The remote CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:0779 advisory.

  - Insufficient policy enforcement in media in Google Chrome prior to 80.0.3987.132 allowed a remote attacker     to bypass same origin policy via a crafted HTML page. (CVE-2020-6420)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0738 advisory.

  - An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer     overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in     common/unistr.cpp. (CVE-2020-10531)

  - Type confusion in V8 in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6383)

  - Use after free in WebAudio in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6384)

  - Use after free in speech in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6386)

  - Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.122 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6407)

  - Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6418)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:0005 advisory.

  - Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2019-13767)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1504 advisory.

  - Use after free in speech recognizer in Google Chrome prior to 81.0.4044.113 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2020-6457)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1487 advisory.

  - Out of bounds write in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6419)

  - Use after free in audio in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6423)

  - Type Confusion in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6430)

  - Insufficient policy enforcement in full screen in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to spoof security UI via a crafted HTML page. (CVE-2020-6431)

  - Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2020-6432)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2020-6433)

  - Use after free in devtools in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6434)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML     page. (CVE-2020-6435)

  - Use after free in window management in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6436)

  - Inappropriate implementation in WebView in Google Chrome prior to 81.0.4044.92 allowed a remote attacker     to spoof security UI via a crafted application. (CVE-2020-6437)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker     who convinced a user to install a malicious extension to obtain potentially sensitive information from     process memory via a crafted Chrome Extension. (CVE-2020-6438)

  - Insufficient policy enforcement in navigations in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to bypass security UI via a crafted HTML page. (CVE-2020-6439)

  - Inappropriate implementation in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who     convinced a user to install a malicious extension to obtain potentially sensitive information via a     crafted Chrome Extension. (CVE-2020-6440)

  - Insufficient policy enforcement in omnibox in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to bypass security UI via a crafted HTML page. (CVE-2020-6441)

  - Inappropriate implementation in cache in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to     leak cross-origin data via a crafted HTML page. (CVE-2020-6442)

  - Insufficient data validation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker who had convinced the user to use devtools to execute arbitrary code via a crafted HTML page.
    (CVE-2020-6443)

  - Uninitialized use in WebRTC in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6444)

  - Insufficient policy enforcement in trusted types in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker to bypass content security policy via a crafted HTML page. (CVE-2020-6445, CVE-2020-6446)

  - Inappropriate implementation in developer tools in Google Chrome prior to 81.0.4044.92 allowed a remote     attacker who had convinced the user to use devtools to potentially exploit heap corruption via a crafted     HTML page. (CVE-2020-6447)

  - Use after free in V8 in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6448)

  - Use after free in extensions in Google Chrome prior to 81.0.4044.92 allowed an attacker who convinced a     user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome     Extension. (CVE-2020-6454)

  - Out of bounds read in WebSQL in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6455)

  - Insufficient validation of untrusted input in clipboard in Google Chrome prior to 81.0.4044.92 allowed a     local attacker to bypass site isolation via crafted clipboard contents. (CVE-2020-6456)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0467 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2583)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2593)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through     a web service which supplies data to the APIs. (CVE-2020-2604)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2659)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0214 advisory.

  - Use after free in speech in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6378)

  - Use after free in V8 in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6379)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.130 allowed a remote     attacker who had compromised the renderer process to bypass site isolation via a crafted Chrome Extension.
    (CVE-2020-6380)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1270 advisory.

  - usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init. (CVE-2019-20503)

  - Use after free in WebGL in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6422)

  - Use after free in media in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6424)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.149 allowed an attacker     who convinced a user to install a malicious extension to bypass site isolation via a crafted Chrome     Extension. (CVE-2020-6425)

  - Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6426)

  - Use after free in audio in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6427, CVE-2020-6428, CVE-2020-6429,     CVE-2020-6449)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0514 advisory.

  - In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain     circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds     check could fail and memory outside a buffer could be written to, or uninitialized data could be     disclosed. (CVE-2019-18197)

  - sqlite: error mishandling because of incomplete fix of (CVE-2019-19880)

  - flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT     JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect     results). (CVE-2019-19923)

  - zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP     archive. (CVE-2019-19925)

  - multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by     errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2019-19880. (CVE-2019-19926)

  - Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87 allowed a     remote attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6381)

  - Type confusion in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6382)

  - Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.87 allowed a remote     attacker to bypass site isolation via a crafted HTML page. (CVE-2020-6385)

  - Out of bounds write in WebRTC in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to     potentially exploit heap corruption via a crafted video stream. (CVE-2020-6387, CVE-2020-6389)

  - Out of bounds access in WebAudio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6388)

  - Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6390)

  - Insufficient validation of untrusted input in Blink in Google Chrome prior to 80.0.3987.87 allowed a local     attacker to bypass content security policy via a crafted HTML page. (CVE-2020-6391)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker     who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted     Chrome Extension. (CVE-2020-6392)

  - Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker     to leak cross-origin data via a crafted HTML page. (CVE-2020-6393)

  - Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker     to bypass content security policy via a crafted HTML page. (CVE-2020-6394)

  - Out of bounds read in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to     obtain potentially sensitive information from process memory via a crafted HTML page. (CVE-2020-6395)

  - Inappropriate implementation in Skia in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to     spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-6396)

  - Inappropriate implementation in sharing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker     to spoof security UI via a crafted HTML page. (CVE-2020-6397)

  - Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to     potentially exploit heap corruption via a crafted PDF file. (CVE-2020-6398)

  - Insufficient policy enforcement in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2020-6399)

  - Inappropriate implementation in CORS in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to     leak cross-origin data via a crafted HTML page. (CVE-2020-6400)

  - Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a     remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. (CVE-2020-6401,     CVE-2020-6411, CVE-2020-6412)

  - Insufficient policy enforcement in downloads in Google Chrome on OS X prior to 80.0.3987.87 allowed an     attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted     Chrome Extension. (CVE-2020-6402)

  - Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote     attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-6403)

  - Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6404)

  - Out of bounds read in SQLite in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted HTML page. (CVE-2020-6405)

  - Use after free in audio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-6406)

  - Insufficient policy enforcement in CORS in Google Chrome prior to 80.0.3987.87 allowed a local attacker to     obtain potentially sensitive information via a crafted HTML page. (CVE-2020-6408)

  - Inappropriate implementation in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker     who convinced the user to enter a URI to bypass navigation restrictions via a crafted domain name.
    (CVE-2020-6409)

  - Insufficient policy enforcement in navigation in Google Chrome prior to 80.0.3987.87 allowed a remote     attacker to confuse the user via a crafted domain name. (CVE-2020-6410)

  - Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to     bypass HTML validators via a crafted HTML page. (CVE-2020-6413)

  - Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 80.0.3987.87 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2020-6414)

  - Inappropriate implementation in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote     attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6415)

  - Insufficient data validation in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6416)

  - Inappropriate implementation in installer in Google Chrome prior to 80.0.3987.87 allowed a local attacker     to execute arbitrary code via a crafted registry entry. (CVE-2020-6417)

  - Inappropriate implementation in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker     to bypass AppCache security restrictions via a crafted HTML page. (CVE-2020-6499)

  - Inappropriate implementation in interstitials in Google Chrome prior to 80.0.3987.87 allowed a remote     attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-6500)

  - Insufficient policy enforcement in CSP in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to     bypass content security policy via a crafted HTML page. (CVE-2020-6501)

  - Incorrect implementation in permissions in Google Chrome prior to 80.0.3987.87 allowed a remote attacker     to spoof security UI via a crafted HTML page. (CVE-2020-6502)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1350 advisory.

