The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the curl-7.76.1-31.el9 build changelog.

  - When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers     for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting,     libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.
    Further, this error condition fails silently and is therefore not easily detected by an application.
    (CVE-2024-2398)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.19-8.el9 build changelog.

  - There is a HIGH severity vulnerability affecting the CPython zipfile module affecting zipfile.Path.
    Note that the more common API zipfile.ZipFile class is unaffected. When iterating over names of entries     in a zip archive (for example, methods of zipfile.Path like namelist(), iterdir(), etc) the process     can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading     only metadata or extracting the contents of the zip archive. Programs that are not handling user-     controlled zip archives are not affected. (CVE-2024-8088)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:5294 advisory.

  - latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a     large p2c (aka PBES2 Count) value. (CVE-2023-50967)

  - jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens     (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS),     and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces,     specifically related to the support for decompressing plaintext after its decryption. Under certain     conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory     during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
    (CVE-2024-28176)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.19-7.el9 build changelog.

  - There is a MEDIUM severity vulnerability affecting CPython. The email module didn't properly quote     newlines for email headers when serializing an email message allowing for header injection when an email     is serialized. (CVE-2024-6923)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python- setuptools-53.0.0-13.el9 build changelog.

  - A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote     code execution via its download functions. These functions, which are used to download packages from URLs     provided by users or retrieved from package index servers, are susceptible to code injection. If these     functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands     on the system. The issue is fixed in version 70.0. (CVE-2024-6345)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3980 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in     versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute     arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be     given a command to run in the specified Flatpak app, optionally along with some arguments. However it is     possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an     arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from     within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect     of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to     pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since     bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-     desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create     .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9,     1.12.9, and 1.14.6. (CVE-2024-32462)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3939 advisory.

  - Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a     privileged user to potentially enable escalation of privilege via local access. (CVE-2022-27635,     CVE-2022-40964)

  - Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an     unauthenticated user to potentially enable denial of service via adjacent access. (CVE-2022-36351)

  - Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an     authenticated user to potentially enable escalation of privilege via local access. (CVE-2022-38076)

  - Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user     to potentially enable escalation of privilege via local access. (CVE-2022-46329)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:3669 advisory.

  - less through 653 allows OS command execution via a newline character in the name of a file, because     quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file     names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN     environment variable, but this is set by default in many common cases. (CVE-2024-32487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0857 advisory.

  - Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a     different vulnerability than CVE-2022-22817 (which was about the expression parameter). (CVE-2023-50447)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.19-4.el9 build changelog.

  - The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were     designated as globally reachable or private. This affected the is_private and is_global properties of     the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network     classes, where values wouldn't be returned in accordance with the latest information from the IANA     Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these     registries and thus have the intended behavior. (CVE-2024-4032)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-479.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_netdev_start(): fix     UAF for rx_kref of j1939_priv It will trigger UAF for rx_kref of j1939_priv as following. cpu0 cpu1     j1939_sk_bind(socket0, ndev0, ...) j1939_netdev_start j1939_sk_bind(socket1, ndev0, ...)     j1939_netdev_start j1939_priv_set j1939_priv_get_by_ndev_locked j1939_jsk_add ..... j1939_netdev_stop     kref_put_lock(&priv->rx_kref, ...) kref_get(&priv->rx_kref, ...) REFCOUNT_WARN(addition on 0;...)     ==================================================== refcount_t: addition on 0; use-after-free. WARNING:
    CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 RIP:
    0010:refcount_warn_saturate+0x169/0x1e0 Call Trace: j1939_netdev_start+0x68b/0x920     j1939_sk_bind+0x426/0xeb0 ? security_socket_bind+0x83/0xb0 The rx_kref's kref_get() and kref_put() should     use j1939_netdev_lock to protect. (CVE-2021-47459)

  - In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix mirred deadlock on     device recursion When the mirred action is used on a classful egress qdisc and a packet is mirrored or     redirected to self we hit a qdisc lock deadlock. See trace below. [..... other info removed for     brevity....] [ 82.890906] [ 82.890906] ============================================ [ 82.890906] WARNING:
    possible recursive locking detected [ 82.890906] 6.8.0-05205-g77fadd89fe2d-dirty #213 Tainted: G W [     82.890906] -------------------------------------------- [ 82.890906] ping/418 is trying to acquire lock: [     82.890906] ffff888006994110 (&sch->q.lock){+.-.}-{3:3}, at: __dev_queue_xmit+0x1778/0x3550 [ 82.890906] [     82.890906] but task is already holding lock: [ 82.890906] ffff888006994110 (&sch->q.lock){+.-.}-{3:3}, at:
    __dev_queue_xmit+0x1778/0x3550 [ 82.890906] [ 82.890906] other info that might help us debug this: [     82.890906] Possible unsafe locking scenario: [ 82.890906] [ 82.890906] CPU0 [ 82.890906] ---- [ 82.890906]     lock(&sch->q.lock); [ 82.890906] lock(&sch->q.lock); [ 82.890906] [ 82.890906] *** DEADLOCK *** [     82.890906] [..... other info removed for brevity....] Example setup (eth0->eth0) to recreate tc qdisc add     dev eth0 root handle 1: htb default 30 tc filter add dev eth0 handle 1: protocol ip prio 2 matchall \     action mirred egress redirect dev eth0 Another example(eth0->eth1->eth0) to recreate tc qdisc add dev eth0     root handle 1: htb default 30 tc filter add dev eth0 handle 1: protocol ip prio 2 matchall \ action mirred     egress redirect dev eth1 tc qdisc add dev eth1 root handle 1: htb default 30 tc filter add dev eth1 handle     1: protocol ip prio 2 matchall \ action mirred egress redirect dev eth0 We fix this by adding an owner     field (CPU id) to struct Qdisc set after root qdisc is entered. When the softirq enters it a second time,     if the qdisc owner is the same CPU, the packet is dropped to break the loop. (CVE-2024-27010)

