The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libssh-0.10.4-10.el9 build changelog.

  - A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may     allow an authenticated client to cause a denial of service. (CVE-2023-1667)

  - A vulnerability was found in libssh, where the authentication check of the connecting client can be     bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen     if there is insufficient memory or the memory usage is limited. The problem is caused by the return value     `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call     `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the     cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
    (CVE-2023-2283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the zsh-5.8-9.el9 build changelog.

  - In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the     prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.
    (CVE-2021-45444)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the cups-2.3.3op2-19.el9 build changelog.

  - heap buffer overflow may lead to DoS (CVE-2023-32324)

  - use-after-free in cupsdAcceptClient() in scheduler/client.c (CVE-2023-34241)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the httpd-2.4.53-11.el9 build changelog.

  - out-of-bounds read/write of zero byte (CVE-2006-20001)

  - Possible request smuggling (CVE-2022-36760)

  - HTTP response splitting (CVE-2022-37436)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ncurses-6.2-9.20210508.el9 build changelog.

  - ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-     relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo     or reached via the TERMINFO or TERM environment variable. (CVE-2023-29491)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the yajl-2.1.0-21.el9 build changelog.

  - yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x     branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing     with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit     integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a     reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x     branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this     does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent     population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory     corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for     arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version     1.4.2. As a workaround, avoid passing large inputs to YAJL. (CVE-2022-24795)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-350.el9 build changelog.

  - The Linux kernel allows userspace processes to enable mitigations by calling prctl with     PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed     that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to     attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be     observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened     because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that     STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection.
    However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons,     which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target     injection against which STIBP protects. (CVE-2023-1998)

  - An issue in Zen 2 CPUs, under specific microarchitectural circumstances, may allow an attacker to     potentially access sensitive information. (CVE-2023-20593)

  - A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the     Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading     to a kernel information leak. (CVE-2023-3141)

  - An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in     kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel     internal information. (CVE-2023-3268)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the curl-7.76.1-23.el9 build changelog.

  - An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the     chained HTTP compression algorithms, meaning that a server response can be compressed multiple times and     potentially with differentalgorithms. The number of acceptable links in this decompression chain     wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a     virtually unlimited number of compression steps simply byusing many headers. The use of such a     decompression chain could result in a malloc bomb, making curl end up spending enormous amounts of     allocated heap memory, or trying to and returning out of memory errors. (CVE-2023-23916)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libreoffice-7.1.8.1-11.el9 build changelog.

  - Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation     LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow     when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as     AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected,     leading to an array index underflow, in which case there is a risk that arbitrary code could be executed.
    This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.6; 7.5 versions prior to     7.5.1. (CVE-2023-0950)

  - Arbitrary File Write (CVE-2023-1183)

  - Remote documents loaded without prompt via IFrame (CVE-2023-2255)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libtiff-4.4.0-7.el9 build changelog.

  - Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to     trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into     application crash, potential information disclosure or any other context-dependent impact (CVE-2022-3570)

  - LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from     extractImageSection, tools/tiffcrop.c:6826, allowing attackers to cause a denial-of-service via a crafted     tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
    (CVE-2022-3597)

  - LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604,     allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff     from sources, the fix is available with commit cfbb883b. (CVE-2022-3598)

  - LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit e8131125. (CVE-2022-3599)

  - LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from     processCropSelections, tools/tiffcrop.c:7619, allowing attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
    (CVE-2022-3626)

  - LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from     extractImageSection, tools/tiffcrop.c:6860, allowing attackers to cause a denial-of-service via a crafted     tiff file. For users that compile libtiff from sources, the fix is available with commit 236b7191.
    (CVE-2022-3627)

  - A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function     TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is     possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
    The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to     fix this issue. The identifier VDB-213549 was assigned to this vulnerability. (CVE-2022-3970)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libtiff-4.4.0-2.el9 build changelog.

  - Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in     tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF     file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
    (CVE-2022-0561)

  - Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c     in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users     that compile libtiff from sources, a fix is available with commit 561599c. (CVE-2022-0562)

  - Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted     tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045.
    (CVE-2022-0865)

  - A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0     allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could     result into application crash, potential information disclosure or any other context-dependent impact     (CVE-2022-0891)

  - Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in     tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
    (CVE-2022-0908)

  - Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa.
    (CVE-2022-0909)

  - Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 408976c4.
    (CVE-2022-0924)

  - A heap buffer overflow flaw was found in Libtiffs' tiffinfo.c in TIFFReadRawDataStriped() function. This     flaw allows an attacker to pass a crafted TIFF file to the tiffinfo tool, triggering a heap buffer     overflow issue and causing a crash that leads to a denial of service. (CVE-2022-1354)

  - A stack buffer overflow flaw was found in Libtiffs' tiffcp.c in main() function. This flaw allows an     attacker to pass a crafted TIFF file to the tiffcp tool, triggering a stack buffer overflow issue,     possibly corrupting the memory, and causing a crash that leads to a denial of service. (CVE-2022-1355)

  - LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a     custom tag and 0x0200 as the second word of the DE field. (CVE-2022-22844)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the dpdk-21.11.1-1.el9 build changelog.

  - A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate     `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using     DPDK vhost library may crash as a result of this vulnerability. (CVE-2021-3839)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libxml2-2.9.12-4.el9 build changelog.

  - xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
    (CVE-2019-20388)

  - GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at     libxml2/entities.c. The issue has been fixed in commit 50f06b3e. (CVE-2020-24977)

  - xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file     situation. (CVE-2020-7595)

  - There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted     file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to     confidentiality, integrity, and availability. (CVE-2021-3516)

  - There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker     who is able to supply a crafted file to be processed by an application linked with the affected     functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to     application availability, with some potential impact to confidentiality and integrity if an attacker is     able to use memory information to further exploit the application. (CVE-2021-3517)

  - There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to     be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact     from this flaw is to confidentiality, integrity, and availability. (CVE-2021-3518)

  - A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while     parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery     mode and post-validated, the flaw could be used to crash the application. The highest threat from this     vulnerability is to system availability. (CVE-2021-3537)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the vim-8.2.2637-14.el9 build changelog.

  - Stack-based Buffer Overflow in vim prior to 8.2 (CVE-2022-0629)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python- wheel-0.36.2-8.el9 build changelog.

  - An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers     to cause a denial of service via attacker controlled input to wheel cli. (CVE-2022-40898)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libjpeg- turbo-2.0.90-5.el9 build changelog.

  - Out of bounds read in libjpeg-turbo in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-37972)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the haproxy-2.4.22-1.el9 build changelog.

  - An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before     2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the     connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to     configured FastCGI backends in an unexpected way. (CVE-2023-0836)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the open-vm- tools-12.2.5-2.el9 build changelog.

  - SAML token signature bypass [rhel-9]) (CVE-2023-20900)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openblas-0.3.15-3.el9 build changelog.

  - An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through     version 3.10.0, as also used in OpenBLAS before version 0.3.18. Specially crafted inputs passed to these     functions could cause an application using lapack to crash or possibly disclose portions of its memory.
    (CVE-2021-4048)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the haproxy-2.4.7-1.el9 build changelog.

  - An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not     ensure that the scheme and path portions of a URI have the expected characters. For example, the authority     field (as observed on a target HTTP/2 server) might differ from what the routing rules were intended to     achieve. (CVE-2021-39240)

  - An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before     2.4.3. An HTTP method name may contain a space followed by the name of a protected resource. It is     possible that a server would interpret this as a request for that protected resource, such as in the GET     /admin? HTTP/1.1 /static/images HTTP/1.1 example. (CVE-2021-39241)

  - An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead     to a situation with an attacker-controlled HTTP Host header, because a mismatch between Host and authority     is mishandled. (CVE-2021-39242)

  - An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform     an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs     and possibly other ACLs. (CVE-2021-40346)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0957 advisory.

  - When storing and re-accessing data on a networking channel, the length of buffers may have been confused,     resulting in an out-of-bounds memory read. This vulnerability affects Firefox < 123, Firefox ESR < 115.8,     and Thunderbird < 115.8. (CVE-2024-1546)

  - Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed     on another website (with the victim website's URL shown). This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1547)

  - A website could have obscured the fullscreen notification by using a dropdown select input element. This     could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1548)

  - If a website set a large custom cursor, portions of the cursor could have overlapped with the permission     dialog, potentially resulting in user confusion and unexpected granted permissions. This vulnerability     affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1549)

  - A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to     cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and     inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1550)

  - Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker     could control the Content-Type response header, as well as control part of the response body, they could     inject Set-Cookie response headers that would have been honored by the browser. This vulnerability affects     Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1551)

  - Incorrect code generation could have led to unexpected numeric conversions and potential undefined     behavior.*Note:* This issue only affects 32-bit ARM devices. This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1552)

  - Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and     Thunderbird < 115.8. (CVE-2024-1553)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0976 advisory.