  - Use after free in WebAudio in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6450, CVE-2020-6451)

  - Heap buffer overflow in media in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6452)

  - Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.162 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-6453)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-513.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: net: phy: micrel: Fix potential null     pointer dereference In lan8814_get_sig_rx() and lan8814_get_sig_tx() ptp_parse_header() may return NULL as     ptp_header due to abnormal packet type or corrupted packet. Fix this bug by adding ptp_header check. Found     by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2024-35891)

  - In the Linux kernel, the following vulnerability has been resolved: protect the fetch of ->fd[fd] in     do_dup2() from mispredictions both callers have verified that fd is not greater than ->max_fds; however,     misprediction might end up with tofree = fdt->fd[fd]; being speculatively executed. That's wrong for the     same reasons why it's wrong in close_fd()/file_close_fd_locked(); the same solution applies -     array_index_nospec(fd, fdt->max_fds) could differ from fd only in case of speculative execution on     mispredicted path. (CVE-2024-42265)

  - In the Linux kernel, the following vulnerability has been resolved: sysctl: always initialize i_uid/i_gid     Always initialize i_uid/i_gid inside the sysfs core so set_ownership() can safely skip setting them.
    Commit 5ec27ec735ba (fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.)     added defaults for i_uid/i_gid when set_ownership() was not implemented. It also missed adjusting     net_ctl_set_ownership() to use the same default values in case the computation of a better value failed.
    (CVE-2024-42312)

  - In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential deadlock on
    __exfat_get_dentry_set When accessing a file with more entries than ES_MAX_ENTRY_NUM, the bh-array is     allocated in __exfat_get_entry_set. The problem is that the bh-array is allocated with GFP_KERNEL. It does     not make sense. In the following cases, a deadlock for sbi->s_lock between the two processes may occur.
    CPU0 CPU1 ---- ---- kswapd balance_pgdat lock(fs_reclaim) exfat_iterate lock(&sbi->s_lock) exfat_readdir     exfat_get_uniname_from_ext_entry exfat_get_dentry_set __exfat_get_dentry_set kmalloc_array ...
    lock(fs_reclaim) ... evict exfat_evict_inode lock(&sbi->s_lock) To fix this, let's allocate bh-array with     GFP_NOFS. (CVE-2024-42315)

  - In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Fix NULL pointer     dereference in case of DT error in ks_pcie_setup_rc_app_regs() If IORESOURCE_MEM is not provided in Device     Tree due to any error, resource_list_first_type() will return NULL and pci_parse_request_of_pci_ranges()     will just emit a warning. This will cause a NULL pointer dereference. Fix this bug by adding NULL return     check. Found by Linux Verification Center (linuxtesting.org) with SVACE. (CVE-2024-43823)

  - In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure that     nfsd4_fattr_args.context is zeroed out If nfsd4_encode_fattr4 ends up doing a goto out before we get to     checking for the security label, then args.context will be set to uninitialized junk on the stack, which     we'll then try to free. Initialize it early. (CVE-2024-46697)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the microcode_ctl-20240910-1.el9 build changelog.

  - Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to     potentially enable information disclosure via local access. (CVE-2024-23984)

  - Incorrect behavior order in transition between executive monitor and SMI transfer monitor (STM) in some     Intel(R) Processor may allow a privileged user to potentially enable escalation of privilege via local     access. (CVE-2024-24853)

  - Improper finite state machines (FSMs) in hardware logic in some Intel(R) Processors may allow an     privileged user to potentially enable a denial of service via local access. (CVE-2024-24968)

  - Protection mechanism failure in some 3rd, 4th, and 5th Generation Intel(R) Xeon(R) Processors may allow a     privileged user to potentially enable escalation of privilege via local access. (CVE-2024-24980)

  - Mirrored regions with different values in 3rd Generation Intel(R) Xeon(R) Scalable Processors may allow a     privileged user to potentially enable denial of service via local access. (CVE-2024-25939)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-511.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: pipe: wakeup wr_wait after setting     max_usage Commit c73be61cede5 (pipe: Add general notification queue support) a regression was introduced     that would lock up resized pipes under certain conditions. See the reproducer in [1]. The commit resizing     the pipe ring size was moved to a different function, doing that moved the wakeup for pipe->wr_wait before     actually raising pipe->max_usage. If a pipe was full before the resize occured it would result in the     wakeup never actually triggering pipe_write. Set @max_usage and @nr_accounted before waking writers if     this isn't a watch queue. [Christian Brauner <brauner@kernel.org>: rewrite to account for watch queues]     (CVE-2023-52672)

  - In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix     pca953x_irq_bus_sync_unlock race Ensure that `i2c_lock' is held when setting interrupt latch and mask in     pca953x_irq_bus_sync_unlock() in order to avoid races. The other (non-probe) call site     pca953x_gpio_set_multiple() ensures the lock is held before calling pca953x_write_regs(). The problem     occurred when a request raced against irq_bus_sync_unlock() approximately once per thousand reboots on an     i.MX8MP based system. * Normal case 0-0022: write register AI|3a {03,02,00,00,01} Input latch P0 0-0022:
    write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0 0-0022: write register AI|08 {ff,00,00,00,00}     Output P3 0-0022: write register AI|12 {fc,00,00,00,00} Config P3 * Race case 0-0022: write register AI|08     {ff,00,00,00,00} Output P3 0-0022: write register AI|08 {03,02,00,00,01} *** Wrong register *** 0-0022:
    write register AI|12 {fc,00,00,00,00} Config P3 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt     mask P0 (CVE-2024-42253)

  - In the Linux kernel, the following vulnerability has been resolved: bonding: fix xfrm real_dev null     pointer dereference We shouldn't set real_dev to NULL because packets can be in transit and xfrm might     call xdo_dev_offload_ok() in parallel. All callbacks assume real_dev is set. Example trace: kernel: BUG:
    unable to handle page fault for address: 0000000000001030 kernel: bond0: (slave eni0np1): making interface     the new active one kernel: #PF: supervisor write access in kernel mode kernel: #PF: error_code(0x0002) -     not-present page kernel: PGD 0 P4D 0 kernel: Oops: 0002 [#1] PREEMPT SMP kernel: CPU: 4 PID: 2237 Comm:
    ping Not tainted 6.7.7+ #12 kernel: Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40     04/01/2014 kernel: RIP: 0010:nsim_ipsec_offload_ok+0xc/0x20 [netdevsim] kernel: bond0: (slave eni0np1):
    bond_ipsec_add_sa_all: failed to add SA kernel: Code: e0 0f 0b 48 83 7f 38 00 74 de 0f 0b 48 8b 47 08 48     8b 37 48 8b 78 40 e9 b2 e5 9a d7 66 90 0f 1f 44 00 00 48 8b 86 80 02 00 00 <83> 80 30 10 00 00 01 b8 01 00     00 00 c3 0f 1f 80 00 00 00 00 0f 1f kernel: bond0: (slave eni0np1): making interface the new active one     kernel: RSP: 0018:ffffabde81553b98 EFLAGS: 00010246 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all:
    failed to add SA kernel: kernel: RAX: 0000000000000000 RBX: ffff9eb404e74900 RCX: ffff9eb403d97c60 kernel:
    RDX: ffffffffc090de10 RSI: ffff9eb404e74900 RDI: ffff9eb3c5de9e00 kernel: RBP: ffff9eb3c0a42000 R08:
    0000000000000010 R09: 0000000000000014 kernel: R10: 7974203030303030 R11: 3030303030303030 R12:
    0000000000000000 kernel: R13: ffff9eb3c5de9e00 R14: ffffabde81553cc8 R15: ffff9eb404c53000 kernel: FS:
    00007f2a77a3ad00(0000) GS:ffff9eb43bd00000(0000) knlGS:0000000000000000 kernel: CS: 0010 DS: 0000 ES: 0000     CR0: 0000000080050033 kernel: CR2: 0000000000001030 CR3: 00000001122ab000 CR4: 0000000000350ef0 kernel:
    bond0: (slave eni0np1): making interface the new active one kernel: Call Trace: kernel: <TASK> kernel: ?
    __die+0x1f/0x60 kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel: ?     page_fault_oops+0x142/0x4c0 kernel: ? do_user_addr_fault+0x65/0x670 kernel: ?     kvm_read_and_reset_apf_flags+0x3b/0x50 kernel: bond0: (slave eni0np1): making interface the new active one     kernel: ? exc_page_fault+0x7b/0x180 kernel: ? asm_exc_page_fault+0x22/0x30 kernel: ?     nsim_bpf_uninit+0x50/0x50 [netdevsim] kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add     SA kernel: ? nsim_ipsec_offload_ok+0xc/0x20 [netdevsim] kernel: bond0: (slave eni0np1): making interface     the new active one kernel: bond_ipsec_offload_ok+0x7b/0x90 [bonding] kernel: xfrm_output+0x61/0x3b0     kernel: bond0: (slave eni0np1): bond_ipsec_add_sa_all: failed to add SA kernel:
    ip_push_pending_frames+0x56/0x80 (CVE-2024-44989)

  - In the Linux kernel, the following vulnerability has been resolved: bonding: fix null pointer deref in     bond_ipsec_offload_ok We must check if there is an active slave before dereferencing the pointer.
    (CVE-2024-44990)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-508.el9 build changelog.

  - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
    (CVE-2024-42226)

  - In the Linux kernel, the following vulnerability has been resolved: lib: objagg: Fix general protection     fault The library supports aggregation of objects into other objects only if the parent object does not     have a parent itself. That is, nesting is not supported. Aggregation happens in two cases: Without and     with hints, where hints are a pre-computed recommendation on how to aggregate the provided objects.
    Nesting is not possible in the first case due to a check that prevents it, but in the second case there is     no check because the assumption is that nesting cannot happen when creating objects based on hints. The     violation of this assumption leads to various warnings and eventually to a general protection fault [1].
    Before fixing the root cause, error out when nesting happens and warn. [1] general protection fault,     probably for non-canonical address 0xdead000000000d90: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 1083 Comm:
    kworker/1:9 Tainted: G W 6.9.0-rc6-custom-gd9b4f1cca7fb #7 Hardware name: Mellanox Technologies Ltd.
    MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP:
    0010:mlxsw_sp_acl_erp_bf_insert+0x25/0x80 [...] Call Trace: <TASK>     mlxsw_sp_acl_atcam_entry_add+0x256/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0     mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510     process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50     ret_from_fork_asm+0x1a/0x30 </TASK> (CVE-2024-43846)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the kernel-5.14.0-505.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: net/smc: reduce rtnl pressure in     smc_pnet_create_pnetids_list() Many syzbot reports show extreme rtnl pressure, and many of them hint that     smc acquires rtnl in netns creation for no good reason [1] This patch returns early from     smc_pnet_net_init() if there is no netdevice yet. I am not even sure why smc_pnet_create_pnetids_list()     even exists, because smc_pnet_netdev_event() is also calling smc_pnet_add_base_pnetid() when handling     NETDEV_UP event. [1] extract of typical syzbot reports 2 locks held by syz-executor.3/12252: #0:
    ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491     #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809     [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0     net/smc/smc_pnet.c:878 2 locks held by syz-executor.4/12253: #0: ffffffff8f369610     (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1:
    ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809     [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0     net/smc/smc_pnet.c:878 2 locks held by syz-executor.1/12257: #0: ffffffff8f369610     (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1:
    ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809     [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0     net/smc/smc_pnet.c:878 2 locks held by syz-executor.2/12261: #0: ffffffff8f369610     (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1:
    ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809     [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0     net/smc/smc_pnet.c:878 2 locks held by syz-executor.0/12265: #0: ffffffff8f369610     (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1:
    ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809     [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0     net/smc/smc_pnet.c:878 2 locks held by syz-executor.3/12268: #0: ffffffff8f369610     (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1:
    ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809     [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0     net/smc/smc_pnet.c:878 2 locks held by syz-executor.4/12271: #0: ffffffff8f369610     (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1:
    ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809     [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0     net/smc/smc_pnet.c:878 2 locks held by syz-executor.1/12274: #0: ffffffff8f369610     (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1:
    ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809     [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0     net/smc/smc_pnet.c:878 2 locks held by syz-executor.2/12280: #0: ffffffff8f369610     (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1:
    ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809     [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0     net/smc/smc_pnet.c:878 (CVE-2024-35934)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-503.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: null_blk: fix validation of block size     Block size should be between 512 and PAGE_SIZE and be a power of 2. The current check does not validate     this, so update the check. Without this patch, null_blk would Oops due to a null pointer deref when loaded     with bs=1536 [1]. [axboe: remove unnecessary braces and != 0 check] (CVE-2024-41077)

  - In the Linux kernel, the following vulnerability has been resolved: dev/parport: fix the array out-of-     bounds risk Fixed array out-of-bounds issues caused by sprintf by replacing it with snprintf for safer     data copying, ensuring the destination buffer is not overflowed. Below is the stack trace I encountered     during the actual issue: [ 66.575408s] [pid:5118,cpu4,QThread,4]Kernel panic - not syncing: stack-     protector: Kernel stack is corrupted in: do_hardware_base_addr+0xcc/0xd0 [parport] [ 66.575408s]     [pid:5118,cpu4,QThread,5]CPU: 4 PID: 5118 Comm: QThread Tainted: G S W O 5.10.97-arm64-desktop     #7100.57021.2 [ 66.575439s] [pid:5118,cpu4,QThread,6]TGID: 5087 Comm: EFileApp [ 66.575439s]     [pid:5118,cpu4,QThread,7]Hardware name: HUAWEI HUAWEI QingYun PGUX-W515x-B081/SP1PANGUXM, BIOS 1.00.07     04/29/2024 [ 66.575439s] [pid:5118,cpu4,QThread,8]Call trace: [ 66.575469s] [pid:5118,cpu4,QThread,9]     dump_backtrace+0x0/0x1c0 [ 66.575469s] [pid:5118,cpu4,QThread,0] show_stack+0x14/0x20 [ 66.575469s]     [pid:5118,cpu4,QThread,1] dump_stack+0xd4/0x10c [ 66.575500s] [pid:5118,cpu4,QThread,2] panic+0x1d8/0x3bc     [ 66.575500s] [pid:5118,cpu4,QThread,3] __stack_chk_fail+0x2c/0x38 [ 66.575500s] [pid:5118,cpu4,QThread,4]     do_hardware_base_addr+0xcc/0xd0 [parport] (CVE-2024-42301)

  - In the Linux kernel, the following vulnerability has been resolved: leds: trigger: Unregister sysfs     attributes before calling deactivate() Triggers which have trigger specific sysfs attributes typically     store related data in trigger-data allocated by the activate() callback and freed by the deactivate()     callback. Calling device_remove_groups() after calling deactivate() leaves a window where the sysfs     attributes show/store functions could be called after deactivation and then operate on the just freed     trigger-data. Move the device_remove_groups() call to before deactivate() to close this race window. This     also makes the deactivation path properly do things in reverse order of the activation path which calls     the activate() callback before calling device_add_groups(). (CVE-2024-43830)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssl-3.2.2-4.el9 build changelog.

  - SSL_select_next_proto buffer overread (CVE-2024-5535)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the curl-7.76.1-31.el9 build changelog.

  - When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers     for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting,     libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.
    Further, this error condition fails silently and is therefore not easily detected by an application.
    (CVE-2024-2398)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.19-8.el9 build changelog.

  - There is a HIGH severity vulnerability affecting the CPython zipfile module affecting zipfile.Path.
    Note that the more common API zipfile.ZipFile class is unaffected. When iterating over names of entries     in a zip archive (for example, methods of zipfile.Path like namelist(), iterdir(), etc) the process     can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading     only metadata or extracting the contents of the zip archive. Programs that are not handling user-     controlled zip archives are not affected. (CVE-2024-8088)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:5294 advisory.

  - latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a     large p2c (aka PBES2 Count) value. (CVE-2023-50967)

  - jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens     (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS),     and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces,     specifically related to the support for decompressing plaintext after its decryption. Under certain     conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory     during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
    (CVE-2024-28176)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.19-7.el9 build changelog.

  - There is a MEDIUM severity vulnerability affecting CPython. The email module didn't properly quote     newlines for email headers when serializing an email message allowing for header injection when an email     is serialized. (CVE-2024-6923)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python- setuptools-53.0.0-13.el9 build changelog.

  - A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote     code execution via its download functions. These functions, which are used to download packages from URLs     provided by users or retrieved from package index servers, are susceptible to code injection. If these     functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands     on the system. The issue is fixed in version 70.0. (CVE-2024-6345)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3980 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in     versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute     arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be     given a command to run in the specified Flatpak app, optionally along with some arguments. However it is     possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an     arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from     within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect     of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to     pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since     bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-     desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create     .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9,     1.12.9, and 1.14.6. (CVE-2024-32462)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3939 advisory.

  - Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow a     privileged user to potentially enable escalation of privilege via local access. (CVE-2022-27635,     CVE-2022-40964)

  - Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an     unauthenticated user to potentially enable denial of service via adjacent access. (CVE-2022-36351)

  - Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an     authenticated user to potentially enable escalation of privilege via local access. (CVE-2022-38076)

  - Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user     to potentially enable escalation of privilege via local access. (CVE-2022-46329)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:3669 advisory.

  - less through 653 allows OS command execution via a newline character in the name of a file, because     quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file     names, such as the files extracted from an untrusted archive. Exploitation also requires the LESSOPEN     environment variable, but this is set by default in many common cases. (CVE-2024-32487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0857 advisory.

  - Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a     different vulnerability than CVE-2022-22817 (which was about the expression parameter). (CVE-2023-50447)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.19-4.el9 build changelog.

  - The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were     designated as globally reachable or private. This affected the is_private and is_global properties of     the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network     classes, where values wouldn't be returned in accordance with the latest information from the IANA     Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these     registries and thus have the intended behavior. (CVE-2024-4032)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-479.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_netdev_start(): fix     UAF for rx_kref of j1939_priv It will trigger UAF for rx_kref of j1939_priv as following. cpu0 cpu1     j1939_sk_bind(socket0, ndev0, ...) j1939_netdev_start j1939_sk_bind(socket1, ndev0, ...)     j1939_netdev_start j1939_priv_set j1939_priv_get_by_ndev_locked j1939_jsk_add ..... j1939_netdev_stop     kref_put_lock(&priv->rx_kref, ...) kref_get(&priv->rx_kref, ...) REFCOUNT_WARN(addition on 0;...)     ==================================================== refcount_t: addition on 0; use-after-free. WARNING:
    CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 RIP:
    0010:refcount_warn_saturate+0x169/0x1e0 Call Trace: j1939_netdev_start+0x68b/0x920     j1939_sk_bind+0x426/0xeb0 ? security_socket_bind+0x83/0xb0 The rx_kref's kref_get() and kref_put() should     use j1939_netdev_lock to protect. (CVE-2021-47459)

  - In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix mirred deadlock on     device recursion When the mirred action is used on a classful egress qdisc and a packet is mirrored or     redirected to self we hit a qdisc lock deadlock. See trace below. [..... other info removed for     brevity....] [ 82.890906] [ 82.890906] ============================================ [ 82.890906] WARNING:
    possible recursive locking detected [ 82.890906] 6.8.0-05205-g77fadd89fe2d-dirty #213 Tainted: G W [     82.890906] -------------------------------------------- [ 82.890906] ping/418 is trying to acquire lock: [     82.890906] ffff888006994110 (&sch->q.lock){+.-.}-{3:3}, at: __dev_queue_xmit+0x1778/0x3550 [ 82.890906] [     82.890906] but task is already holding lock: [ 82.890906] ffff888006994110 (&sch->q.lock){+.-.}-{3:3}, at:
    __dev_queue_xmit+0x1778/0x3550 [ 82.890906] [ 82.890906] other info that might help us debug this: [     82.890906] Possible unsafe locking scenario: [ 82.890906] [ 82.890906] CPU0 [ 82.890906] ---- [ 82.890906]     lock(&sch->q.lock); [ 82.890906] lock(&sch->q.lock); [ 82.890906] [ 82.890906] *** DEADLOCK *** [     82.890906] [..... other info removed for brevity....] Example setup (eth0->eth0) to recreate tc qdisc add     dev eth0 root handle 1: htb default 30 tc filter add dev eth0 handle 1: protocol ip prio 2 matchall \     action mirred egress redirect dev eth0 Another example(eth0->eth1->eth0) to recreate tc qdisc add dev eth0     root handle 1: htb default 30 tc filter add dev eth0 handle 1: protocol ip prio 2 matchall \ action mirred     egress redirect dev eth1 tc qdisc add dev eth1 root handle 1: htb default 30 tc filter add dev eth1 handle     1: protocol ip prio 2 matchall \ action mirred egress redirect dev eth0 We fix this by adding an owner     field (CPU id) to struct Qdisc set after root qdisc is entered. When the softirq enters it a second time,     if the qdisc owner is the same CPU, the packet is dropped to break the loop. (CVE-2024-27010)

  - In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix possible out-of-bounds     in gsm0_receive() Assuming the following: - side A configures the n_gsm in basic option mode - side B     sends the header of a basic option mode frame with data length 1 - side A switches to advanced option mode
    - side B sends 2 data bytes which exceeds gsm->len Reason: gsm->len is not used in advanced option mode. -     side A switches to basic option mode - side B keeps sending until gsm0_receive() writes past gsm->buf     Reason: Neither gsm->state nor gsm->len have been reset after reconfiguration. Fix this by changing     gsm->count to gsm->len comparison from equal to less than. Also add upper limit checks against the     constant MAX_MRU in gsm0_receive() and gsm1_receive() to harden against memory corruption of gsm->len and     gsm->mru. All other checks remain as we still need to limit the data according to the user configuration     and actual payload size. (CVE-2024-36016)

  - In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested     IFLA_VF_VLAN_LIST attribute validation Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a     struct ifla_vf_vlan_info so the size of such attribute needs to be at least of sizeof(struct     ifla_vf_vlan_info) which is 14 bytes. The current size validation in do_setvfinfo is against NLA_HDRLEN (4     bytes) which is less than sizeof(struct ifla_vf_vlan_info) so this validation is not enough and a too     small attribute might be cast to a struct ifla_vf_vlan_info, this might result in an out of bands read     access when accessing the saved (casted) entry in ivvl. (CVE-2024-36017)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssh-8.7p1-43.el9 build changelog.

  - A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a     remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called     asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for     example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be     able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.
    (CVE-2024-6409)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-474.el9 build changelog.

  - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
    (CVE-2023-52651)