  - In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix possible out-of-bounds     in gsm0_receive() Assuming the following: - side A configures the n_gsm in basic option mode - side B     sends the header of a basic option mode frame with data length 1 - side A switches to advanced option mode
    - side B sends 2 data bytes which exceeds gsm->len Reason: gsm->len is not used in advanced option mode. -     side A switches to basic option mode - side B keeps sending until gsm0_receive() writes past gsm->buf     Reason: Neither gsm->state nor gsm->len have been reset after reconfiguration. Fix this by changing     gsm->count to gsm->len comparison from equal to less than. Also add upper limit checks against the     constant MAX_MRU in gsm0_receive() and gsm1_receive() to harden against memory corruption of gsm->len and     gsm->mru. All other checks remain as we still need to limit the data according to the user configuration     and actual payload size. (CVE-2024-36016)

  - In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested     IFLA_VF_VLAN_LIST attribute validation Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a     struct ifla_vf_vlan_info so the size of such attribute needs to be at least of sizeof(struct     ifla_vf_vlan_info) which is 14 bytes. The current size validation in do_setvfinfo is against NLA_HDRLEN (4     bytes) which is less than sizeof(struct ifla_vf_vlan_info) so this validation is not enough and a too     small attribute might be cast to a struct ifla_vf_vlan_info, this might result in an out of bands read     access when accessing the saved (casted) entry in ivvl. (CVE-2024-36017)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssh-8.7p1-43.el9 build changelog.

  - A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a     remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called     asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for     example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be     able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.
    (CVE-2024-6409)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-474.el9 build changelog.

  - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
    (CVE-2023-52651)

