The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-529.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: ipvs: properly dereference pe in     ip_vs_add_service Use pe directly to resolve sparse warning: net/netfilter/ipvs/ip_vs_ctl.c:1471:27:
    warning: dereference of noderef expression (CVE-2024-42322)

  - In the Linux kernel, the following vulnerability has been resolved: fscache: delete     fscache_cookie_lru_timer when fscache exits to avoid UAF The fscache_cookie_lru_timer is initialized when     the fscache module is inserted, but is not deleted when the fscache module is removed. If timer_reduce()     is called before removing the fscache module, the fscache_cookie_lru_timer will be added to the timer list     of the current cpu. Afterwards, a use-after-free will be triggered in the softIRQ after removing the     fscache module, as follows: ================================================================== BUG: unable     to handle page fault for address: fffffbfff803c9e9 PF: supervisor read access in kernel mode PF:
    error_code(0x0000) - not-present page PGD 21ffea067 P4D 21ffea067 PUD 21ffe6067 PMD 110a7c067 PTE 0 Oops:
    Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W 6.11.0-rc3 #855     Tainted: [W]=WARN RIP: 0010:__run_timer_base.part.0+0x254/0x8a0 Call Trace: <IRQ>     tmigr_handle_remote_up+0x627/0x810 __walk_groups.isra.0+0x47/0x140 tmigr_handle_remote+0x1fa/0x2f0     handle_softirqs+0x180/0x590 irq_exit_rcu+0x84/0xb0 sysvec_apic_timer_interrupt+0x6e/0x90 </IRQ> <TASK>     asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 default_idle_call+0x38/0x60     do_idle+0x2b5/0x300 cpu_startup_entry+0x54/0x60 start_secondary+0x20d/0x280 common_startup_64+0x13e/0x148     </TASK> Modules linked in: [last unloaded: netfs]     ================================================================== Therefore delete     fscache_cookie_lru_timer when removing the fscahe module. (CVE-2024-46786)

  - In the Linux kernel, the following vulnerability has been resolved: NFSD: Limit the number of concurrent     async COPY operations Nothing appears to limit the number of concurrent async COPY operations that clients     can start. In addition, AFAICT each async COPY can copy an unlimited number of 4MB chunks, so can run for     a long time. Thus IMO async COPY can become a DoS vector. Add a restriction mechanism that bounds the     number of concurrent background COPY operations. Start simple and try to be fair -- this patch implements     a per-namespace limit. An async COPY request that occurs while this limit is exceeded gets NFS4ERR_DELAY.
    The requesting client can choose to send the request again after a delay or fall back to a traditional     read/write style copy. If there is need to make the mechanism more sophisticated, we can visit that in     future patches. (CVE-2024-49974)

  - In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: avoid     NFPROTO_UNSPEC where needed syzbot managed to call xt_cluster match via ebtables: WARNING: CPU: 0 PID: 11     at net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780 [..] ebt_do_table+0x174b/0x2a40 Module     registers to NFPROTO_UNSPEC, but it assumes ipv4/ipv6 packet processing. As this is only useful to     restrict locally terminating TCP/UDP traffic, register this for ipv4 and ipv6 family only. Pablo points     out that this is a general issue, direct users of the set/getsockopt interface can call into     targets/matches that were only intended for use with ip(6)tables. Check all UNSPEC matches and targets for     similar issues: - matches and targets are fine except if they assume skb_network_header() is valid -- this     is only true when called from inet layer: ip(6) stack pulls the ip/ipv6 header into linear data area. -     targets that return XT_CONTINUE or other xtables verdicts must be restricted too, they are incompatbile     with the ebtables traverser, e.g. EBT_CONTINUE is a completely different value than XT_CONTINUE. Most     matches/targets are changed to register for NFPROTO_IPV4/IPV6, as they are provided for use by     ip(6)tables. The MARK target is also used by arptables, so register for NFPROTO_ARP too. While at it, bail     out if connbytes fails to enable the corresponding conntrack family. This change passes the selftests in     iptables.git. (CVE-2024-50038)

  - In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/pmc: Fix     pmc_core_iounmap to call iounmap for valid addresses Commit 50c6dbdfd16e (x86/ioremap: Improve iounmap()     address range checks) introduces a WARN when adrress ranges of iounmap are invalid. On Thinkpad P1 Gen 7     (Meteor Lake-P) this caused the following warning to appear: WARNING: CPU: 7 PID: 713 at     arch/x86/mm/ioremap.c:461 iounmap+0x58/0x1f0 Modules linked in: rfkill(+) snd_timer(+) fjes(+) snd     soundcore intel_pmc_core(+) int3403_thermal(+) int340x_thermal_zone intel_vsec pmt_telemetry acpi_pad     pmt_class acpi_tad int3400_thermal acpi_thermal_rel joydev loop nfnetlink zram xe drm_suballoc_helper     nouveau i915 mxm_wmi drm_ttm_helper gpu_sched drm_gpuvm drm_exec drm_buddy i2c_algo_bit crct10dif_pclmul     crc32_pclmul ttm crc32c_intel polyval_clmulni rtsx_pci_sdmmc ucsi_acpi polyval_generic mmc_core     hid_multitouch drm_display_helper ghash_clmulni_intel typec_ucsi nvme sha512_ssse3 video sha256_ssse3     nvme_core intel_vpu sha1_ssse3 rtsx_pci cec typec nvme_auth i2c_hid_acpi i2c_hid wmi pinctrl_meteorlake     serio_raw ip6_tables ip_tables fuse CPU: 7 UID: 0 PID: 713 Comm: (udev-worker) Not tainted     6.12.0-rc2iounmap+ #42 Hardware name: LENOVO 21KWCTO1WW/21KWCTO1WW, BIOS N48ET19W (1.06 ) 07/18/2024 RIP:
    0010:iounmap+0x58/0x1f0 Code: 85 6a 01 00 00 48 8b 05 e6 e2 28 04 48 39 c5 72 19 eb 26 cc cc cc 48 ba 00     00 00 00 00 00 32 00 48 8d 44 02 ff 48 39 c5 72 23 <0f> 0b 48 83 c4 08 5b 5d 41 5c c3 cc cc cc cc 48 ba 00     00 00 00 00 RSP: 0018:ffff888131eff038 EFLAGS: 00010207 RAX: ffffc90000000000 RBX: 0000000000000000 RCX:
    ffff888e33b80000 RDX: dffffc0000000000 RSI: ffff888e33bc29c0 RDI: 0000000000000000 RBP: 0000000000000000     R08: ffff8881598a8000 R09: ffff888e2ccedc10 R10: 0000000000000003 R11: ffffffffb3367634 R12:
    00000000fe000000 R13: ffff888101d0da28 R14: ffffffffc2e437e0 R15: ffff888110b03b28 FS:
    00007f3c1d4b3980(0000) GS:ffff888e33b80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 CR2: 00005651cfc93578 CR3: 0000000124e4c002 CR4: 0000000000f70ef0 DR0: 0000000000000000     DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7:
    0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn.cold+0xb6/0x176 ? iounmap+0x58/0x1f0 ?     report_bug+0x1f4/0x2b0 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x17/0x40 ? asm_exc_invalid_op+0x1a/0x20 ?     iounmap+0x58/0x1f0 pmc_core_ssram_get_pmc+0x477/0x6c0 [intel_pmc_core] ?
    __pfx_pmc_core_ssram_get_pmc+0x10/0x10 [intel_pmc_core] ? __pfx_do_pci_enable_device+0x10/0x10 ?     pci_wait_for_pending+0x60/0x110 ? pci_enable_device_flags+0x1e3/0x2e0 ? __pfx_mtl_core_init+0x10/0x10     [intel_pmc_core] pmc_core_ssram_init+0x7f/0x110 [intel_pmc_core] mtl_core_init+0xda/0x130 [intel_pmc_core]     ? __mutex_init+0xb9/0x130 pmc_core_probe+0x27e/0x10b0 [intel_pmc_core] ? _raw_spin_lock_irqsave+0x96/0xf0     ? __pfx_pmc_core_probe+0x10/0x10 [intel_pmc_core] ? __pfx_mutex_unlock+0x10/0x10 ?
    __pfx_mutex_lock+0x10/0x10 ? device_pm_check_callbacks+0x82/0x370 ? acpi_dev_pm_attach+0x234/0x2b0     platform_probe+0x9f/0x150 really_probe+0x1e0/0x8a0 __driver_probe_device+0x18c/0x370 ?
    __pfx___driver_attach+0x10/0x10 driver_probe_device+0x4a/0x120 __driver_attach+0x190/0x4a0 ?
    __pfx___driver_attach+0x10/0x10 bus_for_each_dev+0x103/0x180 ? __pfx_bus_for_each_dev+0x10/0x10 ?     klist_add_tail+0x136/0x270 bus_add_driver+0x2fc/0x540 driver_register+0x1a5/0x360 ?
    __pfx_pmc_core_driver_init+0x10/0x10 [intel_pmc_core] do_one_initcall+0xa4/0x380 ?
    __pfx_do_one_initcall+0x10/0x10 ? kasan_unpoison+0x44/0x70 do_init_module+0x296/0x800     load_module+0x5090/0x6ce0 ? __pfx_load_module+0x10/0x10 ? ima_post_read_file+0x193/0x200 ?
    __pfx_ima_post_read_file+0x10/0x10 ? rw_verify_area+0x152/0x4c0 ? kernel_read_file+0x257/0x750 ?
    __pfx_kernel_read_file+0x10/0x10 ? __pfx_filemap_get_read_batch+0x10/0x10 ?     init_module_from_file+0xd1/0x130 init_module_from_file+0xd1/0x130 ? __pfx_init_module_from_file+0x10/0
    ---truncated--- (CVE-2024-50107)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the expat-2.5.0-4.el9 build changelog.