  - In the Linux kernel, the following vulnerability has been resolved: io_uring: drop any code related to     SCM_RIGHTS This is dead code after we dropped support for passing io_uring fds over SCM_RIGHTS, get rid of     it. (CVE-2023-52656)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921e: fix use-after-     free in free_irq() From commit a304e1b82808 ([PATCH] Debug shared irqs), there is a test to make sure     the shared irq handler should be able to handle the unexpected event after deregistration. For this case,     let's apply MT76_REMOVED flag to indicate the device was removed and do not run into the resource access     anymore. BUG: KASAN: use-after-free in mt7921_irq_handler+0xd8/0x100 [mt7921e] Read of size 8 at addr     ffff88824a7d3b78 by task rmmod/11115 CPU: 28 PID: 11115 Comm: rmmod Tainted: G W L 5.17.0 #10 Hardware     name: Micro-Star International Co., Ltd. MS-7D73/MPG B650I EDGE WIFI (MS-7D73), BIOS 1.81 01/05/2024 Call     Trace: <TASK> dump_stack_lvl+0x6f/0xa0 print_address_description.constprop.0+0x1f/0x190 ?     mt7921_irq_handler+0xd8/0x100 [mt7921e] ? mt7921_irq_handler+0xd8/0x100 [mt7921e]     kasan_report.cold+0x7f/0x11b ? mt7921_irq_handler+0xd8/0x100 [mt7921e] mt7921_irq_handler+0xd8/0x100     [mt7921e] free_irq+0x627/0xaa0 devm_free_irq+0x94/0xd0 ? devm_request_any_context_irq+0x160/0x160 ?     kobject_put+0x18d/0x4a0 mt7921_pci_remove+0x153/0x190 [mt7921e] pci_device_remove+0xa2/0x1d0
    __device_release_driver+0x346/0x6e0 driver_detach+0x1ef/0x2c0 bus_remove_driver+0xe7/0x2d0 ?
    __check_object_size+0x57/0x310 pci_unregister_driver+0x26/0x250 __do_sys_delete_module+0x307/0x510 ?     free_module+0x6a0/0x6a0 ? fpregs_assert_state_consistent+0x4b/0xb0 ? rcu_read_lock_sched_held+0x10/0x70 ?     syscall_enter_from_user_mode+0x20/0x70 ? trace_hardirqs_on+0x1c/0x130 do_syscall_64+0x5c/0x80 ?     trace_hardirqs_on_prepare+0x72/0x160 ? do_syscall_64+0x68/0x80 ? trace_hardirqs_on_prepare+0x72/0x160     entry_SYSCALL_64_after_hwframe+0x44/0xae (CVE-2024-26892)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: delay all of     ath9k_wmi_event_tasklet() until init is complete The ath9k_wmi_event_tasklet() used in ath9k_htc assumes     that all the data structures have been fully initialised by the time it runs. However, because of the     order in which things are initialised, this is not guaranteed to be the case, because the device is     exposed to the USB subsystem before the ath9k driver initialisation is completed. We already committed a     partial fix for this in commit: 8b3046abc99e (ath9k_htc: fix NULL pointer dereference at     ath9k_htc_tx_get_packet()) However, that commit only aborted the WMI_TXSTATUS_EVENTID command in the     event tasklet, pairing it with an initialisation complete bit in the TX struct. It seems syzbot managed     to trigger the race for one of the other commands as well, so let's just move the existing synchronisation     bit to cover the whole tasklet (setting it at the end of ath9k_htc_probe_device() instead of inside     ath9k_tx_init()). (CVE-2024-26897)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: handle pmk_op     allocation failure The kzalloc() in brcmf_pmksa_v3_op() will return null if the physical memory has run     out. As a result, if we dereference the null value, the null pointer dereference bug will happen. Return
    -ENOMEM from brcmf_pmksa_v3_op() if kzalloc() fails for pmk_op. (CVE-2024-27048)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925e: fix use-after-     free in free_irq() From commit a304e1b82808 ([PATCH] Debug shared irqs), there is a test to make sure     the shared irq handler should be able to handle the unexpected event after deregistration. For this case,     let's apply MT76_REMOVED flag to indicate the device was removed and do not run into the resource access     anymore. (CVE-2024-27049)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: add cancel_work_sync()     for c2hcmd_work The workqueue might still be running, when the driver is stopped. To avoid a use-after-     free, call cancel_work_sync() in rtl8xxxu_stop(). (CVE-2024-27052)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't set the MFP     flag for the GTK The firmware doesn't need the MFP flag for the GTK, it can even make the firmware crash.
    in case the AP is configured with: group cipher TKIP and MFPC. We would send the GTK with cipher = TKIP     and MFP which is of course not possible. (CVE-2024-27434)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx     for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the     fast_rx entry still holds a pointer to the VLAN's netdev, which can cause use-after-free bugs. Fix this by     immediately calling ieee80211_check_fast_rx after the VLAN change. (CVE-2024-35789)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL     termination The iwl_fw_ini_debug_info_tlv is used as a string, so we must ensure the string is terminated     correctly before using it. (CVE-2024-35845)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: rfi: fix potential     response leaks If the rx payload length check fails, or if kmemdup() fails, we still need to free the     command response. Fix that. (CVE-2024-35912)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: pick the version     of SESSION_PROTECTION_NOTIF When we want to know whether we should look for the mac_id or the link_id in     struct iwl_mvm_session_prot_notif, we should look at the version of SESSION_PROTECTION_NOTIF. This causes     WARNINGs: WARNING: CPU: 0 PID: 11403 at drivers/net/wireless/intel/iwlwifi/mvm/time-event.c:959     iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm] RIP:
    0010:iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm] Code: 00 49 c7 84 24 48 07 00 00 00 00 00 00 41     c6 84 24 78 07 00 00 ff 4c 89 f7 e8 e9 71 54 d9 e9 7d fd ff ff 0f 0b e9 23 fe ff ff <0f> 0b e9 1c fe ff ff     66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffb4bb00003d40 EFLAGS: 00010202 RAX:
    0000000000000000 RBX: ffff9ae63a361000 RCX: ffff9ae4a98b60d4 RDX: ffff9ae4588499c0 RSI: 0000000000000305     RDI: ffff9ae4a98b6358 RBP: ffffb4bb00003d68 R08: 0000000000000003 R09: 0000000000000010 R10:
    ffffb4bb00003d00 R11: 000000000000000f R12: ffff9ae441399050 R13: ffff9ae4761329e8 R14: 0000000000000001     R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff9ae7af400000(0000) knlGS:0000000000000000 CS: 0010     DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055fb75680018 CR3: 00000003dae32006 CR4: 0000000000f70ef0     PKRU: 55555554 Call Trace: <IRQ> ? show_regs+0x69/0x80 ? __warn+0x8d/0x150 ?     iwl_mvm_rx_session_protect_notif+0x333/0x340 [iwlmvm] ? report_bug+0x196/0x1c0 ? handle_bug+0x45/0x80 ?     exc_invalid_op+0x1c/0xb0 ? asm_exc_invalid_op+0x1f/0x30 ? iwl_mvm_rx_session_protect_notif+0x333/0x340     [iwlmvm] iwl_mvm_rx_common+0x115/0x340 [iwlmvm] iwl_mvm_rx_mq+0xa6/0x100 [iwlmvm]     iwl_pcie_rx_handle+0x263/0xa10 [iwlwifi] iwl_pcie_napi_poll_msix+0x32/0xd0 [iwlwifi] (CVE-2024-35913)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check A-MSDU format     more carefully If it looks like there's another subframe in the A-MSDU but the header isn't fully there,     we can end up reading data out of bounds, only to discard later. Make this a bit more careful and check if     the subframe header can even be present. (CVE-2024-35937)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: decrease MHI channel     buffer length to 8KB Currently buf_len field of ath11k_mhi_config_qca6390 is assigned with 0, making MHI     use a default size, 64KB, to allocate channel buffers. This is likely to fail in some scenarios where     system memory is highly fragmented and memory compaction or reclaim is not allowed. There is a fail report     which is caused by it: kworker/u32:45: page allocation failure: order:4,     mode:0x40c00(GFP_NOIO|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0 CPU: 0 PID: 19318 Comm:
    kworker/u32:45 Not tainted 6.8.0-rc3-1.gae4495f-default #1 openSUSE Tumbleweed (unreleased)     493b6d5b382c603654d7a81fc3c144d59a1dfceb Workqueue: events_unbound async_run_entry_fn Call Trace: <TASK>     dump_stack_lvl+0x47/0x60 warn_alloc+0x13a/0x1b0 ? srso_alias_return_thunk+0x5/0xfbef5 ?
    __alloc_pages_direct_compact+0xab/0x210 __alloc_pages_slowpath.constprop.0+0xd3e/0xda0
    __alloc_pages+0x32d/0x350 ? mhi_prepare_channel+0x127/0x2d0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814]
    __kmalloc_large_node+0x72/0x110 __kmalloc+0x37c/0x480 ? mhi_map_single_no_bb+0x77/0xf0 [mhi     40df44e07c05479f7a6e7b90fba9f0e0031a7814] ? mhi_prepare_channel+0x127/0x2d0 [mhi     40df44e07c05479f7a6e7b90fba9f0e0031a7814] mhi_prepare_channel+0x127/0x2d0 [mhi     40df44e07c05479f7a6e7b90fba9f0e0031a7814] __mhi_prepare_for_transfer+0x44/0x80 [mhi     40df44e07c05479f7a6e7b90fba9f0e0031a7814] ? __pfx_____mhi_prepare_for_transfer+0x10/0x10 [mhi     40df44e07c05479f7a6e7b90fba9f0e0031a7814] device_for_each_child+0x5c/0xa0 ? __pfx_pci_pm_resume+0x10/0x10     ath11k_core_resume+0x65/0x100 [ath11k a5094e22d7223135c40d93c8f5321cf09fd85e4e] ?     srso_alias_return_thunk+0x5/0xfbef5 ath11k_pci_pm_resume+0x32/0x60 [ath11k_pci     830b7bfc3ea80ebef32e563cafe2cb55e9cc73ec] ? srso_alias_return_thunk+0x5/0xfbef5     dpm_run_callback+0x8c/0x1e0 device_resume+0x104/0x340 ? __pfx_dpm_watchdog_handler+0x10/0x10     async_resume+0x1d/0x30 async_run_entry_fn+0x32/0x120 process_one_work+0x168/0x330     worker_thread+0x2f5/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xe8/0x120 ? __pfx_kthread+0x10/0x10     ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Actually those     buffers are used only by QMI target -> host communication. And for WCN6855 and QCA6390, the largest packet     size for that is less than 6KB. So change buf_len field to 8KB, which results in order 1 allocation if     page size is 4KB. In this way, we can at least save some memory, and as well as decrease the possibility     of allocation failure in those scenarios. Tested-on: WCN6855 hw2.0 PCI     WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30 (CVE-2024-35938)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix null pointer access     when abort scan During cancel scan we might use vif that weren't scanning. Fix this by using the actual     scanning vif. (CVE-2024-35946)