  - In the Linux kernel, the following vulnerability has been resolved: io_uring: drop any code related to     SCM_RIGHTS This is dead code after we dropped support for passing io_uring fds over SCM_RIGHTS, get rid of     it. (CVE-2023-52656)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921e: fix use-after-     free in free_irq() From commit a304e1b82808 ([PATCH] Debug shared irqs), there is a test to make sure     the shared irq handler should be able to handle the unexpected event after deregistration. For this case,     let's apply MT76_REMOVED flag to indicate the device was removed and do not run into the resource access     anymore. BUG: KASAN: use-after-free in mt7921_irq_handler+0xd8/0x100 [mt7921e] Read of size 8 at addr     ffff88824a7d3b78 by task rmmod/11115 CPU: 28 PID: 11115 Comm: rmmod Tainted: G W L 5.17.0 #10 Hardware     name: Micro-Star International Co., Ltd. MS-7D73/MPG B650I EDGE WIFI (MS-7D73), BIOS 1.81 01/05/2024 Call     Trace: <TASK> dump_stack_lvl+0x6f/0xa0 print_address_description.constprop.0+0x1f/0x190 ?     mt7921_irq_handler+0xd8/0x100 [mt7921e] ? mt7921_irq_handler+0xd8/0x100 [mt7921e]     kasan_report.cold+0x7f/0x11b ? mt7921_irq_handler+0xd8/0x100 [mt7921e] mt7921_irq_handler+0xd8/0x100     [mt7921e] free_irq+0x627/0xaa0 devm_free_irq+0x94/0xd0 ? devm_request_any_context_irq+0x160/0x160 ?     kobject_put+0x18d/0x4a0 mt7921_pci_remove+0x153/0x190 [mt7921e] pci_device_remove+0xa2/0x1d0
    __device_release_driver+0x346/0x6e0 driver_detach+0x1ef/0x2c0 bus_remove_driver+0xe7/0x2d0 ?
    __check_object_size+0x57/0x310 pci_unregister_driver+0x26/0x250 __do_sys_delete_module+0x307/0x510 ?     free_module+0x6a0/0x6a0 ? fpregs_assert_state_consistent+0x4b/0xb0 ? rcu_read_lock_sched_held+0x10/0x70 ?     syscall_enter_from_user_mode+0x20/0x70 ? trace_hardirqs_on+0x1c/0x130 do_syscall_64+0x5c/0x80 ?     trace_hardirqs_on_prepare+0x72/0x160 ? do_syscall_64+0x68/0x80 ? trace_hardirqs_on_prepare+0x72/0x160     entry_SYSCALL_64_after_hwframe+0x44/0xae (CVE-2024-26892)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: delay all of     ath9k_wmi_event_tasklet() until init is complete The ath9k_wmi_event_tasklet() used in ath9k_htc assumes     that all the data structures have been fully initialised by the time it runs. However, because of the     order in which things are initialised, this is not guaranteed to be the case, because the device is     exposed to the USB subsystem before the ath9k driver initialisation is completed. We already committed a     partial fix for this in commit: 8b3046abc99e (ath9k_htc: fix NULL pointer dereference at     ath9k_htc_tx_get_packet()) However, that commit only aborted the WMI_TXSTATUS_EVENTID command in the     event tasklet, pairing it with an initialisation complete bit in the TX struct. It seems syzbot managed     to trigger the race for one of the other commands as well, so let's just move the existing synchronisation     bit to cover the whole tasklet (setting it at the end of ath9k_htc_probe_device() instead of inside     ath9k_tx_init()). (CVE-2024-26897)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: handle pmk_op     allocation failure The kzalloc() in brcmf_pmksa_v3_op() will return null if the physical memory has run     out. As a result, if we dereference the null value, the null pointer dereference bug will happen. Return
    -ENOMEM from brcmf_pmksa_v3_op() if kzalloc() fails for pmk_op. (CVE-2024-27048)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925e: fix use-after-     free in free_irq() From commit a304e1b82808 ([PATCH] Debug shared irqs), there is a test to make sure     the shared irq handler should be able to handle the unexpected event after deregistration. For this case,     let's apply MT76_REMOVED flag to indicate the device was removed and do not run into the resource access     anymore. (CVE-2024-27049)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: add cancel_work_sync()     for c2hcmd_work The workqueue might still be running, when the driver is stopped. To avoid a use-after-     free, call cancel_work_sync() in rtl8xxxu_stop(). (CVE-2024-27052)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't set the MFP     flag for the GTK The firmware doesn't need the MFP flag for the GTK, it can even make the firmware crash.
    in case the AP is configured with: group cipher TKIP and MFPC. We would send the GTK with cipher = TKIP     and MFP which is of course not possible. (CVE-2024-27434)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx     for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the     fast_rx entry still holds a pointer to the VLAN's netdev, which can cause use-after-free bugs. Fix this by     immediately calling ieee80211_check_fast_rx after the VLAN change. (CVE-2024-35789)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL     termination The iwl_fw_ini_debug_info_tlv is used as a string, so we must ensure the string is terminated     correctly before using it. (CVE-2024-35845)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: rfi: fix potential     response leaks If the rx payload length check fails, or if kmemdup() fails, we still need to free the     command response. Fix that. (CVE-2024-35912)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: pick the version     of SESSION_PROTECTION_NOTIF When we want to know whether we should look for the mac_id or the link_id in     struct iwl_mvm_session_prot_notif, we should look at the version of SESSION_PROTECTION_NOTIF. This causes     WARNINGs: WARNING: CPU: 0 PID: 11403 at drivers/net/wireless/intel/iwlwifi/mvm/time-event.c:959     iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm] RIP:
    0010:iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm] Code: 00 49 c7 84 24 48 07 00 00 00 00 00 00 41     c6 84 24 78 07 00 00 ff 4c 89 f7 e8 e9 71 54 d9 e9 7d fd ff ff 0f 0b e9 23 fe ff ff <0f> 0b e9 1c fe ff ff     66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffb4bb00003d40 EFLAGS: 00010202 RAX:
    0000000000000000 RBX: ffff9ae63a361000 RCX: ffff9ae4a98b60d4 RDX: ffff9ae4588499c0 RSI: 0000000000000305     RDI: ffff9ae4a98b6358 RBP: ffffb4bb00003d68 R08: 0000000000000003 R09: 0000000000000010 R10:
    ffffb4bb00003d00 R11: 000000000000000f R12: ffff9ae441399050 R13: ffff9ae4761329e8 R14: 0000000000000001     R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff9ae7af400000(0000) knlGS:0000000000000000 CS: 0010     DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055fb75680018 CR3: 00000003dae32006 CR4: 0000000000f70ef0     PKRU: 55555554 Call Trace: <IRQ> ? show_regs+0x69/0x80 ? __warn+0x8d/0x150 ?     iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm] ? report_bug+0x196/0x1c0 ? handle_bug+0x45/0x80 ?     exc_invalid_op+0x1c/0xb0 ? asm_exc_invalid_op+0x1f/0x30 ? iwl_mvm_rx_session_protect_notif+0x333/0x340     [iwlmvm] iwl_mvm_rx_common+0x115/0x340 [iwlmvm] iwl_mvm_rx_mq+0xa6/0x100 [iwlmvm]     iwl_pcie_rx_handle+0x263/0xa10 [iwlwifi] iwl_pcie_napi_poll_msix+0x32/0xd0 [iwlwifi] (CVE-2024-35913)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check A-MSDU format     more carefully If it looks like there's another subframe in the A-MSDU but the header isn't fully there,     we can end up reading data out of bounds, only to discard later. Make this a bit more careful and check if     the subframe header can even be present. (CVE-2024-35937)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: decrease MHI channel     buffer length to 8KB Currently buf_len field of ath11k_mhi_config_qca6390 is assigned with 0, making MHI     use a default size, 64KB, to allocate channel buffers. This is likely to fail in some scenarios where     system memory is highly fragmented and memory compaction or reclaim is not allowed. There is a fail report     which is caused by it: kworker/u32:45: page allocation failure: order:4,     mode:0x40c00(GFP_NOIO|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0 CPU: 0 PID: 19318 Comm:
    kworker/u32:45 Not tainted 6.8.0-rc3-1.gae4495f-default #1 openSUSE Tumbleweed (unreleased)     493b6d5b382c603654d7a81fc3c144d59a1dfceb Workqueue: events_unbound async_run_entry_fn Call Trace: <TASK>     dump_stack_lvl+0x47/0x60 warn_alloc+0x13a/0x1b0 ? srso_alias_return_thunk+0x5/0xfbef5 ?
    __alloc_pages_direct_compact+0xab/0x210 __alloc_pages_slowpath.constprop.0+0xd3e/0xda0
    __alloc_pages+0x32d/0x350 ? mhi_prepare_channel+0x127/0x2d0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814]
    __kmalloc_large_node+0x72/0x110 __kmalloc+0x37c/0x480 ? mhi_map_single_no_bb+0x77/0xf0 [mhi     40df44e07c05479f7a6e7b90fba9f0e0031a7814] ? mhi_prepare_channel+0x127/0x2d0 [mhi     40df44e07c05479f7a6e7b90fba9f0e0031a7814] mhi_prepare_channel+0x127/0x2d0 [mhi     40df44e07c05479f7a6e7b90fba9f0e0031a7814] __mhi_prepare_for_transfer+0x44/0x80 [mhi     40df44e07c05479f7a6e7b90fba9f0e0031a7814] ? __pfx_____mhi_prepare_for_transfer+0x10/0x10 [mhi     40df44e07c05479f7a6e7b90fba9f0e0031a7814] device_for_each_child+0x5c/0xa0 ? __pfx_pci_pm_resume+0x10/0x10     ath11k_core_resume+0x65/0x100 [ath11k a5094e22d7223135c40d93c8f5321cf09fd85e4e] ?     srso_alias_return_thunk+0x5/0xfbef5 ath11k_pci_pm_resume+0x32/0x60 [ath11k_pci     830b7bfc3ea80ebef32e563cafe2cb55e9cc73ec] ? srso_alias_return_thunk+0x5/0xfbef5     dpm_run_callback+0x8c/0x1e0 device_resume+0x104/0x340 ? __pfx_dpm_watchdog_handler+0x10/0x10     async_resume+0x1d/0x30 async_run_entry_fn+0x32/0x120 process_one_work+0x168/0x330     worker_thread+0x2f5/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xe8/0x120 ? __pfx_kthread+0x10/0x10     ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Actually those     buffers are used only by QMI target -> host communication. And for WCN6855 and QCA6390, the largest packet     size for that is less than 6KB. So change buf_len field to 8KB, which results in order 1 allocation if     page size is 4KB. In this way, we can at least save some memory, and as well as decrease the possibility     of allocation failure in those scenarios. Tested-on: WCN6855 hw2.0 PCI     WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30 (CVE-2024-35938)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix null pointer access     when abort scan During cancel scan we might use vif that weren't scanning. Fix this by using the actual     scanning vif. (CVE-2024-35946)

