The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3526 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3526-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     August 13, 2023                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libreoffice     Version        : 1:6.1.5-3+deb10u10     CVE ID         : CVE-2022-3874 CVE-2023-0950 CVE-2023-2255     Debian Bug     :

    LibreOffice an office productivity suite was affected by multiple     vulnerabilities.

    CVE-2022-3874

        Libreoffice may be configured to add an empty         entry to the Java class path.
        This may lead to run arbitrary Java code from the         current directory.

    CVE-2023-0950

        Improper Validation of Array Index vulnerability in the         spreadsheet component allows an attacker to craft a         spreadsheet document that will cause an array index         underflow when loaded. In the affected versions of LibreOffice         certain malformed spreadsheet formulas, such as AGGREGATE,         could be created with less parameters passed to the formula         interpreter than it expected, leading to an array index         underflow, in which case there is a risk that arbitrary         code could be executed.

    CVE-2023-2255

        Improper access control in editor components of         LibreOffice allowed an attacker to craft         a document that would cause external links to be loaded without prompt.
        In the affected versions of LibreOffice documents         that used floating frames         linked to external files, would load the contents of those frames         without prompting the user for permission to do so.
        This was inconsistent with the treatment of other linked         content in LibreOffice.


    For Debian 10 buster, these problems have been fixed in version     1:6.1.5-3+deb10u10.

    We recommend that you upgrade your libreoffice packages.

    For the detailed security status of libreoffice please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libreoffice

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3526 : fonts-opensymbol - security update

critical Nessus Plugin ID 179739

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.3 Jan 22, 2025, 5:44 PM CVE (set "CVE" coverage to "CVE-2022-3874,CVE-2023-0950,CVE-2023-2255") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501221744
Version 1.2 Dec 15, 2023, 10:12 AM IAVM reference Plugin Feed: 202312151012
Version 1.1 Sep 27, 2023, 2:15 PM CVSS metrics ("CVSSv2 score" changed from 7.2 to 8.3. "CVSSv2 vector" changed from "CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C" to "CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C". "CVSSv3 score" changed from 7.8 to 9.1. "CVSSv3 vector" changed from "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" to "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2023-0950" to "CVE-2022-3874") CVSSv3 score source (set to "CVE-2022-3874") Plugin Feed: 202309271415
Version 1.0 Aug 14, 2023, 4:00 PM New Plugin Feed: 202308141600