  - An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function     because XML_StopParser can stop/suspend an unstarted parser. (CVE-2024-50602)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-527.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix duplicate endpoint bug     by clearing reserved bits in the descriptor Syzbot has identified a bug in usbcore (see the Closes: tag     below) caused by our assumption that the reserved bits in an endpoint descriptor's bEndpointAddress field     will always be 0. As a result of the bug, the endpoint_is_duplicate() routine in config.c (and possibly     other routines as well) may believe that two descriptors are for distinct endpoints, even though they have     the same direction and endpoint number. This can lead to confusion, including the bug identified by syzbot     (two descriptors with matching endpoint numbers and directions, where one was interrupt and the other was     bulk). To fix the bug, we will clear the reserved bits in bEndpointAddress when we parse the descriptor.
    (Note that both the USB-2.0 and USB-3.1 specs say these bits are Reserved, reset to zero.) This requires     us to make a copy of the descriptor earlier in usb_parse_endpoint() and use the copy instead of the     original when checking for duplicates. (CVE-2024-41035)

  - In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on     resume Since commit c49cfa917025 (USB: serial: use generic method if no alternative is provided in usb     serial layer), USB serial core calls the generic resume implementation when the driver has not provided     one. This can trigger a crash on resume with mos7840 since support for multiple read URBs was added back     in 2011. Specifically, both port read URBs are now submitted on resume for open ports, but the context     pointer of the second URB is left set to the core rather than mos7840 port structure. Fix this by     implementing dedicated suspend and resume functions for mos7840. Tested with Delock 87414 USB 2.0 to 4x     serial adapter. [ johan: analyse crash and rewrite commit message; set busy flag on resume; drop bulk-in     check; drop unnecessary usb_kill_urb() ] (CVE-2024-42244)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-516.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: r8169: Fix possible ring buffer     corruption on fragmented Tx packets. An issue was found on the RTL8125b when transmitting small fragmented     packets, whereby invalid entries were inserted into the transmit ring buffer, subsequently leading to     calls to dma_unmap_single() with a null address. This was caused by rtl8169_start_xmit() not noticing     changes to nr_frags which may occur when small packets are padded (to work around hardware quirks) in     rtl8169_tso_csum_v2(). To fix this, postpone inspecting nr_frags until after any padding has been applied.
    (CVE-2024-38586)

  - In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Avoid unnecessary     destruction of file_ida file_ida is allocated during cdev open and is freed accordingly during cdev     release. This sequence is guaranteed by driver file operations. Therefore, there is no need to destroy an     already empty file_ida when the WQ cdev is removed. Worse, ida_free() in cdev release may happen after     destruction of file_ida per WQ cdev. This can lead to accessing an id in file_ida after it has been     destroyed, resulting in a kernel panic. Remove ida_destroy(&file_ida) to address these issues.
    (CVE-2024-38629)