  - In the Linux kernel, the following vulnerability has been resolved: mm: use memalloc_nofs_save() in     page_cache_ra_order() See commit f2c817bed58d (mm: use memalloc_nofs_save in readahead path), ensure     that page_cache_ra_order() do not attempt to reclaim file-backed pages too, or it leads to a deadlock,     found issue when test ext4 large folio. INFO: task DataXceiver for:7494 blocked for more than 120 seconds.
    echo 0 > /proc/sys/kernel/hung_task_timeout_secs disables this message. task:DataXceiver for state:D     stack:0 pid:7494 ppid:1 flags:0x00000200 Call trace: __switch_to+0x14c/0x240 __schedule+0x82c/0xdd0     schedule+0x58/0xf0 io_schedule+0x24/0xa0 __folio_lock+0x130/0x300 migrate_pages_batch+0x378/0x918     migrate_pages+0x350/0x700 compact_zone+0x63c/0xb38 compact_zone_order+0xc0/0x118     try_to_compact_pages+0xb0/0x280 __alloc_pages_direct_compact+0x98/0x248 __alloc_pages+0x510/0x1110     alloc_pages+0x9c/0x130 folio_alloc+0x20/0x78 filemap_alloc_folio+0x8c/0x1b0     page_cache_ra_order+0x174/0x308 ondemand_readahead+0x1c8/0x2b8 page_cache_async_ra+0x68/0xb8     filemap_readahead.isra.0+0x64/0xa8 filemap_get_pages+0x3fc/0x5b0 filemap_splice_read+0xf4/0x280     ext4_file_splice_read+0x2c/0x48 [ext4] vfs_splice_read.part.0+0xa8/0x118 splice_direct_to_actor+0xbc/0x288     do_splice_direct+0x9c/0x108 do_sendfile+0x328/0x468 __arm64_sys_sendfile64+0x8c/0x148     invoke_syscall+0x4c/0x118 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x4c/0x1f8     el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x188/0x190 (CVE-2024-36882)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: guard against     invalid STA ID on removal Guard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would result     in out-of-bounds array accesses. This prevents issues should the driver get into a bad state during error     handling. (CVE-2024-36921)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: read txq->read_ptr     under lock If we read txq->read_ptr without lock, we can read the same value twice, then obtain the lock,     and reclaim from there to two different places, but crucially reclaim the same entry twice, resulting in     the WARN_ONCE() a little later. Fix that by reading txq->read_ptr under lock. (CVE-2024-36922)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: don't free NULL     coalescing rule If the parsing fails, we can dereference a NULL pointer here. (CVE-2024-36941)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssh-8.7p1-42.el9 build changelog.

  - A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition     which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may     be able to trigger it by failing to authenticate within a set time period. (CVE-2024-6387)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the cockpit-320-1.el9 build changelog.

  - A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when     enabling the pam_env's user_readenv option, which leads to a denial of service (DoS) attack.
    (CVE-2024-6126)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-472.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: xsk: fix usage of multi-buffer BPF     helpers for ZC XDP Currently when packet is shrunk via bpf_xdp_adjust_tail() and memory type is set to     MEM_TYPE_XSK_BUFF_POOL, null ptr dereference happens: [1136314.192256] BUG: kernel NULL pointer     dereference, address: 0000000000000034 [1136314.203943] #PF: supervisor read access in kernel mode     [1136314.213768] #PF: error_code(0x0000) - not-present page [1136314.223550] PGD 0 P4D 0 [1136314.230684]     Oops: 0000 [#1] PREEMPT SMP NOPTI [1136314.239621] CPU: 8 PID: 54203 Comm: xdpsock Not tainted 6.6.0+ #257     [1136314.250469] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS     SE5C620.86B.02.01.0008.031920191559 03/19/2019 [1136314.265615] RIP: 0010:__xdp_return+0x6c/0x210     [1136314.274653] Code: ad 00 48 8b 47 08 49 89 f8 a8 01 0f 85 9b 01 00 00 0f 1f 44 00 00 f0 41 ff 48 34 75     32 4c 89 c7 e9 79 cd 80 ff 83 fe 03 75 17 <f6> 41 34 01 0f 85 02 01 00 00 48 89 cf e9 22 cc 1e 00 e9 3d d2     86 [1136314.302907] RSP: 0018:ffffc900089f8db0 EFLAGS: 00010246 [1136314.312967] RAX: ffffc9003168aed0     RBX: ffff8881c3300000 RCX: 0000000000000000 [1136314.324953] RDX: 0000000000000000 RSI: 0000000000000003     RDI: ffffc9003168c000 [1136314.336929] RBP: 0000000000000ae0 R08: 0000000000000002 R09: 0000000000010000     [1136314.348844] R10: ffffc9000e495000 R11: 0000000000000040 R12: 0000000000000001 [1136314.360706] R13:
    0000000000000524 R14: ffffc9003168aec0 R15: 0000000000000001 [1136314.373298] FS: 00007f8df8bbcb80(0000)     GS:ffff8897e0e00000(0000) knlGS:0000000000000000 [1136314.386105] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [1136314.396532] CR2: 0000000000000034 CR3: 00000001aa912002 CR4: 00000000007706f0     [1136314.408377] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1136314.420173] DR3:
    0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1136314.431890] PKRU: 55555554     [1136314.439143] Call Trace: [1136314.446058] <IRQ> [1136314.452465] ? __die+0x20/0x70 [1136314.459881] ?     page_fault_oops+0x15b/0x440 [1136314.468305] ? exc_page_fault+0x6a/0x150 [1136314.476491] ?     asm_exc_page_fault+0x22/0x30 [1136314.484927] ? __xdp_return+0x6c/0x210 [1136314.492863]     bpf_xdp_adjust_tail+0x155/0x1d0 [1136314.501269] bpf_prog_ccc47ae29d3b6570_xdp_sock_prog+0x15/0x60     [1136314.511263] ice_clean_rx_irq_zc+0x206/0xc60 [ice] [1136314.520222] ? ice_xmit_zc+0x6e/0x150 [ice]     [1136314.528506] ice_napi_poll+0x467/0x670 [ice] [1136314.536858] ?     ttwu_do_activate.constprop.0+0x8f/0x1a0 [1136314.546010] __napi_poll+0x29/0x1b0 [1136314.553462]     net_rx_action+0x133/0x270 [1136314.561619] __do_softirq+0xbe/0x28e [1136314.569303] do_softirq+0x3f/0x60     This comes from __xdp_return() call with xdp_buff argument passed as NULL which is supposed to be consumed     by xsk_buff_free() call. To address this properly, in ZC case, a node that represents the frag being     removed has to be pulled out of xskb_list. Introduce appropriate xsk helpers to do such node operation and     use them accordingly within bpf_xdp_adjust_tail(). (CVE-2024-26611)

