9     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21955)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Components Services).
    Supported versions that are affected are 8.0.32 and     prior. Difficult to exploit vulnerability allows high     privileged attacker with network access via multiple     protocols to compromise MySQL Server. Successful attacks     of this vulnerability can result in unauthorized ability     to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.4     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21940)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Components Services).
    Supported versions that are affected are 8.0.32 and     prior. Difficult to exploit vulnerability allows high     privileged attacker with network access via multiple     protocols to compromise MySQL Server. Successful attacks     of this vulnerability can result in unauthorized ability     to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. CVSS 3.1 Base Score 4.4     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21947)

  - Vulnerability in the Oracle Communications Diameter     Signaling Router product of Oracle Communications     (component: Virtual Network Function Manager (git)). The     supported version that is affected is 8.6.0.0. Easily     exploitable vulnerability allows unauthenticated     attacker with logon to the infrastructure where Oracle     Communications Diameter Signaling Router executes to     compromise Oracle Communications Diameter Signaling     Router. Successful attacks require human interaction     from a person other than the attacker. Successful     attacks of this vulnerability can result in takeover of     Oracle Communications Diameter Signaling Router. CVSS     3.1 Base Score 7.8 (Confidentiality, Integrity and     Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
    (CVE-2023-29007)

  - Vulnerability in the MySQL Workbench product of Oracle     MySQL (component: Workbench (libxml2)). Supported     versions that are affected are 8.0.33 and prior. Easily     exploitable vulnerability allows unauthenticated     attacker with network access via MySQL Workbench to     compromise MySQL Workbench. Successful attacks require     human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Workbench. CVSS     3.1 Base Score 6.5 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
    (CVE-2023-28484)

  - Vulnerability in the Oracle Retail Advanced Inventory     Planning product of Oracle Retail Applications     (component: Operations & Maintenance (zlib)). Supported     versions that are affected are 15.0 and 16.0. Easily     exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise     Oracle Retail Advanced Inventory Planning. Successful     attacks of this vulnerability can result in takeover of     Oracle Retail Advanced Inventory Planning. CVSS 3.1 Base     Score 9.8 (Confidentiality, Integrity and Availability     impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
    (CVE-2022-37434)

  - Vulnerability in the Oracle Enterprise Operations     Monitor product of Oracle Communications (component:
    Mediation Engine (OpenSSL)). Supported versions that are     affected are 5.0 and 5.1. Easily exploitable     vulnerability allows unauthenticated attacker with     network access via TLS to compromise Oracle Enterprise     Operations Monitor. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete     DOS) of Oracle Enterprise Operations Monitor. CVSS 3.1     Base Score 7.5 (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-0215)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Packaging (cURL)). Supported     versions that are affected are 5.7.41 and prior and     8.0.32 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via     multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access     to all MySQL Server accessible data. CVSS 3.1 Base Score     7.5 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
    (CVE-2022-43551)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Server: Security: Privileges).
    Supported versions that are affected are 5.7.41 and     prior and 8.0.30 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of MySQL     Server. CVSS 3.1 Base Score 7.5 (Availability impacts).
    CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-21912)

  - Vulnerability in the MySQL Server product of Oracle     MySQL (component: Client programs). Supported versions     that are affected are 5.7.41 and prior and 8.0.32 and     prior. Difficult to exploit vulnerability allows low     privileged attacker with network access via multiple     protocols to compromise MySQL Server. Successful attacks     require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in takeover of MySQL Server. CVSS 3.1 Base Score     7.1 (Confidentiality, Integrity and Availability     impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
    (CVE-2023-21980)

  - Vulnerability in the Oracle Communications Diameter     Signaling Router product of Oracle Communications     (component: Virtual Network Function Manager (Libwebp)).
    The supported version that is affected is 8.6.0.0.
    Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise     Oracle Communications Diameter Signaling Router.
    Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle Communications     Diameter Signaling Router. CVSS 3.1 Base Score 7.5     (Availability impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
    (CVE-2023-1999)

The remote Ubuntu 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5996-2 advisory.

    USN-5996-1 fixed vulnerabilities in Liblouis. This update provides the corresponding updates for Ubuntu     23.04.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of liblouis installed on the remote host is prior to 2.6.2-21. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2013 advisory.

    Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of     service via the lou_logFile function at logginc.c endpoint. (CVE-2023-26767)

    Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of     service via the compileTranslationTable.c and lou_setDataPath functions. (CVE-2023-26768)

    Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a     denial of service via the resolveSubtable function at compileTranslationTabel.c. (CVE-2023-26769)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1773-1 advisory.

  - Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of     service via the lou_logFile function at logginc.c endpoint. (CVE-2023-26767)

  - Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a     denial of service via the resolveSubtable function at compileTranslationTabel.c. (CVE-2023-26769)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1771-1 advisory.

  - Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of     service via the lou_logFile function at logginc.c endpoint. (CVE-2023-26767)

  - Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a     denial of service via the resolveSubtable function at compileTranslationTabel.c. (CVE-2023-26769)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1772-1 advisory.

  - Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of     service via the lou_logFile function at logginc.c endpoint. (CVE-2023-26767)

  - Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a     denial of service via the resolveSubtable function at compileTranslationTabel.c. (CVE-2023-26769)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5996-1 advisory.

    It was discovered that Liblouis incorrectly handled certain files. An attacker could possibly use this     issue to cause a denial of service. (CVE-2023-26767, CVE-2023-26768, CVE-2023-26769)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
207576	GLSA-202409-18 : liblouis: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
199667	RHEL 8 : liblouis (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195531	RHEL 7 : liblouis (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
191309	CentOS 9 : liblouis-3.16.1-5.el9	Nessus	CentOS Local Security Checks	high
185827	Oracle Linux 9 : liblouis (ELSA-2023-6385)	Nessus	Oracle Linux Local Security Checks	high
185106	RHEL 9 : liblouis (RHSA-2023:6385)	Nessus	Red Hat Local Security Checks	high
178628	Oracle Solaris Critical Patch Update : jul2023_SRU11_4_59_144_2	Nessus	Solaris Local Security Checks	critical
176265	Ubuntu 23.04 : Libloius vulnerabilities (USN-5996-2)	Nessus	Ubuntu Local Security Checks	high
174578	Amazon Linux 2 : liblouis (ALAS-2023-2013)	Nessus	Amazon Linux Local Security Checks	high
173957	SUSE SLES15 / openSUSE 15 Security Update : liblouis (SUSE-SU-2023:1773-1)	Nessus	SuSE Local Security Checks	high
173956	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : liblouis (SUSE-SU-2023:1771-1)	Nessus	SuSE Local Security Checks	high
173951	SUSE SLES15 / openSUSE 15 Security Update : liblouis (SUSE-SU-2023:1772-1)	Nessus	SuSE Local Security Checks	high
173861	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : Liblouis vulnerabilities (USN-5996-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2023-26767

high

Tenable Plugins

high

critical

high

high

high

high

critical

high

high

high

high

high

high