  - When storing and re-accessing data on a networking channel, the length of buffers may have been confused,     resulting in an out-of-bounds memory read. This vulnerability affects Firefox < 123, Firefox ESR < 115.8,     and Thunderbird < 115.8. (CVE-2024-1546)

  - Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed     on another website (with the victim website's URL shown). This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1547)

  - A website could have obscured the fullscreen notification by using a dropdown select input element. This     could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1548)

  - If a website set a large custom cursor, portions of the cursor could have overlapped with the permission     dialog, potentially resulting in user confusion and unexpected granted permissions. This vulnerability     affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1549)

  - A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to     cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and     inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1550)

  - Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker     could control the Content-Type response header, as well as control part of the response body, they could     inject Set-Cookie response headers that would have been honored by the browser. This vulnerability affects     Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1551)

  - Incorrect code generation could have led to unexpected numeric conversions and potential undefined     behavior.*Note:* This issue only affects 32-bit ARM devices. This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1552)

  - Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and     Thunderbird < 115.8. (CVE-2024-1553)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:0967 advisory.

  - A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-     channel resistant. This issue may result in the potential leak of private data. (CVE-2023-5992)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0965 advisory.

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:0811 advisory.

  - Sudo before 1.9.13 does not escape control characters in log messages. (CVE-2023-28486)

  - Sudo before 1.9.13 does not escape control characters in sudoreplay output. (CVE-2023-28487)

  - Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation)     because application logic sometimes is based on not equaling an error value (instead of equaling a success     value), and because the values do not resist flips of a single bit. (CVE-2023-42465)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0879 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf; Oracle     GraalVM Enterprise Edition: 20.3.11 and 21.3.7. Easily exploitable vulnerability allows unauthenticated     attacker with network access via CORBA to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can     only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web     Start applications or Untrusted Java applets, such as through a web service. (CVE-2023-22067)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u381,     8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition:
    20.3.11, 21.3.7 and 22.3.3. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of     service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note:
    This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2023-22081)

  - In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or     a segmentation fault if a shutdown signal (SIGTERM, SIGINT or SIGHUP) is received before the JVM has     finished initializing. (CVE-2023-5676)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:0893 advisory.

  - Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a     different vulnerability than CVE-2022-22817 (which was about the expression parameter). (CVE-2023-50447)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:0888 advisory.

  - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary:
    Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key     or DH parameters may experience long delays. Where the key or parameters that are being checked have been     obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs     various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too     large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is     over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or     parameters that have been supplied. Some of those checks use the supplied modulus value even if it has     already been found to be too large. An application that calls DH_check() and supplies a key or parameters     obtained from an untrusted source could be vulernable to a Denial of Service attack. The function     DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those     other functions may similarly be affected. The other functions affected by this are DH_check_ex() and     EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications     when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The     OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. (CVE-2023-3446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:0608 advisory.

  - An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially     exploitable crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.
    (CVE-2024-0741)

  - It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by     the user due to an incorrect timestamp used to prevent input after page load. This vulnerability affects     Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. (CVE-2024-0742)

  - A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability     affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. (CVE-2024-0746)

  - When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy     could have overridden the child Content Security Policy. This vulnerability affects Firefox < 122, Firefox     ESR < 115.7, and Thunderbird < 115.7. (CVE-2024-0747)

  - A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin     in the address bar. This vulnerability affects Firefox < 122 and Thunderbird < 115.7. (CVE-2024-0749)

  - A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user     into granting permissions. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird     < 115.7. (CVE-2024-0750)

  - A malicious devtools extension could have been used to escalate privileges. This vulnerability affects     Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. (CVE-2024-0751)

  - In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability     affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. (CVE-2024-0753)

  - Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and     Thunderbird < 115.7. (CVE-2024-0755)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:0609 advisory.