  - In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from     corrupted group in ext4_mb_find_by_goal() Places the logic for checking if the group's block bitmap is     corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted     block bitmap. (CVE-2024-26772)

  - In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line     resize We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k     block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue     can be reproduced on a smaller file system for convenience by explicitly turning off resize_inode. An on-     line resize across an 8 GiB boundary (the size of a meta block group in this setup) then leads to a     corruption: dev=/dev/<some_dev> # should be >= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O     ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096     of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test #     79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # drop page     cache to force reload the block from disk echo 1 > /proc/sys/vm/drop_caches sha1sum /corruption/test #     3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the     number of blocks per block group and 2^6 are the number of block groups that make a meta block group. The     last checksum might be different depending on how the file is laid out across the physical blocks. The     actual corruption occurs at physical block 63*2^15 = 2064384 which would be the location of the backup of     the meta block group's block descriptor. During the on-line resize the file system will be converted to     meta_bg starting at s_first_meta_bg which is 2 in the example - meaning all block groups after 16 GiB.
    However, in ext4_flex_group_add we might add block groups that are not part of the first meta block group     yet. In the reproducer we achieved this by substracting the size of a whole block group from the point     where the meta block group would start. This must be considered when updating the backup block group     descriptors to follow the non-meta_bg layout. The fix is to add a test whether the group to add is already     part of the meta block group or not. (CVE-2024-35807)

  - In the Linux kernel, the following vulnerability has been resolved: block: fix overflow in     blk_ioctl_discard() There is no check for overflow of 'start + len' in blk_ioctl_discard(). Hung task     occurs if submit an discard ioctl with the following param: start = 0x80000000000ff000, len =     0x8000000000fff000; Add the overflow validation now. (CVE-2024-36917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the python- urllib3-1.26.5-6.el9 build changelog.

  - urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with     `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected.
    However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally     configure the `Proxy-Authorization` header even though it won't have any effect as the request is not     using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-     Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on     cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this     vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip     the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are     doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve     safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default     in order to further protect users who aren't using the correct approach. We believe the number of usages     affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting     the `Proxy-Authorization` header without using urllib3's built-in proxy support. 2. Not disabling HTTP     redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a     malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to     upgrade may use the `Proxy-Authorization` header with urllib3's `ProxyManager`, disable HTTP redirects     using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as     mitigations. (CVE-2024-37891)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4160 advisory.

  - The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0     through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper     enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters. IBM X-Force ID: 260578.
    (CVE-2023-38264)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-467.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: efivarfs: force RO when remounting if     SetVariable is not supported If SetVariable at runtime is not supported by the firmware we never assign a     callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we     never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a     crash looking like this: $ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [     303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [     303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current     EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04:
    level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [     303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error:
    Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core     crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm:
    efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown     Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv     daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr :
    efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29:
    ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25:
    ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21:
    ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [     303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14:
    ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10:
    0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 :
    0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [     303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [     303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585]     efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [     303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156]     el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [     303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code:
    ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]--- Fix this     by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and     deny anything that's not RO if the firmware doesn't implement SetVariable at runtime. (CVE-2023-52463)

  - This CVE was assigned by Intel. Please see CVE-2024-2201 on CVE.org for more information. (CVE-2024-2201)

  - In the Linux kernel, the following vulnerability has been resolved: block: prevent division by zero in     blk_rq_stat_sum() The expression dst->nr_samples + src->nr_samples may have zero value on overflow. It is     necessary to add a check to avoid division by zero. Found by Linux Verification Center (linuxtesting.org)     with Svace. (CVE-2024-35925)

  - In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration     on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting     to turn it permanent. This causes a problem for DNS resolution as the expiration set by user-space is     overwritten to TIME64_MAX, disabling further DNS updates. Fix this by restoring the condition that     key_set_expiry is only called when the pre-parser sets a specific expiry. (CVE-2024-36031)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4016 advisory.