  - In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic in XDP_TX     action In the XDP_TX path, ionic driver sends a packet to the TX path with rx page and corresponding dma     address. After tx is done, ionic_tx_clean() frees that page. But RX ring buffer isn't reset to NULL. So,     it uses a freed page, which causes kernel panic. BUG: unable to handle page fault for address:
    ffff8881576c110c PGD 773801067 P4D 773801067 PUD 87f086067 PMD 87efca067 PTE 800ffffea893e060 Oops: Oops:
    0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN NOPTI CPU: 1 PID: 25 Comm: ksoftirqd/1 Not tainted 6.9.0+ #11     Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 RIP:
    0010:bpf_prog_f0b8caeac1068a55_balancer_ingress+0x3b/0x44f Code: 00 53 41 55 41 56 41 57 b8 01 00 00 00 48     8b 5f 08 4c 8b 77 00 4c 89 f7 48 83 c7 0e 48 39 d8 RSP: 0018:ffff888104e6fa28 EFLAGS: 00010283 RAX:
    0000000000000002 RBX: ffff8881576c1140 RCX: 0000000000000002 RDX: ffffffffc0051f64 RSI: ffffc90002d33048     RDI: ffff8881576c110e RBP: ffff888104e6fa88 R08: 0000000000000000 R09: ffffed1027a04a23 R10:
    0000000000000000 R11: 0000000000000000 R12: ffff8881b03a21a8 R13: ffff8881589f800f R14: ffff8881576c1100     R15: 00000001576c1100 FS: 0000000000000000(0000) GS:ffff88881ae00000(0000) knlGS:0000000000000000 CS: 0010     DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8881576c110c CR3: 0000000767a90000 CR4: 00000000007506f0     PKRU: 55555554 Call Trace: <TASK> ? __die+0x20/0x70 ? page_fault_oops+0x254/0x790 ?
    __pfx_page_fault_oops+0x10/0x10 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ?     search_bpf_extables+0x165/0x260 ? fixup_exception+0x4a/0x970 ? exc_page_fault+0xcb/0xe0 ?     asm_exc_page_fault+0x22/0x30 ? 0xffffffffc0051f64 ? bpf_prog_f0b8caeac1068a55_balancer_ingress+0x3b/0x44f     ? do_raw_spin_unlock+0x54/0x220 ionic_rx_service+0x11ab/0x3010 [ionic     9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ? ionic_tx_clean+0x29b/0xc60 [ionic     9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ? __pfx_ionic_tx_clean+0x10/0x10 [ionic     9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ? __pfx_ionic_rx_service+0x10/0x10 [ionic     9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ? ionic_tx_cq_service+0x25d/0xa00 [ionic     9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ? __pfx_ionic_rx_service+0x10/0x10 [ionic     9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ionic_cq_service+0x69/0x150 [ionic     9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] ionic_txrx_napi+0x11a/0x540 [ionic     9180c3001ab627d82bbc5f3ebe8a0decaf6bb864] __napi_poll.constprop.0+0xa0/0x440 net_rx_action+0x7e7/0xc30 ?
    __pfx_net_rx_action+0x10/0x10 (CVE-2024-40907)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix missing lock on sync     reset reload On sync reset reload work, when remote host updates devlink on reload actions performed on     that host, it misses taking devlink lock before calling devlink_remote_reload_actions_performed() which     results in triggering lock assert like the following: WARNING: CPU: 4 PID: 1164 at net/devlink/core.c:261     devl_assert_locked+0x3e/0x50  CPU: 4 PID: 1164 Comm: kworker/u96:6 Tainted: G S W 6.10.0-rc2+ #116     Hardware name: Supermicro SYS-2028TP-DECTR/X10DRT-PT, BIOS 2.0 12/18/2015 Workqueue: mlx5_fw_reset_events     mlx5_sync_reset_reload_work [mlx5_core] RIP: 0010:devl_assert_locked+0x3e/0x50  Call Trace: <TASK> ?
    __warn+0xa4/0x210 ? devl_assert_locked+0x3e/0x50 ? report_bug+0x160/0x280 ? handle_bug+0x3f/0x80 ?     exc_invalid_op+0x17/0x40 ? asm_exc_invalid_op+0x1a/0x20 ? devl_assert_locked+0x3e/0x50     devlink_notify+0x88/0x2b0 ? mlx5_attach_device+0x20c/0x230 [mlx5_core] ? __pfx_devlink_notify+0x10/0x10 ?     process_one_work+0x4b6/0xbb0 process_one_work+0x4b6/0xbb0 [] (CVE-2024-42268)

  - In the Linux kernel, the following vulnerability has been resolved: tipc: Return non-zero value from     tipc_udp_addr2str() on error tipc_udp_addr2str() should return non-zero value if the UDP media address is     invalid. Otherwise, a buffer overflow access can occur in tipc_media_addr_printf(). Fix this by returning     1 on an invalid UDP media address. (CVE-2024-42284)

  - In the Linux kernel, the following vulnerability has been resolved: dma: fix call order in     dmam_free_coherent dmam_free_coherent() frees a DMA allocation, which makes the freed vaddr available for     reuse, then calls devres_destroy() to remove and free the data structure used to track the DMA allocation.
    Between the two calls, it is possible for a concurrent task to make an allocation with the same vaddr and     add it to the devres list. If this happens, there will be two entries in the devres list with the same     vaddr and devres_destroy() can free the wrong entry, triggering the WARN_ON() in dmam_match. Fix by     destroying the devres entry before freeing the DMA allocation. kokonut //net/encryption     http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03 (CVE-2024-43856)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix CT entry update leaks     of modify header context The cited commit allocates a new modify header to replace the old one when     updating CT entry. But if failed to allocate a new one, eg. exceed the max number firmware can support,     modify header will be an error pointer that will trigger a panic when deallocating it. And the old modify     header point is copied to old attr. When the old attr is freed, the old modify header is lost. Fix it by     restoring the old attr to attr when failed to allocate a new modify header context. So when the CT entry     is freed, the right modify header context will be freed. And the panic of accessing error pointer is also     fixed. (CVE-2024-43864)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Always drain health in     shutdown callback There is no point in recovery during device shutdown. if health work started need to     wait for it to avoid races and NULL pointer access. Hence, drain health WQ on shutdown callback.
    (CVE-2024-43866)

  - In the Linux kernel, the following vulnerability has been resolved: memcg: protect concurrent access to     mem_cgroup_idr Commit 73f576c04b94 (mm: memcontrol: fix cgroup creation failure after many small jobs)     decoupled the memcg IDs from the CSS ID space to fix the cgroup creation failures. It introduced IDR to     maintain the memcg ID space. The IDR depends on external synchronization mechanisms for modifications. For     the mem_cgroup_idr, the idr_alloc() and idr_replace() happen within css callback and thus are protected     through cgroup_mutex from concurrent modifications. However idr_remove() for mem_cgroup_idr was not     protected against concurrency and can be run concurrently for different memcgs when they hit their refcnt     to zero. Fix that. We have been seeing list_lru based kernel crashes at a low frequency in our fleet for a     long time. These crashes were in different part of list_lru code including list_lru_add(), list_lru_del()     and reparenting code. Upon further inspection, it looked like for a given object (dentry and inode), the     super_block's list_lru didn't have list_lru_one for the memcg of that object. The initial suspicions were     either the object is not allocated through kmem_cache_alloc_lru() or somehow memcg_list_lru_alloc() failed     to allocate list_lru_one() for a memcg but returned success. No evidence were found for these cases.
    Looking more deeply, we started seeing situations where valid memcg's id is not present in mem_cgroup_idr     and in some cases multiple valid memcgs have same id and mem_cgroup_idr is pointing to one of them. So,     the most reasonable explanation is that these situations can happen due to race between multiple     idr_remove() calls or race between idr_alloc()/idr_replace() and idr_remove(). These races are causing     multiple memcgs to acquire the same ID and then offlining of one of them would cleanup list_lrus on the     system for all of them. Later access from other memcgs to the list_lru cause crashes due to missing     list_lru_one. (CVE-2024-43892)

  - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix invalid WQ     linked list unlink When all the strides in a WQE have been consumed, the WQE is unlinked from the WQ     linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible to receive CQEs with 0 consumed strides for the     same WQE even after the WQE is fully consumed and unlinked. This triggers an additional unlink for the     same wqe which corrupts the linked list. Fix this scenario by accepting 0 sized consumed strides without     unlinking the WQE again. (CVE-2024-44970)