  - An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially     exploitable crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.
    (CVE-2024-0741)

  - It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by     the user due to an incorrect timestamp used to prevent input after page load. This vulnerability affects     Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. (CVE-2024-0742)

  - A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability     affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. (CVE-2024-0746)

  - When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy     could have overridden the child Content Security Policy. This vulnerability affects Firefox < 122, Firefox     ESR < 115.7, and Thunderbird < 115.7. (CVE-2024-0747)

  - A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin     in the address bar. This vulnerability affects Firefox < 122 and Thunderbird < 115.7. (CVE-2024-0749)

  - A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user     into granting permissions. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird     < 115.7. (CVE-2024-0750)

  - A malicious devtools extension could have been used to escalate privileges. This vulnerability affects     Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. (CVE-2024-0751)

  - In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability     affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. (CVE-2024-0753)

  - Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and     Thunderbird < 115.7. (CVE-2024-0755)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:0786 advisory.

  - Multiple NSS NIST curves were susceptible to a side-channel attack known as Minerva. This attack could     potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121.
    (CVE-2023-6135)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:0768 advisory.

  - libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.
    (CVE-2020-28241)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0753 advisory.

  - Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a     malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of     guest virtual machine (VM) memory integrity. (CVE-2023-20592)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:0116 advisory.

  - GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects     asn1_encode_simple_der. (CVE-2021-46848)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:7207 advisory.

  - Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in     ares_parse_soa_reply.c. (CVE-2020-22217)

  - c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for     certain ipv6 addresses, in particular 0::00:00:00/2 was found to cause an issue. C-ares only uses this     function internally for configuration purposes which would require an administrator to configure such an     address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes     and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. (CVE-2023-31130)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:0835 advisory.

  - Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of     service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of     Service (ReDoS) in package_index.py. (CVE-2022-40897)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:5455 advisory.

  - A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and     the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048     bytes can potentially disclose stack contents through the function returned address data, and may cause a     crash. (CVE-2023-4527)

  - A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that     has been freed, resulting in an application crash. This issue is only exploitable when a NSS module     implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the
    _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the     call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and     AI_V4MAPPED as flags. (CVE-2023-4806)

  - A flaw was found in glibc. In an uncommon situation, the gaih_inet function may use memory that has been     freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is     called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.
    (CVE-2023-4813)

  - A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the     GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted     GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with     elevated privileges. (CVE-2023-4911)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:3425 advisory.

  - cups-filters contains backends, filters, and other software required to get the cups printing service     working on operating systems other than macos. If you use the Backend Error Handler (beh) to create an     accessible network printer, this security vulnerability can cause remote code execution. `beh.c` contains     the line `retval = system(cmdline) >> 8;` which calls the `system` command with the operand `cmdline`.
    `cmdline` contains multiple user controlled, unsanitized values. As a result an attacker with network     access to the hosted print server can exploit this vulnerability to inject system commands which are     executed in the context of the running server. This issue has been addressed in commit `8f2740357` and is     expected to be bundled in the next release. Users are advised to upgrade when possible and to restrict     access to network printers in the meantime. (CVE-2023-24805)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:3106 advisory.

  - An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that     can result in wrong credentials being used during subsequent transfers. Previously created connections are     kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as     CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not     included in the configuration match checks, causing them to match too easily. This could lead to libcurl     using the wrong credentials when performing a transfer, potentially allowing unauthorized access to     sensitive information. (CVE-2023-27535)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:5252 advisory.

  - Dmidecode before 3.5 allows -dump-bin to overwrite a local file. This has security relevance because, for     example, execution of Dmidecode via Sudo is plausible. (CVE-2023-30630)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:5433 advisory.

  - During the worker lifecycle, a use-after-free condition could have occured, which could have led to a     potentially exploitable crash. This vulnerability affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and     Thunderbird < 115.0.1. (CVE-2023-3600)

  - A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-     of-bounds write, leading to a potentially exploitable crash in a privileged process. This vulnerability     affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5169)

  - During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing     an attacker to write two NUL bytes, and cause a potentially exploitable crash. This vulnerability affects     Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3. (CVE-2023-5171)

  - Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and     Thunderbird < 115.3. (CVE-2023-5176)

  - Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1     allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium     security severity: High) (CVE-2023-5217)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:3246 advisory.

  - Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2,     2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its     local clone optimization even when using a non-local transport. Though Git will abort local clones whose     source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a     symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's     filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar     manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5     v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term     workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`.
    Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git     submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it     does not contain suspicious module URLs. (CVE-2023-22490)

  - Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6,     2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a     path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been     prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6,     v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid     applying one that creates a symbolic link and then creates a file beyond the symbolic link.
    (CVE-2023-23946)

  - Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8,     2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a     path outside the working tree can be overwritten with partially controlled contents (corresponding to the     rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8,     2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with     `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch     before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file     exists. (CVE-2023-25652)

  - In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a     consequence, Git is expected not to localize messages at all, and skips the gettext initialization.
    However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer     uses the runtime prefix but uses the hard-coded path `C:\mingw64\share\locale` to look for localized     messages. And since any authenticated user has the permission to create folders in `C:\` (and since     `C:\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in     that location where `git.exe` will pick them up in version 2.40.1. This vulnerability is relatively hard     to exploit and requires social engineering. For example, a legitimate message at the end of a clone could     be maliciously modified to ask the user to direct their web browser to a malicious website, and the user     might think that the message comes from Git and is legitimate. It does require local write access by the     attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this     issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or     alternatively create a `C:\mingw64` folder and leave it empty. Users who have administrative rights may     remove the permission to create folders in `C:\`. (CVE-2023-25815)

  - Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8,     2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs     that are longer than 1024 characters can used to exploit a bug in     `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary     configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section     associated with that submodule. When the attacker injects configuration values which specify executables     to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code     execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6,     2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted     repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`. (CVE-2023-29007)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:5184 advisory.

  - Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a     remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security     severity: Critical) (CVE-2023-4863)

  - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate of     CVE-2023-4863. (CVE-2023-5129)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:1252 advisory.

  - An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory     writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110,     Thunderbird < 102.8, and Firefox ESR < 102.8. (CVE-2023-0767)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:4520 advisory.

  - Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to     destination servers when redirected to an HTTPS endpoint. This is a product of how we use     `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent     through the tunnel, the proxy will identify the header in the request itself and remove it prior to     forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must     be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in     Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious     actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.
    (CVE-2023-32681)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:4202 advisory.

  - A memory corruption issue was addressed with improved state management. This issue is fixed in macOS     Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content     may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively     exploited against versions of iOS released before iOS 15.7. (CVE-2023-32435)

  - A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS     16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted     web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been     actively exploited. (CVE-2023-32439)

  - The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari     16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code     execution. Apple is aware of a report that this issue may have been actively exploited. (CVE-2023-37450)

  - The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web     content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been     actively exploited against versions of iOS before iOS 16.7. (CVE-2023-41993)

  - A type confusion issue was addressed with improved checks. This issue is fixed in tvOS 17.3, iOS 17.3 and     iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, Safari 17.3, macOS Ventura 13.6.4, macOS     Monterey 12.7.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is     aware of a report that this issue may have been exploited. (CVE-2024-23222)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:3827 advisory.

  - processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g.,     WRITE of size 307203) via a crafted TIFF image. (CVE-2022-48281)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:3661 advisory.

  - LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from     an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also     affects TeX Live before 2023 r66984 and MiKTeX before 23.5. (CVE-2023-32700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:0379 advisory.

  - libXpm: Runaway loop on width of 0 and enormous height (CVE-2022-44617)

  - libXpm: Infinite loop on unclosed comments (CVE-2022-46285)

  - libXpm: compression commands depend on $PATH (CVE-2022-4883)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2023:6194 advisory.

  - VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. (CVE-2023-44488)

  - It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by     the user due to an insufficient activation-delay. This vulnerability affects Firefox < 119, Firefox ESR <     115.4, and Thunderbird < 115.4.1. (CVE-2023-5721)

  - Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led     to a crash. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.
    (CVE-2023-5724)

  - A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be     leveraged to collect sensitive user data. This vulnerability affects Firefox < 119, Firefox ESR < 115.4,     and Thunderbird < 115.4.1. (CVE-2023-5725)

  - During garbage collection extra operations were performed on a object that should not be. This could have     led to a potentially exploitable crash. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and     Thunderbird < 115.4.1. (CVE-2023-5728)

  - Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and     Thunderbird < 115.4.1. (CVE-2023-5730)

