An issue in wasm2c 1.0.32, wasm2wat 1.0.32, wasm-decompile 1.0.32, and wasm-validate 1.0.32 allows attackers to cause a Denial of Service (DoS) via running a crafted binary.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Mozilla: Type confusion for special arguments in IonMonkey (CVE-2020-15656)

  - Mozilla: Malicious Extension could obtain auth codes from OAuth login flows (CVE-2020-6823)

  - By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject     stylesheets and bypass Content Security Policy (CSP). This vulnerability affects Firefox < 63.
    (CVE-2018-12398)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - wasm2c: DoS via crafted binary (CVE-2023-31670)

  - Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS)     via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting     this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic     backtracking. (CVE-2023-26116)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Severity
199961	RHEL 8 : firefox (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199960	RHEL 9 : firefox (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2023-31670

high

Tenable Plugins

critical

high