  - If a garbage collection was triggered at the right time, a use-after-free could have occurred during     object transplant. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird <     115.12. (CVE-2024-5688)

  - By monitoring the time certain operations take, an attacker could have guessed which external protocol     handlers were functional on a user's system. This vulnerability affects Firefox < 127, Firefox ESR <     115.12, and Thunderbird < 115.12. (CVE-2024-5690)

  - By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button     that, if clicked by a user, would bypass restrictions to open a new window. This vulnerability affects     Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. (CVE-2024-5691)

  - Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data     from another site in violation of same-origin policy. This vulnerability affects Firefox < 127, Firefox     ESR < 115.12, and Thunderbird < 115.12. (CVE-2024-5693)

  - By manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory leading     to a potentially exploitable crash. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and     Thunderbird < 115.12. (CVE-2024-5696)

  - Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and     Thunderbird < 115.12. (CVE-2024-5700)

  - Memory corruption in the networking stack could have led to a potentially exploitable crash. This     vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12. (CVE-2024-5702)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3741 advisory.

  - The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through     9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1     through 9.18.21-S1. (CVE-2023-4408)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:3951 advisory.

  - If a garbage collection was triggered at the right time, a use-after-free could have occurred during     object transplant. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird <     115.12. (CVE-2024-5688)

  - By monitoring the time certain operations take, an attacker could have guessed which external protocol     handlers were functional on a user's system. This vulnerability affects Firefox < 127, Firefox ESR <     115.12, and Thunderbird < 115.12. (CVE-2024-5690)

  - By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button     that, if clicked by a user, would bypass restrictions to open a new window. This vulnerability affects     Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. (CVE-2024-5691)

  - Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data     from another site in violation of same-origin policy. This vulnerability affects Firefox < 127, Firefox     ESR < 115.12, and Thunderbird < 115.12. (CVE-2024-5693)

  - By manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory leading     to a potentially exploitable crash. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and     Thunderbird < 115.12. (CVE-2024-5696)

  - Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and     Thunderbird < 115.12. (CVE-2024-5700)

  - Memory corruption in the networking stack could have led to a potentially exploitable crash. This     vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12. (CVE-2024-5702)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3760 advisory.

  - A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client's     session key. This key is different for each new session, which protects it from brute force attacks.
    However, the ticket it contains is encrypted using the target principal key directly. For user principals,     this key is a hash of a public per-principal randomly-generated salt and the user's password. If a     principal is compromised it means the attacker would be able to retrieve tickets encrypted to any     principal, all of them being encrypted by their own key directly. By taking these tickets and salts     offline, the attacker could run brute force attacks to find character strings able to decrypt tickets when     combined to a principal salt (i.e. find the principal's password). (CVE-2024-3183)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3591 advisory.

  - A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an     authenticated user to cause a server crash while modifying `userPassword` using malformed input.
    (CVE-2024-2199)

  - A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the     directory server, leading to a denial of service (CVE-2024-3657)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the openssl-3.2.2-1.el9 build changelog.

  - Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when     processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to     trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3     if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured     and the default anti-replay protection is in use). In this case, under certain conditions, the session     cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache     will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario     for this failure to force a Denial of Service. It may also happen by accident in normal operation. This     issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in     3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.
    (CVE-2024-2511)

  - Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary:
    Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA     public key or DSA parameters may experience long delays. Where the key or parameters that are being     checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions     EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those     computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large     modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in     length for signature verification. However the key and parameter check functions do not limit the modulus     size when performing the checks. An application that calls EVP_PKEY_param_check() or     EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be     vulnerable to a Denial of Service attack. These functions are not called by OpenSSL itself on untrusted     DSA keys so only applications that directly call these functions may be vulnerable. Also vulnerable are     the OpenSSL pkey and pkeyparam command line applications when using the `-check` option. The OpenSSL     SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected     by this issue. (CVE-2024-4603)

  - Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was     previously freed in some situations Impact summary: A use after free can have a range of potential     consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only     applications that directly call the SSL_free_buffers function are affected by this issue. Applications     that do not call this function are not vulnerable. Our investigations indicate that this function is     rarely used by applications. The SSL_free_buffers function is used to free the internal OpenSSL buffer     used when processing an incoming record from the network. The call is only expected to succeed if the     buffer is not currently in use. However, two scenarios have been identified where the buffer is freed even     when still in use. The first scenario occurs where a record header has been received from the network and     processed by OpenSSL, but the full record body has not yet arrived. In this case calling SSL_free_buffers     will succeed even though a record has only been partially processed and the buffer is still in use. The     second scenario occurs where a full record containing application data has been received and processed by     OpenSSL but the application has only read part of this data. Again a call to SSL_free_buffers will succeed     even though the buffer is still in use. While these scenarios could occur accidentally during normal     operation a malicious attacker could attempt to engineer a stituation where this occurs. We are not aware     of this issue being actively exploited. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this     issue. Found by William Ahern (Akamai). Fix developed by Matt Caswell. Fix developed by Watson Ladd     (Akamai). Fixed in OpenSSL 3.3.1 (Affected since 3.3.0). (CVE-2024-4741)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3588 advisory.

  - The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to     it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to     crash an application or overwrite a neighbouring variable. (CVE-2024-2961)

  - nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size     cache is exhausted by client requests then a subsequent client request for netgroup data may result in a     stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This     vulnerability is only present in the nscd binary. (CVE-2024-33599)

  - nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails     to add a not-found netgroup response to the cache, the client request can result in a null pointer     dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability     is only present in the nscd binary. (CVE-2024-33600)

  - nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's     (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a     memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in     glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.
    (CVE-2024-33601)

  - nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd)     netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer.
    The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present     in the nscd binary. (CVE-2024-33602)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3340 advisory.

  - .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2024-30045)

  - Visual Studio Denial of Service Vulnerability (CVE-2024-30046)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3344 advisory.

  - nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size     cache is exhausted by client requests then a subsequent client request for netgroup data may result in a     stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This     vulnerability is only present in the nscd binary. (CVE-2024-33599)

  - nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails     to add a not-found netgroup response to the cache, the client request can result in a null pointer     dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability     is only present in the nscd binary. (CVE-2024-33600)

  - nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's     (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a     memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in     glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.
    (CVE-2024-33601)

  - nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd)     netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer.
    The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present     in the nscd binary. (CVE-2024-33602)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:3343 advisory.

  - A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents()     function. This issue occurs when byte-swapped length values are used in replies, potentially leading to     memory leakage and segmentation faults, particularly when triggered by a client with a different     endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory     values and then transmit them back to the client until encountering an unmapped page, resulting in a     crash. Despite the attacker's inability to control the specific memory copied into the replies, the small     length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds     reads. (CVE-2024-31080)

  - A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice()     function. This issue occurs when byte-swapped length values are used in replies, potentially leading to     memory leakage and segmentation faults, particularly when triggered by a client with a different     endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory     values and then transmit them back to the client until encountering an unmapped page, resulting in a     crash. Despite the attacker's inability to control the specific memory copied into the replies, the small     length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds     reads. (CVE-2024-31081)

  - A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue     occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially     resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently,     ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer     is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the     system by sending a specially crafted request. (CVE-2024-31083)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3347 advisory.

  - An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7,     3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks     during cleanup of permissions-related errors. This means users which can run privileged programs are     potentially able to modify permissions of files referenced by symlinks in some circumstances.
    (CVE-2023-6597)

  - An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and     3.8.18 and prior. The zipfile module is vulnerable to quoted-overlap zip-bombs which exploit the zip     format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile     module reject zip archives which overlap entries in the archive. (CVE-2024-0450)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3261 advisory.

  - A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents()     function. This issue occurs when byte-swapped length values are used in replies, potentially leading to     memory leakage and segmentation faults, particularly when triggered by a client with a different     endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory     values and then transmit them back to the client until encountering an unmapped page, resulting in a     crash. Despite the attacker's inability to control the specific memory copied into the replies, the small     length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds     reads. (CVE-2024-31080)

  - A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice()     function. This issue occurs when byte-swapped length values are used in replies, potentially leading to     memory leakage and segmentation faults, particularly when triggered by a client with a different     endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory     values and then transmit them back to the client until encountering an unmapped page, resulting in a     crash. Despite the attacker's inability to control the specific memory copied into the replies, the small     length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds     reads. (CVE-2024-31081)

  - A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue     occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially     resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently,     ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer     is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the     system by sending a specially crafted request. (CVE-2024-31083)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:2968 advisory.

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP     request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method     changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs.
    Although this behavior is not specified in the section for redirects, it can be inferred by piecing     together information from different sections and we have observed the behavior in other major HTTP client     implementations like curl and web browsers. Because the vulnerability requires a previously trusted     service to become compromised in order to have an impact on confidentiality we believe the exploitability     of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request     bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions     must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information     in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts     redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised.
    This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve     this issue. Users unable to update should disable redirects for services that aren't expecting to respond     with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle     301, 302, and 303 redirects manually by stripping the HTTP request body. (CVE-2023-45803)

  - PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable     for a Manger attack. (CVE-2023-52323)

  - Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar     to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template,     potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject     arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to     XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
    (CVE-2024-22195)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3067 advisory.

  - A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and     legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if     the pointer is warped from within a window on one screen to the root window of the other screen and if the     original window is destroyed followed by another window being destroyed. (CVE-2023-5380)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3060 advisory.

  - GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this     library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the parsing of MXF video files. The issue results from the     lack of proper validation of user-supplied data, which can result in an integer overflow before allocating     a buffer. An attacker can leverage this vulnerability to execute code in the context of the current     process. Was ZDI-CAN-21660. (CVE-2023-40474)

  - GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this     library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the parsing of MXF video files. The issue results from the     lack of proper validation of user-supplied data, which can result in an integer overflow before allocating     a buffer. An attacker can leverage this vulnerability to execute code in the context of the current     process. Was ZDI-CAN-21661. (CVE-2023-40475)

  - GStreamer H265 Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the parsing of H265 encoded video files. The issue results     from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-     length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of     the current process. Was ZDI-CAN-21768. (CVE-2023-40476)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3265 advisory.

  - It is possible for a user in a different organization from the owner of a snapshot to bypass authorization     and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This     functionality is intended to only be available to individuals with the permission to write/edit to the     snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an     unprivileged user in a different organization than the snapshot owner are treated as authorized. Grafana     Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing     this vulnerability. This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from     10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5. (CVE-2024-1313)

  - A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a     resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in     github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function     uses named return parameters to free pkey and ctx if there is an error initializing the context or     setting the different properties. All return statements related to error cases follow the return nil,     nil, fail(...) pattern, meaning that pkey and ctx will be nil inside the deferred function that should     free them. (CVE-2024-1394)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:2980 advisory.

  - hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via     consecutive marks during the process of looking back for base glyphs when attaching marks.
    (CVE-2023-25193)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:2953 advisory.

  - Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack's media     type parser to take much longer than expected, leading to a possible denial of service vulnerability     (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1. (CVE-2024-25126)

  - Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond     with an unexpectedly large response. Responding with such large responses could lead to a denial of     service issue. Vulnerable applications will use the `Rack::File` middleware or the     `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in     3.0.9.1 and 2.2.8.1. (CVE-2024-26141)

  - Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to     take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers     are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are     unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1. (CVE-2024-26146)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:2994 advisory.

  - Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the     LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp. (CVE-2021-32142)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3008 advisory.

  - OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files     via a race condition during execution of library code with UID 0. (CVE-2023-41915)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3095 advisory.

  - Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code     and cause a denial of service during the conversion of wav files to ogg files. (CVE-2023-43361)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:2981 advisory.