  - An attacker could have created a malicious link using bidirectional characters to spoof the location in     the address bar when visited. This vulnerability affects Firefox < 117, Firefox ESR < 115.4, and     Thunderbird < 115.4.1. (CVE-2023-5732)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
191165	CentOS 9 : libssh-0.10.4-10.el9	medium
191164	CentOS 9 : zsh-5.8-9.el9	high
191163	CentOS 9 : cups-2.3.3op2-19.el9	high
191162	CentOS 9 : httpd-2.4.53-11.el9	critical
191161	CentOS 9 : ncurses-6.2-9.20210508.el9	high
191160	CentOS 9 : yajl-2.1.0-21.el9	high
191159	CentOS 9 : kernel-5.14.0-350.el9	high
191158	CentOS 9 : curl-7.76.1-23.el9	medium
191157	CentOS 9 : libreoffice-7.1.8.1-11.el9	high
191156	CentOS 9 : libtiff-4.4.0-7.el9	high
191155	CentOS 9 : libtiff-4.4.0-2.el9	high
191154	CentOS 9 : dpdk-21.11.1-1.el9	high
191152	CentOS 9 : libxml2-2.9.12-4.el9	high
191151	CentOS 9 : vim-8.2.2637-14.el9	high
191150	CentOS 9 : python-wheel-0.36.2-8.el9	high
191149	CentOS 9 : libjpeg-turbo-2.0.90-5.el9	high
191148	CentOS 9 : haproxy-2.4.22-1.el9	high
191147	CentOS 9 : open-vm-tools-12.2.5-2.el9	high
191146	CentOS 9 : openblas-0.3.15-3.el9	critical
191145	CentOS 9 : haproxy-2.4.7-1.el9	high
191124	CentOS 7 : thunderbird (RHSA-2024:0957)	high
190992	CentOS 7 : firefox (RHSA-2024:0976)	high
190970	CentOS 8 : opensc (CESA-2024:0967)	medium
190969	CentOS 8 : unbound (CESA-2024:0965)	high
190850	CentOS 8 : sudo (CESA-2024:0811)	high
190776	CentOS 7 : java-1.8.0-ibm (RHSA-2024:0879)	medium
190775	CentOS 8 : python-pillow (CESA-2024:0893)	high
190774	CentOS 8 : edk2 (CESA-2024:0888)	medium
190446	CentOS 8 : firefox (CESA-2024:0608)	high
190445	CentOS 8 : thunderbird (CESA-2024:0609)	high
190407	CentOS 8 : nss (CESA-2024:0786)	medium
190396	CentOS 8 : libmaxminddb (CESA-2024:0768)	medium
190366	CentOS 7 : linux-firmware (RHSA-2024:0753)	medium
190218	CentOS 8 : libtasn1 (CESA-2023:0116)	critical
190217	CentOS 8 : c-ares (CESA-2023:7207)	medium
190216	CentOS 8 : python-setuptools (CESA-2023:0835)	medium
190215	CentOS 8 : glibc (CESA-2023:5455)	high
190214	CentOS 8 : cups-filters (CESA-2023:3425)	high
190213	CentOS 8 : curl (CESA-2023:3106)	medium
190212	CentOS 8 : dmidecode (CESA-2023:5252)	high
190211	CentOS 8 : firefox (CESA-2023:5433)	critical
190210	CentOS 8 : git (CESA-2023:3246)	high
190209	CentOS 8 : firefox (CESA-2023:5184)	high
190208	CentOS 8 : nss (CESA-2023:1252)	high
190207	CentOS 8 : python-requests (CESA-2023:4520)	medium
190206	CentOS 8 : webkit2gtk3 (CESA-2023:4202)	high
190205	CentOS 8 : libtiff (CESA-2023:3827)	medium
190204	CentOS 8 : texlive (CESA-2023:3661)	high
190203	CentOS 8 : libXpm (CESA-2023:0379)	high
190202	CentOS 8 : thunderbird (CESA-2023:6194)	critical

Detections

Analytics

CentOS Local Security Checks Family for Nessus

medium

high

high

critical

high

high

high

medium

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

medium

high

high

medium

high

medium

high

high

medium

medium

medium

critical

medium

medium

high

high

medium

high

critical

high

high

high

medium

high

medium

high

high

critical