  - In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix double DMA unmapping for     XDP_REDIRECT Remove the dma_unmap_page_attrs() call in the driver's XDP_REDIRECT code path. This should     have been removed when we let the page pool handle the DMA mapping. This bug causes the warning: WARNING:
    CPU: 7 PID: 59 at drivers/iommu/dma-iommu.c:1198 iommu_dma_unmap_page+0xd5/0x100 CPU: 7 PID: 59 Comm:
    ksoftirqd/7 Tainted: G W 6.8.0-1010-gcp #11-Ubuntu Hardware name: Dell Inc. PowerEdge R7525/0PYVT1, BIOS     2.15.2 04/02/2024 RIP: 0010:iommu_dma_unmap_page+0xd5/0x100 Code: 89 ee 48 89 df e8 cb f2 69 ff 48 83 c4     08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff 45 31 c0 e9 ab 17 71 00 <0f> 0b 48 83 c4 08     5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 RSP: 0018:ffffab1fc0597a48 EFLAGS: 00010246 RAX:
    0000000000000000 RBX: ffff99ff838280c8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000     RDI: 0000000000000000 RBP: ffffab1fc0597a78 R08: 0000000000000002 R09: ffffab1fc0597c1c R10:
    ffffab1fc0597cd3 R11: ffff99ffe375acd8 R12: 00000000e65b9000 R13: 0000000000000050 R14: 0000000000001000     R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffff9a06efb80000(0000) knlGS:0000000000000000 CS: 0010     DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000565c34c37210 CR3: 00000005c7e3e000 CR4: 0000000000350ef0     ? show_regs+0x6d/0x80 ? __warn+0x89/0x150 ? iommu_dma_unmap_page+0xd5/0x100 ? report_bug+0x16a/0x190 ?     handle_bug+0x51/0xa0 ? exc_invalid_op+0x18/0x80 ? iommu_dma_unmap_page+0xd5/0x100 ?     iommu_dma_unmap_page+0x35/0x100 dma_unmap_page_attrs+0x55/0x220 ?     bpf_prog_4d7e87c0d30db711_xdp_dispatcher+0x64/0x9f bnxt_rx_xdp+0x237/0x520 [bnxt_en]     bnxt_rx_pkt+0x640/0xdd0 [bnxt_en] __bnxt_poll_work+0x1a1/0x3d0 [bnxt_en] bnxt_poll+0xaa/0x1e0 [bnxt_en]
    __napi_poll+0x33/0x1e0 net_rx_action+0x18a/0x2f0 (CVE-2024-44984)

  - In the Linux kernel, the following vulnerability has been resolved: KVM: s390: fix validity interception     issue when gisa is switched off We might run into a SIE validity if gisa has been disabled either via     using kernel parameter kvm.use_gisa=0 or by setting the related sysfs attribute to N (echo N     >/sys/module/kvm/parameters/use_gisa). The validity is caused by an invalid value in the SIE control     block's gisa designation. That happens because we pass the uninitialized gisa origin to virt_to_phys()     before writing it to the gisa designation. To fix this we return 0 in kvm_s390_get_gisa_desc() if the     origin is 0. kvm_s390_get_gisa_desc() is used to determine which gisa designation to set in the SIE     control block. A value of 0 in the gisa designation disables gisa usage. The issue surfaces in the host     kernel with the following kernel message as soon a new kvm guest start is attemted. kvm: unhandled     validity intercept 0x1011 WARNING: CPU: 0 PID: 781237 at arch/s390/kvm/intercept.c:101     kvm_handle_sie_intercept+0x42e/0x4d0 [kvm] Modules linked in: vhost_net tap tun xt_CHECKSUM xt_MASQUERADE     xt_conntrack ipt_REJECT xt_tcpudp nft_compat x_tables nf_nat_tftp nf_conntrack_tftp vfio_pci_core     irqbypass vhost_vsock vmw_vsock_virtio_transport_common vsock vhost vhost_iotlb kvm nft_fib_inet     nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct     nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables sunrpc mlx5_ib ib_uverbs     ib_core mlx5_core uvdevice s390_trng eadm_sch vfio_ccw zcrypt_cex4 mdev vfio_iommu_type1 vfio sch_fq_codel     drm i2c_core loop drm_panel_orientation_quirks configfs nfnetlink lcs ctcm fsm dm_service_time ghash_s390     prng chacha_s390 libchacha aes_s390 des_s390 libdes sha3_512_s390 sha3_256_s390 sha512_s390 sha256_s390     sha1_s390 sha_common dm_mirror dm_region_hash dm_log zfcp scsi_transport_fc scsi_dh_rdac scsi_dh_emc     scsi_dh_alua pkey zcrypt dm_multipath rng_core autofs4 [last unloaded: vfio_pci] CPU: 0 PID: 781237 Comm:
    CPU 0/KVM Not tainted 6.10.0-08682-gcad9f11498ea #6 Hardware name: IBM 3931 A01 701 (LPAR) Krnl PSW :
    0704c00180000000 000003d93deb0122 (kvm_handle_sie_intercept+0x432/0x4d0 [kvm]) R:0 T:1 IO:1 EX:1 Key:0 M:1     W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3 Krnl GPRS: 000003d900000027 000003d900000023 0000000000000028     000002cd00000000 000002d063a00900 00000359c6daf708 00000000000bebb5 0000000000001eff 000002cfd82e9000     000002cfd80bc000 0000000000001011 000003d93deda412 000003ff8962df98 000003d93de77ce0 000003d93deb011e     00000359c6daf960 Krnl Code: 000003d93deb0112: c020fffe7259 larl %r2,000003d93de7e5c4 000003d93deb0118:
    c0e53fa8beac brasl %r14,000003d9bd3c7e70 #000003d93deb011e: af000000 mc 0,0 >000003d93deb0122: a728ffea     lhi %r2,-22 000003d93deb0126: a7f4fe24 brc 15,000003d93deafd6e 000003d93deb012a: 9101f0b0 tm 176(%r15),1     000003d93deb012e: a774fe48 brc 7,000003d93deafdbe 000003d93deb0132: 40a0f0ae sth %r10,174(%r15) Call     Trace: [<000003d93deb0122>] kvm_handle_sie_intercept+0x432/0x4d0 [kvm] ([<000003d93deb011e>]     kvm_handle_sie_intercept+0x42e/0x4d0 [kvm]) [<000003d93deacc10>] vcpu_post_run+0x1d0/0x3b0 [kvm]     [<000003d93deaceda>] __vcpu_run+0xea/0x2d0 [kvm] [<000003d93dead9da>] kvm_arch_vcpu_ioctl_run+0x16a/0x430     [kvm] [<000003d93de93ee0>] kvm_vcpu_ioctl+0x190/0x7c0 [kvm] [<000003d9bd728b4e>] vfs_ioctl+0x2e/0x70     [<000003d9bd72a092>] __s390x_sys_ioctl+0xc2/0xd0 [<000003d9be0e9222>] __do_syscall+0x1f2/0x2e0     [<000003d9be0f9a90>] system_call+0x70/0x98 Last Breaking-Event-Address: [<000003d9bd3c7f58>]
    __warn_printk+0xe8/0xf0 (CVE-2024-45005)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0028 advisory.

  - Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R)     Processors may allow an authenticated user to potentially enable denial of service of the host system via     local access. (CVE-2018-12207)

  - TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11135)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:5561 advisory.

  - Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted HTML page. (CVE-2020-16042)

  - Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow     on some video drivers. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR <     78.6. (CVE-2020-26971)

  - Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This     could have been used as a sanitizer bypass. This vulnerability affects Firefox < 84, Thunderbird < 78.6,     and Firefox ESR < 78.6. (CVE-2020-26973)

  - When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly     cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially     exploitable crash. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.
    (CVE-2020-26974)

  - Using techniques that built on the slipstream research, a malicious webpage could have exposed both an     internal network's hosts as well as services running on the user's local machine. This vulnerability     affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. (CVE-2020-26978)

  - When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback     was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening     View Source could have inadvertently leaked their IP address. This vulnerability affects Firefox < 84,     Thunderbird < 78.6, and Firefox ESR < 78.6. (CVE-2020-35111)

  - Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and     Firefox ESR < 78.6. (CVE-2020-35113)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3381 advisory.