  - In the Linux kernel, the following vulnerability has been resolved: mm: use memalloc_nofs_save() in     page_cache_ra_order() See commit f2c817bed58d (mm: use memalloc_nofs_save in readahead path), ensure     that page_cache_ra_order() do not attempt to reclaim file-backed pages too, or it leads to a deadlock,     found issue when test ext4 large folio. INFO: task DataXceiver for:7494 blocked for more than 120 seconds.
    echo 0 > /proc/sys/kernel/hung_task_timeout_secs disables this message. task:DataXceiver for state:D     stack:0 pid:7494 ppid:1 flags:0x00000200 Call trace: __switch_to+0x14c/0x240 __schedule+0x82c/0xdd0     schedule+0x58/0xf0 io_schedule+0x24/0xa0 __folio_lock+0x130/0x300 migrate_pages_batch+0x378/0x918     migrate_pages+0x350/0x700 compact_zone+0x63c/0xb38 compact_zone_order+0xc0/0x118     try_to_compact_pages+0xb0/0x280 __alloc_pages_direct_compact+0x98/0x248 __alloc_pages+0x510/0x1110     alloc_pages+0x9c/0x130 folio_alloc+0x20/0x78 filemap_alloc_folio+0x8c/0x1b0     page_cache_ra_order+0x174/0x308 ondemand_readahead+0x1c8/0x2b8 page_cache_async_ra+0x68/0xb8     filemap_readahead.isra.0+0x64/0xa8 filemap_get_pages+0x3fc/0x5b0 filemap_splice_read+0xf4/0x280     ext4_file_splice_read+0x2c/0x48 [ext4] vfs_splice_read.part.0+0xa8/0x118 splice_direct_to_actor+0xbc/0x288     do_splice_direct+0x9c/0x108 do_sendfile+0x328/0x468 __arm64_sys_sendfile64+0x8c/0x148     invoke_syscall+0x4c/0x118 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x4c/0x1f8     el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x188/0x190 (CVE-2024-36882)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: guard against     invalid STA ID on removal Guard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would result     in out-of-bounds array accesses. This prevents issues should the driver get into a bad state during error     handling. (CVE-2024-36921)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: read txq->read_ptr     under lock If we read txq->read_ptr without lock, we can read the same value twice, then obtain the lock,     and reclaim from there to two different places, but crucially reclaim the same entry twice, resulting in     the WARN_ONCE() a little later. Fix that by reading txq->read_ptr under lock. (CVE-2024-36922)

  - In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: don't free NULL     coalescing rule If the parsing fails, we can dereference a NULL pointer here. (CVE-2024-36941)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssh-8.7p1-42.el9 build changelog.

  - A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition     which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may     be able to trigger it by failing to authenticate within a set time period. (CVE-2024-6387)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the cockpit-320-1.el9 build changelog.

  - A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when     enabling the pam_env's user_readenv option, which leads to a denial of service (DoS) attack.
    (CVE-2024-6126)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-472.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: xsk: fix usage of multi-buffer BPF     helpers for ZC XDP Currently when packet is shrunk via bpf_xdp_adjust_tail() and memory type is set to     MEM_TYPE_XSK_BUFF_POOL, null ptr dereference happens: [1136314.192256] BUG: kernel NULL pointer     dereference, address: 0000000000000034 [1136314.203943] #PF: supervisor read access in kernel mode     [1136314.213768] #PF: error_code(0x0000) - not-present page [1136314.223550] PGD 0 P4D 0 [1136314.230684]     Oops: 0000 [#1] PREEMPT SMP NOPTI [1136314.239621] CPU: 8 PID: 54203 Comm: xdpsock Not tainted 6.6.0+ #257     [1136314.250469] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS     SE5C620.86B.02.01.0008.031920191559 03/19/2019 [1136314.265615] RIP: 0010:__xdp_return+0x6c/0x210     [1136314.274653] Code: ad 00 48 8b 47 08 49 89 f8 a8 01 0f 85 9b 01 00 00 0f 1f 44 00 00 f0 41 ff 48 34 75     32 4c 89 c7 e9 79 cd 80 ff 83 fe 03 75 17 <f6> 41 34 01 0f 85 02 01 00 00 48 89 cf e9 22 cc 1e 00 e9 3d d2     86 [1136314.302907] RSP: 0018:ffffc900089f8db0 EFLAGS: 00010246 [1136314.312967] RAX: ffffc9003168aed0     RBX: ffff8881c3300000 RCX: 0000000000000000 [1136314.324953] RDX: 0000000000000000 RSI: 0000000000000003     RDI: ffffc9003168c000 [1136314.336929] RBP: 0000000000000ae0 R08: 0000000000000002 R09: 0000000000010000     [1136314.348844] R10: ffffc9000e495000 R11: 0000000000000040 R12: 0000000000000001 [1136314.360706] R13:
    0000000000000524 R14: ffffc9003168aec0 R15: 0000000000000001 [1136314.373298] FS: 00007f8df8bbcb80(0000)     GS:ffff8897e0e00000(0000) knlGS:0000000000000000 [1136314.386105] CS: 0010 DS: 0000 ES: 0000 CR0:
    0000000080050033 [1136314.396532] CR2: 0000000000000034 CR3: 00000001aa912002 CR4: 00000000007706f0     [1136314.408377] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1136314.420173] DR3:
    0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1136314.431890] PKRU: 55555554     [1136314.439143] Call Trace: [1136314.446058] <IRQ> [1136314.452465] ? __die+0x20/0x70 [1136314.459881] ?     page_fault_oops+0x15b/0x440 [1136314.468305] ? exc_page_fault+0x6a/0x150 [1136314.476491] ?     asm_exc_page_fault+0x22/0x30 [1136314.484927] ? __xdp_return+0x6c/0x210 [1136314.492863]     bpf_xdp_adjust_tail+0x155/0x1d0 [1136314.501269] bpf_prog_ccc47ae29d3b6570_xdp_sock_prog+0x15/0x60     [1136314.511263] ice_clean_rx_irq_zc+0x206/0xc60 [ice] [1136314.520222] ? ice_xmit_zc+0x6e/0x150 [ice]     [1136314.528506] ice_napi_poll+0x467/0x670 [ice] [1136314.536858] ?     ttwu_do_activate.constprop.0+0x8f/0x1a0 [1136314.546010] __napi_poll+0x29/0x1b0 [1136314.553462]     net_rx_action+0x133/0x270 [1136314.561619] __do_softirq+0xbe/0x28e [1136314.569303] do_softirq+0x3f/0x60     This comes from __xdp_return() call with xdp_buff argument passed as NULL which is supposed to be consumed     by xsk_buff_free() call. To address this properly, in ZC case, a node that represents the frag being     removed has to be pulled out of xskb_list. Introduce appropriate xsk helpers to do such node operation and     use them accordingly within bpf_xdp_adjust_tail(). (CVE-2024-26611)

  - In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from     corrupted group in ext4_mb_find_by_goal() Places the logic for checking if the group's block bitmap is     corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted     block bitmap. (CVE-2024-26772)

  - In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line     resize We observed a corruption during on-line resize of a file system that is larger than 16 TiB with 4k     block size. With having more then 2^32 blocks resize_inode is turned off by default by mke2fs. The issue     can be reproduced on a smaller file system for convenience by explicitly turning off resize_inode. An on-     line resize across an 8 GiB boundary (the size of a meta block group in this setup) then leads to a     corruption: dev=/dev/<some_dev> # should be >= 16 GiB mkdir -p /corruption /sbin/mke2fs -t ext4 -b 4096 -O     ^resize_inode $dev $((2 * 2**21 - 2**15)) mount -t ext4 $dev /corruption dd if=/dev/zero bs=4096     of=/corruption/test count=$((2*2**21 - 4*2**15)) sha1sum /corruption/test #     79d2658b39dcfd77274e435b0934028adafaab11 /corruption/test /sbin/resize2fs $dev $((2*2**21)) # drop page     cache to force reload the block from disk echo 1 > /proc/sys/vm/drop_caches sha1sum /corruption/test #     3c2abc63cbf1a94c9e6977e0fbd72cd832c4d5c3 /corruption/test 2^21 = 2^15*2^6 equals 8 GiB whereof 2^15 is the     number of blocks per block group and 2^6 are the number of block groups that make a meta block group. The     last checksum might be different depending on how the file is laid out across the physical blocks. The     actual corruption occurs at physical block 63*2^15 = 2064384 which would be the location of the backup of     the meta block group's block descriptor. During the on-line resize the file system will be converted to     meta_bg starting at s_first_meta_bg which is 2 in the example - meaning all block groups after 16 GiB.
    However, in ext4_flex_group_add we might add block groups that are not part of the first meta block group     yet. In the reproducer we achieved this by substracting the size of a whole block group from the point     where the meta block group would start. This must be considered when updating the backup block group     descriptors to follow the non-meta_bg layout. The fix is to add a test whether the group to add is already     part of the meta block group or not. (CVE-2024-35807)

  - In the Linux kernel, the following vulnerability has been resolved: block: fix overflow in     blk_ioctl_discard() There is no check for overflow of 'start + len' in blk_ioctl_discard(). Hung task     occurs if submit an discard ioctl with the following param: start = 0x80000000000ff000, len =     0x8000000000fff000; Add the overflow validation now. (CVE-2024-36917)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the python- urllib3-1.26.5-6.el9 build changelog.

  - urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with     `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected.
    However, when sending HTTP requests *without* using urllib3's proxy support, it's possible to accidentally     configure the `Proxy-Authorization` header even though it won't have any effect as the request is not     using a forwarding proxy or a tunneling proxy. In those cases, urllib3 doesn't treat the `Proxy-     Authorization` HTTP header as one carrying authentication material and thus doesn't strip the header on     cross-origin redirects. Because this is a highly unlikely scenario, we believe the severity of this     vulnerability is low for almost all users. Out of an abundance of caution urllib3 will automatically strip     the `Proxy-Authorization` header during cross-origin redirects to avoid the small chance that users are     doing this on accident. Users should use urllib3's proxy support or disable automatic redirects to achieve     safe processing of the `Proxy-Authorization` header, but we still decided to strip the header by default     in order to further protect users who aren't using the correct approach. We believe the number of usages     affected by this advisory is low. It requires all of the following to be true to be exploited: 1. Setting     the `Proxy-Authorization` header without using urllib3's built-in proxy support. 2. Not disabling HTTP     redirects. 3. Either not using an HTTPS origin server or for the proxy or target origin to redirect to a     malicious origin. Users are advised to update to either version 1.26.19 or version 2.2.2. Users unable to     upgrade may use the `Proxy-Authorization` header with urllib3's `ProxyManager`, disable HTTP redirects     using `redirects=False` when sending requests, or not user the `Proxy-Authorization` header as     mitigations. (CVE-2024-37891)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4160 advisory.

  - The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0     through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper     enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters. IBM X-Force ID: 260578.
    (CVE-2023-38264)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-467.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: efivarfs: force RO when remounting if     SetVariable is not supported If SetVariable at runtime is not supported by the firmware we never assign a     callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we     never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a     crash looking like this: $ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [     303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [     303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current     EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04:
    level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [     303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error:
    Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core     crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm:
    efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown     Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv     daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr :
    efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29:
    ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25:
    ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21:
    ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [     303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14:
    ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10:
    0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 :
    0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [     303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [     303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585]     efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [     303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156]     el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [     303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code:
    ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]--- Fix this     by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and     deny anything that's not RO if the firmware doesn't implement SetVariable at runtime. (CVE-2023-52463)

  - This CVE was assigned by Intel. Please see CVE-2024-2201 on CVE.org for more information. (CVE-2024-2201)

  - In the Linux kernel, the following vulnerability has been resolved: block: prevent division by zero in     blk_rq_stat_sum() The expression dst->nr_samples + src->nr_samples may have zero value on overflow. It is     necessary to add a check to avoid division by zero. Found by Linux Verification Center (linuxtesting.org)     with Svace. (CVE-2024-35925)

  - In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration     on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting     to turn it permanent. This causes a problem for DNS resolution as the expiration set by user-space is     overwritten to TIME64_MAX, disabling further DNS updates. Fix this by restoring the condition that     key_set_expiry is only called when the pre-parser sets a specific expiry. (CVE-2024-36031)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4016 advisory.

  - If a garbage collection was triggered at the right time, a use-after-free could have occurred during     object transplant. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird <     115.12. (CVE-2024-5688)

  - By monitoring the time certain operations take, an attacker could have guessed which external protocol     handlers were functional on a user's system. This vulnerability affects Firefox < 127, Firefox ESR <     115.12, and Thunderbird < 115.12. (CVE-2024-5690)

  - By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button     that, if clicked by a user, would bypass restrictions to open a new window. This vulnerability affects     Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. (CVE-2024-5691)

  - Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data     from another site in violation of same-origin policy. This vulnerability affects Firefox < 127, Firefox     ESR < 115.12, and Thunderbird < 115.12. (CVE-2024-5693)

  - By manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory leading     to a potentially exploitable crash. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and     Thunderbird < 115.12. (CVE-2024-5696)

  - Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and     Thunderbird < 115.12. (CVE-2024-5700)

  - Memory corruption in the networking stack could have led to a potentially exploitable crash. This     vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12. (CVE-2024-5702)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3741 advisory.

  - The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through     9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1     through 9.18.21-S1. (CVE-2023-4408)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:3951 advisory.

  - If a garbage collection was triggered at the right time, a use-after-free could have occurred during     object transplant. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird <     115.12. (CVE-2024-5688)

  - By monitoring the time certain operations take, an attacker could have guessed which external protocol     handlers were functional on a user's system. This vulnerability affects Firefox < 127, Firefox ESR <     115.12, and Thunderbird < 115.12. (CVE-2024-5690)

  - By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button     that, if clicked by a user, would bypass restrictions to open a new window. This vulnerability affects     Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. (CVE-2024-5691)

  - Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data     from another site in violation of same-origin policy. This vulnerability affects Firefox < 127, Firefox     ESR < 115.12, and Thunderbird < 115.12. (CVE-2024-5693)

  - By manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory leading     to a potentially exploitable crash. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and     Thunderbird < 115.12. (CVE-2024-5696)

  - Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and     Thunderbird < 115.12. (CVE-2024-5700)

  - Memory corruption in the networking stack could have led to a potentially exploitable crash. This     vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12. (CVE-2024-5702)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3760 advisory.

  - A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client's     session key. This key is different for each new session, which protects it from brute force attacks.
    However, the ticket it contains is encrypted using the target principal key directly. For user principals,     this key is a hash of a public per-principal randomly-generated salt and the user's password. If a     principal is compromised it means the attacker would be able to retrieve tickets encrypted to any     principal, all of them being encrypted by their own key directly. By taking these tickets and salts     offline, the attacker could run brute force attacks to find character strings able to decrypt tickets when     combined to a principal salt (i.e. find the principal's password). (CVE-2024-3183)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3591 advisory.

  - A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an     authenticated user to cause a server crash while modifying `userPassword` using malformed input.
    (CVE-2024-2199)

  - A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the     directory server, leading to a denial of service (CVE-2024-3657)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the openssl-3.2.2-1.el9 build changelog.

  - Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when     processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to     trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3     if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured     and the default anti-replay protection is in use). In this case, under certain conditions, the session     cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache     will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario     for this failure to force a Denial of Service. It may also happen by accident in normal operation. This     issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in     3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.
    (CVE-2024-2511)

  - Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary:
    Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA     public key or DSA parameters may experience long delays. Where the key or parameters that are being     checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions     EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those     computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large     modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in     length for signature verification. However the key and parameter check functions do not limit the modulus     size when performing the checks. An application that calls EVP_PKEY_param_check() or     EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be     vulnerable to a Denial of Service attack. These functions are not called by OpenSSL itself on untrusted     DSA keys so only applications that directly call these functions may be vulnerable. Also vulnerable are     the OpenSSL pkey and pkeyparam command line applications when using the `-check` option. The OpenSSL     SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected     by this issue. (CVE-2024-4603)

  - Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was     previously freed in some situations Impact summary: A use after free can have a range of potential     consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only     applications that directly call the SSL_free_buffers function are affected by this issue. Applications     that do not call this function are not vulnerable. Our investigations indicate that this function is     rarely used by applications. The SSL_free_buffers function is used to free the internal OpenSSL buffer     used when processing an incoming record from the network. The call is only expected to succeed if the     buffer is not currently in use. However, two scenarios have been identified where the buffer is freed even     when still in use. The first scenario occurs where a record header has been received from the network and     processed by OpenSSL, but the full record body has not yet arrived. In this case calling SSL_free_buffers     will succeed even though a record has only been partially processed and the buffer is still in use. The     second scenario occurs where a full record containing application data has been received and processed by     OpenSSL but the application has only read part of this data. Again a call to SSL_free_buffers will succeed     even though the buffer is still in use. While these scenarios could occur accidentally during normal     operation a malicious attacker could attempt to engineer a stituation where this occurs. We are not aware     of this issue being actively exploited. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this     issue. Found by William Ahern (Akamai). Fix developed by Matt Caswell. Fix developed by Watson Ladd     (Akamai). Fixed in OpenSSL 3.3.1 (Affected since 3.3.0). (CVE-2024-4741)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3588 advisory.

