The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3345 advisory.

  - tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an     snprintf call, leading to Information disclosure. (CVE-2019-9824)

  - interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
    (CVE-2019-12155)

  - An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by     running /bin/ntfs-3g with specially crafted arguments from a specially crafted directory to cause a heap     buffer overflow, resulting in a crash or the ability to execute arbitrary code. In installations where     /bin/ntfs-3g is a setuid-root binary, this could lead to a local escalation of privileges. (CVE-2019-9755)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 8 : virt:ol (ELSA-2019-3345)

high Nessus Plugin ID 180806

Version 1.2

Version 1.1

Version 1.0

Version 1.2 Nov 2, 2024, 2:28 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin Feed: 202411020228
Version 1.1 Oct 23, 2024, 3:11 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin Feed: 202410230311
Version 1.0 Sep 7, 2023, 9:48 PM New Plugin Feed: 202309072148