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI     controller. (CVE-2021-32399)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1302 advisory.

  - <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe     way on different threads, leading to a use-after-free and potentially exploitable crash. This     vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. (CVE-2022-1097)

  - After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-     after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8 and Firefox     ESR < 91.8. (CVE-2022-1196)

  - When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not     update the existing copy of the key that was not yet revoked, and the existing key was kept as non-     revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation     reason, were unaffected. This vulnerability affects Thunderbird < 91.8. (CVE-2022-1197)

  - regex is an implementation of regular expressions for the Rust language. The regex crate features built-in     mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched     by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This     guarantee is documented and it's considered part of the crate's API. Unfortunately a bug was discovered in     the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing,     and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial     of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted     regexes. All versions of the regex crate before or equal to 1.5.4 are affected by this issue. The fix is     include starting from regex 1.5.5. All users accepting user-controlled regexes are recommended to upgrade     immediately to the latest version of the regex crate. Unfortunately there is no fixed set of problematic     regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability.
    Because of this, it us not recommend to deny known problematic regexes. (CVE-2022-24713)

  - If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to     the parent process, an out of bounds write would have occurred leading to memory corruption and a     potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox     ESR < 91.8. (CVE-2022-28281)

  - By using a link with <code>rel=localization</code> a use-after-free could have been triggered by     destroying an object during JavaScript execution and then referencing the object through a freed pointer,     leading to a potential exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and     Firefox ESR < 91.8. (CVE-2022-28282)

  - When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was     used. In conjunction with another vulnerability this could have been used for an out of bounds memory     read. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.
    (CVE-2022-28285)

  - Due to a layout change, iframe contents could have been rendered outside of its border. This could have     led to user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.8, Firefox < 99,     and Firefox ESR < 91.8. (CVE-2022-28286)

  - Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla     Fuzzing Team reported memory safety bugs present in Thunderbird 91.7. Some of these bugs showed evidence     of memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.
    (CVE-2022-28289)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3548 advisory.

  - The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial     of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain     match field, related to the keyring_search_iterator function in keyring.c. (CVE-2017-2647)

  - A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in     Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly     execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects to an AP.
    (CVE-2019-14896)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4235 advisory.

  - Use after free in payments in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially     perform a sandbox escape via a crafted HTML page. (CVE-2020-15967)

  - Use after free in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-15968)

  - Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-15969)

  - Use after free in NFC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised     the renderer process to potentially perform a sandbox escape via a crafted HTML page. (CVE-2020-15970)

  - Use after free in printing in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-15971)

  - Use after free in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-15972)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 86.0.4240.75 allowed an attacker     who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome     Extension. (CVE-2020-15973)

  - Integer overflow in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to bypass site     isolation via a crafted HTML page. (CVE-2020-15974)

  - Integer overflow in SwiftShader in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-15975)

  - Use after free in WebXR in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-15976)

  - Insufficient data validation in dialogs in Google Chrome on OS X prior to 86.0.4240.75 allowed a remote     attacker to obtain potentially sensitive information from disk via a crafted HTML page. (CVE-2020-15977)

  - Insufficient data validation in navigation in Google Chrome on Android prior to 86.0.4240.75 allowed a     remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted     HTML page. (CVE-2020-15978)

  - Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-15979)

  - Insufficient policy enforcement in Intents in Google Chrome on Android prior to 86.0.4240.75 allowed a     local attacker to bypass navigation restrictions via crafted Intents. (CVE-2020-15980)

  - Out of bounds read in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted HTML page. (CVE-2020-15981)

  - Inappropriate implementation in cache in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to     obtain potentially sensitive information from process memory via a crafted HTML page. (CVE-2020-15982)

  - Insufficient data validation in webUI in Google Chrome on ChromeOS prior to 86.0.4240.75 allowed a local     attacker to bypass content security policy via a crafted HTML page. (CVE-2020-15983)

  - Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 86.0.4240.75 allowed a remote     attacker to spoof the contents of the Omnibox (URL bar) via a crafted URL. (CVE-2020-15984)

  - Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to     spoof security UI via a crafted HTML page. (CVE-2020-15985)

  - Integer overflow in media in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-15986)

  - Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially     exploit heap corruption via a crafted WebRTC stream. (CVE-2020-15987)

  - Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 86.0.4240.75 allowed a     remote attacker who convinced the user to open files to execute arbitrary code via a crafted HTML page.
    (CVE-2020-15988)

  - Uninitialized data in PDFium in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted PDF file. (CVE-2020-15989)

  - Use after free in autofill in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-15990)

  - Use after free in password manager in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-15991)

  - Insufficient policy enforcement in networking in Google Chrome prior to 86.0.4240.75 allowed a remote     attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page.
    (CVE-2020-15992)

  - Inappropriate implementation in networking in Google Chrome prior to 86.0.4240.75 allowed a remote     attacker to perform domain spoofing via a crafted HTML page. (CVE-2020-6557)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0346 advisory.

  - In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects     the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the     QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in     hw/net/net_tx_pkt.c. (CVE-2020-16092)

  - A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service. (CVE-2020-1983)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0354 advisory.

  - Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain     privileges or cause a denial of service by leveraging improper access to a certain error field.
    (CVE-2020-15436)

  - A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN     and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't     correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would     allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this     vulnerability is to data confidentiality. (CVE-2020-1749)

  - A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.
    (CVE-2020-29661)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2516 advisory.

  - An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling     could lead to information disclosure and crashes. This is different from CVE-2020-0093. (CVE-2020-13112)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4163 advisory.

  - Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and     Firefox ESR < 78.3. (CVE-2020-15673)

  - Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove,     resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable     element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.
    (CVE-2020-15676)

  - By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site     displayed in the download file dialog to show the original site (the one suffering from the open redirect)     rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81,     Thunderbird < 78.3, and Firefox ESR < 78.3. (CVE-2020-15677)

  - When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in     a potential use-after-free. This occurs because the function     APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This     vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. (CVE-2020-15678)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2104 advisory.

  - An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an     out of bounds write in the function i2c_smbus_xfer_emulated. (CVE-2017-18551)

  - An issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the function     allocate_trace_buffer in the file kernel/trace/trace.c. (CVE-2017-18595)

  - An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux     kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause     a denial of service (NULL pointer dereference and system crash). (CVE-2019-12614)

  - An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS     partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing     to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack     vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.
    (CVE-2019-15538)

  - In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and     unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list     in fs/ext4/super.c. (CVE-2019-19447)

  - In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB     device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9. (CVE-2019-19524)

  - In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in     kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-     buffer). (CVE-2019-19768)

  - In the Android kernel in i2c driver there is a possible out of bounds write due to memory corruption. This     could lead to local escalation of privilege with System execution privileges needed. User interaction is     not needed for exploitation. (CVE-2019-9454)

  - A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7.
    This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into     the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO     restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate     that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer     dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network     user to crash the system kernel, resulting in a denial of service. (CVE-2020-10711)

  - An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to     a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it,     aka CID-2e90ca68b0d2. (CVE-2020-9383)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3293 advisory.

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2021-2341)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2021-2369)

  - Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is     affected is Java SE: 7u301. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs.
    (CVE-2021-2432)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1209 advisory.

  - In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer     overflow in later code. (CVE-2020-8608)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3439 advisory.