  - The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to     it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to     crash an application or overwrite a neighbouring variable. (CVE-2024-2961)

  - nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size     cache is exhausted by client requests then a subsequent client request for netgroup data may result in a     stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This     vulnerability is only present in the nscd binary. (CVE-2024-33599)

  - nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails     to add a not-found netgroup response to the cache, the client request can result in a null pointer     dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability     is only present in the nscd binary. (CVE-2024-33600)

  - nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's     (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a     memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in     glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.
    (CVE-2024-33601)

  - nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd)     netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer.
    The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present     in the nscd binary. (CVE-2024-33602)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3340 advisory.

  - .NET and Visual Studio Remote Code Execution Vulnerability (CVE-2024-30045)

  - Visual Studio Denial of Service Vulnerability (CVE-2024-30046)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3344 advisory.

  - nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size     cache is exhausted by client requests then a subsequent client request for netgroup data may result in a     stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This     vulnerability is only present in the nscd binary. (CVE-2024-33599)

  - nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails     to add a not-found netgroup response to the cache, the client request can result in a null pointer     dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability     is only present in the nscd binary. (CVE-2024-33600)

  - nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's     (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a     memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in     glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.
    (CVE-2024-33601)

  - nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd)     netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer.
    The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present     in the nscd binary. (CVE-2024-33602)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:3343 advisory.

  - A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents()     function. This issue occurs when byte-swapped length values are used in replies, potentially leading to     memory leakage and segmentation faults, particularly when triggered by a client with a different     endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory     values and then transmit them back to the client until encountering an unmapped page, resulting in a     crash. Despite the attacker's inability to control the specific memory copied into the replies, the small     length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds     reads. (CVE-2024-31080)

  - A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice()     function. This issue occurs when byte-swapped length values are used in replies, potentially leading to     memory leakage and segmentation faults, particularly when triggered by a client with a different     endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory     values and then transmit them back to the client until encountering an unmapped page, resulting in a     crash. Despite the attacker's inability to control the specific memory copied into the replies, the small     length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds     reads. (CVE-2024-31081)

  - A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue     occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially     resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently,     ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer     is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the     system by sending a specially crafted request. (CVE-2024-31083)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3347 advisory.

  - An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7,     3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks     during cleanup of permissions-related errors. This means users which can run privileged programs are     potentially able to modify permissions of files referenced by symlinks in some circumstances.
    (CVE-2023-6597)

  - An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and     3.8.18 and prior. The zipfile module is vulnerable to quoted-overlap zip-bombs which exploit the zip     format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile     module reject zip archives which overlap entries in the archive. (CVE-2024-0450)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3261 advisory.

  - A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents()     function. This issue occurs when byte-swapped length values are used in replies, potentially leading to     memory leakage and segmentation faults, particularly when triggered by a client with a different     endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory     values and then transmit them back to the client until encountering an unmapped page, resulting in a     crash. Despite the attacker's inability to control the specific memory copied into the replies, the small     length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds     reads. (CVE-2024-31080)

  - A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice()     function. This issue occurs when byte-swapped length values are used in replies, potentially leading to     memory leakage and segmentation faults, particularly when triggered by a client with a different     endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory     values and then transmit them back to the client until encountering an unmapped page, resulting in a     crash. Despite the attacker's inability to control the specific memory copied into the replies, the small     length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds     reads. (CVE-2024-31081)

  - A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue     occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially     resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently,     ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer     is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the     system by sending a specially crafted request. (CVE-2024-31083)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:2968 advisory.

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP     request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method     changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs.
    Although this behavior is not specified in the section for redirects, it can be inferred by piecing     together information from different sections and we have observed the behavior in other major HTTP client     implementations like curl and web browsers. Because the vulnerability requires a previously trusted     service to become compromised in order to have an impact on confidentiality we believe the exploitability     of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request     bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions     must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information     in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts     redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised.
    This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve     this issue. Users unable to update should disable redirects for services that aren't expecting to respond     with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle     301, 302, and 303 redirects manually by stripping the HTTP request body. (CVE-2023-45803)

  - PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable     for a Manger attack. (CVE-2023-52323)

  - Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar     to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template,     potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject     arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to     XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
    (CVE-2024-22195)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3067 advisory.

  - A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and     legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if     the pointer is warped from within a window on one screen to the root window of the other screen and if the     original window is destroyed followed by another window being destroyed. (CVE-2023-5380)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
208465	CentOS 6 : chromium-browser (RHSA-2020:0779)	high
208464	CentOS 6 : chromium-browser (RHSA-2020:0738)	high
208463	CentOS 6 : chromium-browser (RHSA-2020:0005)	high
208462	CentOS 6 : chromium-browser (RHSA-2020:1504)	critical
208461	CentOS 6 : chromium-browser (RHSA-2020:1487)	high
208460	CentOS 6 : java-1.7.1-ibm (RHSA-2020:0467)	high
208459	CentOS 6 : chromium-browser (RHSA-2020:0214)	high
208458	CentOS 6 : chromium-browser (RHSA-2020:1270)	high
208457	CentOS 6 : chromium-browser (RHSA-2020:0514)	high
208456	CentOS 6 : chromium-browser (RHSA-2020:1350)	high
207918	CentOS 9 : kernel-5.14.0-513.el9	medium
207917	CentOS 9 : microcode_ctl-20240910-1.el9	high
207605	CentOS 9 : kernel-5.14.0-511.el9	medium
207285	CentOS 9 : kernel-5.14.0-508.el9	medium
206792	CentOS 9 : kernel-5.14.0-505.el9	low
206294	CentOS 9 : kernel-5.14.0-503.el9	high
206293	CentOS 9 : openssl-3.2.2-4.el9	critical
206292	CentOS 9 : curl-7.76.1-31.el9	high
206291	CentOS 9 : python3.9-3.9.19-8.el9	high
206026	CentOS 8 : jose (CESA-2024:5294)	high
205814	CentOS 9 : python3.9-3.9.19-7.el9	medium
204877	CentOS 9 : python-setuptools-53.0.0-13.el9	high
204713	CentOS 7 : flatpak (RHSA-2024:3980)	high
204712	CentOS 7 : linux-firmware (RHSA-2024:3939)	high
204711	CentOS 7 : less (RHSA-2024:3669)	high
204710	CentOS 7 : python-pillow (RHSA-2024:0857)	high
204131	CentOS 9 : python3.9-3.9.19-4.el9	high
202393	CentOS 9 : kernel-5.14.0-479.el9	high
202392	CentOS 9 : openssh-8.7p1-43.el9	high
201993	CentOS 9 : kernel-5.14.0-474.el9	critical
201992	CentOS 9 : openssh-8.7p1-42.el9	high
201968	CentOS 9 : cockpit-320-1.el9	low
201850	CentOS 9 : kernel-5.14.0-472.el9	medium
201849	CentOS 9 : python-urllib3-1.26.5-6.el9	medium
201097	CentOS 7 : java-1.8.0-ibm (RHSA-2024:4160)	medium
200887	CentOS 9 : kernel-5.14.0-467.el9	medium
200827	CentOS 7 : thunderbird (RHSA-2024:4016)	medium
200727	CentOS 7 : bind, bind-dyndb-ldap, and dhcp (RHSA-2024:3741)	high
200726	CentOS 7 : firefox (RHSA-2024:3951)	medium
200725	CentOS 7 : ipa (RHSA-2024:3760)	high
200499	CentOS 7 : 389-ds-base (RHSA-2024:3591)	high
200325	CentOS 9 : openssl-3.2.2-1.el9	high
200256	CentOS 7 : glibc (RHSA-2024:3588)	high
197865	CentOS 8 : .NET 7.0 (CESA-2024:3340)	medium
197864	CentOS 8 : glibc (CESA-2024:3344)	high
197863	CentOS 8 : xorg-x11-server-Xwayland (CESA-2024:3343)	high
197862	CentOS 8 : python3 (CESA-2024:3347)	high
197696	CentOS 8 : tigervnc (CESA-2024:3261)	high
197695	CentOS 8 : fence-agents (CESA-2024:2968)	medium
197694	CentOS 8 : tigervnc (CESA-2024:3067)	medium

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

high

high

critical

high

high

high

high

high

high

medium

high

medium

medium

low

high

critical

high

high

high

medium

high

high

high

high

high

high

high

high

critical

high

low

medium

medium

medium

medium

medium

high

medium

high

high

high

high

medium

high

high

high

high

medium

medium