  - An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the     bgp_attr_psid_sub() function. (CVE-2023-31490)

  - An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute     length is zero. (CVE-2023-41358)

  - An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c     processes malformed requests with no attributes, leading to a NULL pointer dereference. (CVE-2023-41909)

  - An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data,     leading to a crash. (CVE-2023-46752)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message     without mandatory attributes, e.g., one with only an unknown transit attribute. (CVE-2023-46753)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3059 advisory.

  - LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a     denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is     available with commit e8131125. (CVE-2022-4645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:3058 advisory.

  - Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12 (CVE-2023-4874)

  - Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12     (CVE-2023-4875)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3233 advisory.

  - A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit     unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into     the command of the features mentioned through the hostname parameter. (CVE-2023-6004)

  - A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by     different supported crypto backends. The return values from these were not properly checked, which could     cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as     an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures,     terminating the connection. (CVE-2023-6918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3203 advisory.

  - A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of     DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS     resolver) to manipulate records. (CVE-2023-7008)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3049 advisory.

  - perl-Convert-ASN1 (aka the Convert::ASN1 module for Perl) through 0.27 allows remote attackers to cause an     infinite loop via unexpected input. (CVE-2013-7488)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3166 advisory.

  - scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by     backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they     intentionally omit validation of anomalous argument transfers because that could stand a great chance     of breaking existing workflows. (CVE-2020-15778)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:2974 advisory.

  - A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer()     function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents     of memory on the system. (CVE-2023-43788)

  - A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user     can trigger an out-of-bounds read error and read contents of memory on the system. (CVE-2023-43789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3105 advisory.

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
    Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer     dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service     (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to     potential disruptions in system availability and stability. This vulnerability has been patched in version     41.0.6. (CVE-2023-49083)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3102 advisory.

  - Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar     to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template,     potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject     arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to     XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
    (CVE-2024-22195)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
206292	CentOS 9 : curl-7.76.1-31.el9	high
206291	CentOS 9 : python3.9-3.9.19-8.el9	high
206026	CentOS 8 : jose (CESA-2024:5294)	high
205814	CentOS 9 : python3.9-3.9.19-7.el9	medium
204877	CentOS 9 : python-setuptools-53.0.0-13.el9	high
204713	CentOS 7 : flatpak (RHSA-2024:3980)	high
204712	CentOS 7 : linux-firmware (RHSA-2024:3939)	high
204711	CentOS 7 : less (RHSA-2024:3669)	high
204710	CentOS 7 : python-pillow (RHSA-2024:0857)	high
204131	CentOS 9 : python3.9-3.9.19-4.el9	high
202393	CentOS 9 : kernel-5.14.0-479.el9	high
202392	CentOS 9 : openssh-8.7p1-43.el9	high
201993	CentOS 9 : kernel-5.14.0-474.el9	critical
201992	CentOS 9 : openssh-8.7p1-42.el9	high
201968	CentOS 9 : cockpit-320-1.el9	low
201850	CentOS 9 : kernel-5.14.0-472.el9	medium
201849	CentOS 9 : python-urllib3-1.26.5-6.el9	medium
201097	CentOS 7 : java-1.8.0-ibm (RHSA-2024:4160)	medium
200887	CentOS 9 : kernel-5.14.0-467.el9	medium
200827	CentOS 7 : thunderbird (RHSA-2024:4016)	medium
200727	CentOS 7 : bind, bind-dyndb-ldap, and dhcp (RHSA-2024:3741)	high
200726	CentOS 7 : firefox (RHSA-2024:3951)	medium
200725	CentOS 7 : ipa (RHSA-2024:3760)	high
200499	CentOS 7 : 389-ds-base (RHSA-2024:3591)	high
200325	CentOS 9 : openssl-3.2.2-1.el9	high
200256	CentOS 7 : glibc (RHSA-2024:3588)	high
197865	CentOS 8 : .NET 7.0 (CESA-2024:3340)	medium
197864	CentOS 8 : glibc (CESA-2024:3344)	high
197863	CentOS 8 : xorg-x11-server-Xwayland (CESA-2024:3343)	high
197862	CentOS 8 : python3 (CESA-2024:3347)	high
197696	CentOS 8 : tigervnc (CESA-2024:3261)	high
197695	CentOS 8 : fence-agents (CESA-2024:2968)	medium
197694	CentOS 8 : tigervnc (CESA-2024:3067)	medium
197693	CentOS 8 : gstreamer1-plugins-bad-free (CESA-2024:3060)	high
197692	CentOS 8 : grafana (CESA-2024:3265)	medium
197691	CentOS 8 : harfbuzz (CESA-2024:2980)	high
197690	CentOS 8 : pcs (CESA-2024:2953)	medium
197689	CentOS 8 : LibRaw (CESA-2024:2994)	high
197688	CentOS 8 : pmix (CESA-2024:3008)	high
197687	CentOS 8 : vorbis-tools (CESA-2024:3095)	high
197686	CentOS 8 : frr (CESA-2024:2981)	high
197685	CentOS 8 : libtiff (CESA-2024:3059)	medium
197684	CentOS 8 : mutt (CESA-2024:3058)	medium
197683	CentOS 8 : libssh (CESA-2024:3233)	medium
197682	CentOS 8 : systemd (CESA-2024:3203)	medium
197681	CentOS 8 : perl-Convert-ASN1 (CESA-2024:3049)	high
197680	CentOS 8 : openssh (CESA-2024:3166)	high
197679	CentOS 8 : libXpm (CESA-2024:2974)	medium
197678	CentOS 8 : python3.11-cryptography (CESA-2024:3105)	high
197677	CentOS 8 : python-jinja2 (CESA-2024:3102)	medium

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

high

high

medium

high

high

high

high

high

high

high

high

critical

high

low

medium

medium

medium

medium

medium

high

medium

high

high

high

high

medium

high

high

high

high

medium

medium

high

medium

high

medium

high

high

high

high

medium

medium

medium

medium

high

high

medium

high

medium