  - A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3715)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:9079 advisory.

  - If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email     contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network     request to the referenced remote URL was performed, regardless of a configuration to block remote content.
    An image loaded from the POSTER attribute was shown in the composer window. These issues could have given     an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033     which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1.
    (CVE-2022-45414)

  - An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary     files via clipboard-related IPC messages.<br>*This bug only affects Thunderbird for Linux. Other operating     systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird <     102.6. (CVE-2022-46872)

  - A file with a long filename could have had its filename truncated to remove the valid extension, leaving a     malicious extension in its place. This could potentially led to user confusion and the execution of     malicious code.<br/>*Note*: This issue was originally included in the advisories for Thunderbird 102.6,     but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird     102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox     ESR < 102.6. (CVE-2022-46874)

  - Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory     safety bugs present in Thunderbird 102.5. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code. This     vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6. (CVE-2022-46878)

  - A missing check related to tex units could have led to a use-after-free and potentially exploitable     crash.<br />*Note*: This advisory was added on December 13th, 2022 after we better understood the impact     of the issue. The fix was included in the original release of Firefox 105. This vulnerability affects     Firefox ESR < 102.6, Firefox < 105, and Thunderbird < 102.6. (CVE-2022-46880)

  - An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a     potentially exploitable crash. *Note*: This advisory was added on December 13th, 2022 after we better     understood the impact of the issue. The fix was included in the original release of Firefox 106. This     vulnerability affects Firefox < 106, Firefox ESR < 102.6, and Thunderbird < 102.6. (CVE-2022-46881)

  - A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability     affects Firefox < 107, Firefox ESR < 102.6, and Thunderbird < 102.6. (CVE-2022-46882)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0336 advisory.

  - Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain     privileges or cause a denial of service by leveraging improper access to a certain error field.
    (CVE-2020-15436)

  - A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system)     functionality was found in the way user create and delete object using NFSv4.2 or newer if both     simultaneously accessing the NFS by the other process that is not using new NFSv4.2. A user with access to     the NFS could use this flaw to starve the resources causing denial of service. (CVE-2020-35513)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2117 advisory.

  - A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to     trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to     the user's system anywhere that the user has permissions. (CVE-2020-10696)

  - The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use     for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG     signature verification. (CVE-2020-8945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2260 advisory.

  - A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16(). (CVE-2018-25011)

  - A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function     WebPDecodeRGBInto is possible due to an invalid check for buffer size. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-36328)

  - A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being     killed too early. The highest threat from this vulnerability is to data confidentiality and integrity as     well as system availability. (CVE-2020-36329)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3304 advisory.

  - Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice     allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the     embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to run arbitrary     gstreamer plugins depending on what plugins are installed on the target system. (CVE-2023-6185)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4730 advisory.

  - An attacker could have sent a message to the parent process where the contents were used to double-index     into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript     executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox <     100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. (CVE-2022-1529)

  - If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution,     they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This     vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and     Thunderbird < 91.9.1. (CVE-2022-1802)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:5164 advisory.

  - In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in     an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR <     78.4.1, and Thunderbird < 78.4.2. (CVE-2020-26950)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5079 advisory.

  - A flaw was found in the Linux kernel's implementation of biovecs in versions before 5.9-rc7. A zero-length     biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a     denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block     device, resulting in a denial of service. The highest threat from this vulnerability is to system     availability. (CVE-2020-25641)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3377 advisory.

  - Heap buffer overflow in background fetch in Google Chrome prior to 84.0.4147.89 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6510)

  - Information leak in content security policy in Google Chrome prior to 84.0.4147.89 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2020-6511)

  - Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6512, CVE-2020-6533)

  - Heap buffer overflow in PDFium in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to     potentially exploit heap corruption via a crafted PDF file. (CVE-2020-6513)

  - Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a     privileged network position to potentially exploit heap corruption via a crafted SCTP stream.
    (CVE-2020-6514)

  - Use after free in tab strip in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6515)

  - Policy bypass in CORS in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-     origin data via a crafted HTML page. (CVE-2020-6516)

  - Heap buffer overflow in history in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6517)

  - Use after free in developer tools in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had     convinced the user to use developer tools to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2020-6518)

  - Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content     security policy via a crafted HTML page. (CVE-2020-6519)

  - Buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6520)

  - Side-channel information leakage in autofill in Google Chrome prior to 84.0.4147.89 allowed a remote     attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
    (CVE-2020-6521)

  - Inappropriate implementation in external protocol handlers in Google Chrome prior to 84.0.4147.89 allowed     a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (CVE-2020-6522)

  - Out of bounds write in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6523)

  - Heap buffer overflow in WebAudio in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6524)

  - Heap buffer overflow in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6525)

  - Inappropriate implementation in iframe sandbox in Google Chrome prior to 84.0.4147.89 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2020-6526)

  - Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to     bypass content security policy via a crafted HTML page. (CVE-2020-6527)

  - Incorrect security UI in basic auth in Google Chrome on iOS prior to 84.0.4147.89 allowed a remote     attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-6528)

  - Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a     privileged network position to leak cross-origin data via a crafted HTML page. (CVE-2020-6529)

  - Out of bounds memory access in developer tools in Google Chrome prior to 84.0.4147.89 allowed an attacker     who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted     Chrome Extension. (CVE-2020-6530)

  - Side-channel information leakage in scroll to text in Google Chrome prior to 84.0.4147.89 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2020-6531)

  - Use after free in SCTP in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6532)

  - Heap buffer overflow in WebRTC in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6534)

  - Insufficient data validation in WebUI in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who     had compromised the renderer process to inject scripts or HTML into a privileged page via a crafted HTML     page. (CVE-2020-6535)

  - Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had     persuaded the user to install a PWA to spoof the contents of the Omnibox (URL bar) via a crafted PWA.
    (CVE-2020-6536)

  - Type confusion in V8 in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to execute     arbitrary code inside a sandbox via a crafted HTML page. (CVE-2020-6537)

  - Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2020-6538)

  - Use after free in CSS in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6539)

  - Buffer overflow in Skia in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6540)

  - Use after free in WebUSB in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6541)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3387 advisory.

  - In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a     length longer than the length of the source or destination array can, in certain specially crafted code     patterns, cause the current method to return prematurely with an undefined return value. This allows     whatever value happens to be in the return register at that time to be used as if it matches the method's     declared return type. (CVE-2019-17639)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported     versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-14577)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and     server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-14578, CVE-2020-14579)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a     person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in takeover     of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code     (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability     does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code     installed by an administrator). (CVE-2020-14583)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported     versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note:
    This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2020-14593)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported     versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This     vulnerability can only be exploited by supplying data to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.
    (CVE-2020-14621)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2590)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2601)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:2145 advisory.

  - runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the     vulnerability, an attacker must be able to create multiple containers with a fairly specific mount     configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.
    (CVE-2021-30465)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0297 advisory.

  - During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected     and evaluated within the encrypted session. This vulnerability affects Thunderbird < 78.7.
    (CVE-2020-15685)

  - When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former,     the service worker could have intercepted the request for the secure page despite the iframe not being a     secure context due to the (insecure) framing. This vulnerability affects Firefox < 84. (CVE-2020-26976)

  - If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-     origin information, when said information is served as chunked data. This vulnerability affects Firefox <     85, Thunderbird < 78.7, and Firefox ESR < 78.7. (CVE-2021-23953)

  - Using the new logical assignment operators in a JavaScript switch statement could have caused a type     confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects     Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. (CVE-2021-23954)

  - Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a     potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox     ESR < 78.7. (CVE-2021-23960)

  - Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and     Firefox ESR < 78.7. (CVE-2021-23964)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1338 advisory.

  - Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-     free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects     Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6819)

  - Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We     are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird <     68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. (CVE-2020-6820)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4351 advisory.

  - Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-15999)

  - Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16000)

  - Use after free in media in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-16001)

  - Use after free in PDFium in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially     exploit heap corruption via a crafted PDF file. (CVE-2020-16002)

  - Use after free in printing in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16003)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:3525 advisory.

  - Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a     response containing data intended for one client may be cached and subsequently sent by the proxy to other     clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other     clients. The severity depends on the application's use of the session and the proxy's behavior regarding     cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a     caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets     `session.permanent = True` 3. The application does not access or modify the session at any point during a     request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a     `Cache-Control` header to indicate that a page is private or should not be cached. This happens because     vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified,     not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue     has been fixed in versions 2.3.2 and 2.2.5. (CVE-2023-30861)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5937 advisory.

  - Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via local access. (CVE-2022-21123)

  - Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125)

  - Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21166)

  - Improper isolation of shared resources in some Intel(R) Processors may allow a privileged user to     potentially enable information disclosure via local access. (CVE-2022-21233)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2068 advisory.

  - The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon     receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover     credentials by sniffing the network. (CVE-2018-18074)

  - urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin     redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the     Authorization header to be exposed to unintended hosts or transmitted in cleartext. (CVE-2018-20060)

  - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the     request parameter. (CVE-2019-11236)

  - The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA     certificates is different from the OS store of CA certificates, which results in SSL connections     succeeding in situations where a verification failure is the correct outcome. This is related to use of     the ssl_context, ca_certs, or ca_certs_dir argument. (CVE-2019-11324)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:1407 advisory.

  - In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of     a record is stored in the length field of a WAL file and no additional validation is done on this data.
    Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the     expense of any RAFT participant trying to decode the WAL. (CVE-2020-15106)

  - In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number     of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read     during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when     reading the entry. (CVE-2020-15112)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5129 advisory.

  - Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as root. (CVE-2020-15862)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2237 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Kerberos). Supported     versions that are affected are Java SE: 7u231, 8u221, 11.0.4 and 13; Java SE Embedded: 8u221. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java     SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2019-2949)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful     attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service     (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the     specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as     through a web service. (CVE-2020-2654)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported     versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-2754, CVE-2020-2755)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-2756, CVE-2020-2757)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java     SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause     a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-2781)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP     Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded:
    8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability can only be exploited by supplying data to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.
    (CVE-2020-2800)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE,     Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2020-2803, CVE-2020-2805)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-2830)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3441 advisory.

  - A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3715)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2881 advisory.

  - If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server     responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected     data. This could have resulted in Thunderbird showing incorrect information, for example the attacker     could have tricked Thunderbird to show folders that didn't exist on the IMAP server. This vulnerability     affects Thunderbird < 78.12. (CVE-2021-29969)

  - A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially     exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability     affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90. (CVE-2021-29970)

  - Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.12,     Firefox ESR < 78.12, and Firefox < 90. (CVE-2021-29976)

  - Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-30547)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0629 advisory.

  - A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for     each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the     X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap     overflow if a bigger value was used. (CVE-2023-6816)

  - An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a     device frozen by a sync grab is reattached to a different master device. This issue may lead to an     application crash, local privilege escalation (if the server runs with extended privileges), or remote     code execution in SSH X11 forwarding environments. (CVE-2024-0229)

  - A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the     allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can     trigger a heap buffer overflow condition, which may lead to an application crash or remote code execution     in SSH X11 forwarding environments. (CVE-2024-21885)

  - A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may     lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding     environments. (CVE-2024-21886)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2082 advisory.

  - An issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the function     allocate_trace_buffer in the file kernel/trace/trace.c. (CVE-2017-18595)

  - In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in     kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-     buffer). (CVE-2019-19768)

  - A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7.
    This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into     the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO     restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate     that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer     dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network     user to crash the system kernel, resulting in a denial of service. (CVE-2020-10711)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0290 advisory.

  - When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former,     the service worker could have intercepted the request for the secure page despite the iframe not being a     secure context due to the (insecure) framing. This vulnerability affects Firefox < 84. (CVE-2020-26976)

  - If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-     origin information, when said information is served as chunked data. This vulnerability affects Firefox <     85, Thunderbird < 78.7, and Firefox ESR < 78.7. (CVE-2021-23953)

  - Using the new logical assignment operators in a JavaScript switch statement could have caused a type     confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects     Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. (CVE-2021-23954)

  - Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a     potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox     ESR < 78.7. (CVE-2021-23960)

  - Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these     bugs showed evidence of memory corruption and we presume that with enough effort some of these could have     been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and     Firefox ESR < 78.7. (CVE-2021-23964)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6119 advisory.

  - The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory     included an incorrect version of podman missing the fix for CVE-2020-8945, which was previously fixed via     RHSA-2020:2117. This issue could possibly be used to crash or cause potential code execution in Go     applications that use the Go GPGME wrapper library, under certain conditions, during GPG signature     verification. (CVE-2022-2738)

  - The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory     included an incorrect version of podman missing the fix for CVE-2020-14370, which was previously fixed via     RHSA-2020:5056. This issue could possibly allow an attacker to gain access to sensitive information stored     in environment variables. (CVE-2022-2739)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4959 advisory.

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Utility). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM     Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. (CVE-2021-35561)

  - In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode     verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to     be invoked using MethodHandles. (CVE-2021-41041)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14,     17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also     be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to     the APIs. (CVE-2022-21434)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14,     17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM     Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also     be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to     the APIs. (CVE-2022-21443)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: JNDI). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2,     18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible     data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by     using APIs in the specified Component, e.g., through a web service which supplies data to the APIs.
    (CVE-2022-21496)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4206 advisory.

  - Heap buffer overflow in storage in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2020-15960)

  - Insufficient policy validation in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker     who convinced a user to install a malicious extension to potentially perform a sandbox escape via a     crafted Chrome Extension. (CVE-2020-15961)

  - Insufficient policy validation in serial in Google Chrome prior to 85.0.4183.121 allowed a remote attacker     to potentially perform out of bounds memory access via a crafted HTML page. (CVE-2020-15962)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker     who convinced a user to install a malicious extension to potentially perform a sandbox escape via a     crafted Chrome Extension. (CVE-2020-15963)

  - Insufficient data validation in media in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-15964)

  - Type confusion in V8 in Google Chrome prior to 85.0.4183.121 allowed a remote attacker to potentially     perform out of bounds memory access via a crafted HTML page. (CVE-2020-15965)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 85.0.4183.121 allowed an attacker     who convinced a user to install a malicious extension to obtain potentially sensitive information via a     crafted Chrome Extension. (CVE-2020-15966)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6711 advisory.

  - When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the     injected element's base instead. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and     Firefox < 105. (CVE-2022-40956)

  - Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially     exploitable crash.<br>*This bug only affects Firefox on ARM64 platforms.*. This vulnerability affects     Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. (CVE-2022-40957)

  - By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a     secure context could set and thus overwrite cookies from a secure context, leading to session fixation and     other attacks. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.
    (CVE-2022-40958)

  - During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a     bypass that leaked device permissions into untrusted subdocuments. This vulnerability affects Firefox ESR     < 102.3, Thunderbird < 102.3, and Firefox < 105. (CVE-2022-40959)

  - Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-     free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird     < 102.3, and Firefox < 105. (CVE-2022-40960)

  - Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla     Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and     Firefox < 105. (CVE-2022-40962)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3388 advisory.

  - In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a     length longer than the length of the source or destination array can, in certain specially crafted code     patterns, cause the current method to return prematurely with an undefined return value. This allows     whatever value happens to be in the return register at that time to be used as if it matches the method's     declared return type. (CVE-2019-17639)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported     versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-14577)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and     server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-14578, CVE-2020-14579)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a     person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in takeover     of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code     (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability     does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code     installed by an administrator). (CVE-2020-14583)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported     versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note:
    This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2020-14593)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported     versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This     vulnerability can only be exploited by supplying data to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.
    (CVE-2020-14621)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2590)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2601)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0699 advisory.

  - A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI     command when Secure Boot is enabled. This flaw allows an attacker with privileged access to craft a     Secondary System Description Table (SSDT) containing code to overwrite the Linux kernel lockdown variable     content directly into memory. The table is further loaded and executed by the kernel, defeating its Secure     Boot lockdown and allowing the attacker to load unsigned code. The highest threat from this vulnerability     is to data confidentiality and integrity, as well as system availability. (CVE-2020-14372)

  - A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a     module used as a dependency without checking if any other dependent module is still loaded leading to a     use-after-free scenario. This could allow arbitrary code to be executed or a bypass of Secure Boot     protections. The highest threat from this vulnerability is to data confidentiality and integrity as well     as system availability. (CVE-2020-25632)

  - A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are     read with very little bounds checking and assumes the USB device is providing sane values. If properly     exploited, an attacker could trigger memory corruption leading to arbitrary code execution allowing a     bypass of the Secure Boot mechanism. The highest threat from this vulnerability is to data confidentiality     and integrity as well as system availability. (CVE-2020-25647)

  - A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied     command line into their corresponding variable contents, using a 1kB stack buffer for temporary storage,     without sufficient bounds checking. If the function is called with a command line that references a     variable with a sufficiently large payload, it is possible to overflow the stack buffer, corrupt the stack     frame and control execution which could also circumvent Secure Boot protections. The highest threat from     this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2020-27749)

  - A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking     allowing an privileged attacker to remove address ranges from memory creating an opportunity to circumvent     SecureBoot protections after proper triage about grub's memory layout. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2020-27779)

  - A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past     the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms     of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2021-20225)

  - A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs     a length calculation on the assumption that expressing a quoted single quote will require 3 characters,     while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each     quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as     well as system availability. (CVE-2021-20233)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:5400 advisory.

  - When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that     is intended to contain just one byte. Depending on processor architecture and stack layout, this leads to     stack corruption that may be exploitable. This vulnerability affects Thunderbird < 78.5.1.
    (CVE-2020-26970)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
211516	CentOS 9 : kernel-5.14.0-529.el9	high
210768	CentOS 9 : expat-2.5.0-4.el9	medium
210767	CentOS 9 : kernel-5.14.0-527.el9	medium
208962	CentOS 9 : kernel-5.14.0-516.el9	high
208653	CentOS 7 : kpatch-patch (RHSA-2020:0028)	medium
208652	CentOS 7 : firefox (RHSA-2020:5561)	high
208651	CentOS 7 : kpatch-patch (RHSA-2021:3381)	high
208650	CentOS 7 : thunderbird (RHSA-2022:1302)	high
208649	CentOS 6 : kernel (RHSA-2020:3548)	critical
208648	CentOS 6 : chromium-browser (RHSA-2020:4235)	high
208647	CentOS 7 : qemu-kvm-ma (RHSA-2021:0346)	medium
208646	CentOS 7 : kernel-alt (RHSA-2021:0354)	high
208645	CentOS 6 : libexif (RHSA-2020:2516)	critical
208644	CentOS 7 : thunderbird (RHSA-2020:4163)	high
208643	CentOS 7 : kernel-alt (RHSA-2020:2104)	high
208642	CentOS 7 : java-1.7.1-ibm (RHSA-2021:3293)	medium
208641	CentOS 7 : qemu-kvm-ma (RHSA-2020:1209)	medium
208640	CentOS 7 : kernel-rt (RHSA-2021:3439)	high
208639	CentOS 7 : thunderbird (RHSA-2022:9079)	critical
208638	CentOS 7 : kernel (RHSA-2021:0336)	medium
208637	CentOS 7 : podman (RHSA-2020:2117)	high
208636	CentOS 7 : libwebp (RHSA-2021:2260)	critical
208635	CentOS 7 : libreoffice (RHSA-2024:3304)	high
208634	CentOS 7 : thunderbird (RHSA-2022:4730)	high
208633	CentOS 6 : thunderbird (RHSA-2020:5164)	high
208632	CentOS 7 : kernel-alt (RHSA-2020:5079)	medium
208631	CentOS 6 : chromium-browser (RHSA-2020:3377)	critical
208630	CentOS 6 : java-1.7.1-ibm (RHSA-2020:3387)	high
208629	CentOS 7 : runc (RHSA-2021:2145)	high
208628	CentOS 7 : thunderbird (RHSA-2021:0297)	high
208627	CentOS 7 : firefox (RHSA-2020:1338)	high
208626	CentOS 6 : chromium-browser (RHSA-2020:4351)	high
208625	CentOS 7 : python-flask (RHSA-2023:3525)	high
208624	CentOS 7 : kernel (RHSA-2022:5937)	medium
208623	CentOS 7 : python-pip (RHSA-2020:2068)	critical
208622	CentOS 7 : etcd (RHSA-2021:1407)	medium
208621	CentOS 6 : net-snmp (RHSA-2020:5129)	medium
208620	CentOS 7 : java-1.8.0-ibm (RHSA-2020:2237)	high
208619	CentOS 7 : kpatch-patch (RHSA-2021:3441)	high
208618	CentOS 7 : thunderbird (RHSA-2021:2881)	high
208617	CentOS 7 : tigervnc (RHSA-2024:0629)	critical
208616	CentOS 7 : kernel (RHSA-2020:2082)	high
208615	CentOS 7 : firefox (RHSA-2021:0290)	high
208614	CentOS 7 : podman (RHSA-2022:6119)	high
208613	CentOS 7 : java-1.8.0-ibm (RHSA-2022:4959)	medium
208612	CentOS 6 : chromium-browser (RHSA-2020:4206)	critical
208611	CentOS 7 : firefox (RHSA-2022:6711)	high
208610	CentOS 7 : java-1.7.1-ibm (RHSA-2020:3388)	high
208609	CentOS 7 : grub2 (RHSA-2021:0699)	high
208608	CentOS 7 : thunderbird (RHSA-2020:5400)	high

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

medium

medium

high

medium

high

high

high

critical

high

medium

high

critical

high

high

medium

medium

high

critical

medium

high

critical

high

high

high

medium

critical

high

high

high

high

high

high

medium

critical

medium

medium

high

high

high

critical

high

high

high

medium

critical

high

high

high

high