The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3060 advisory.

  - GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this     library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the parsing of MXF video files. The issue results from the     lack of proper validation of user-supplied data, which can result in an integer overflow before allocating     a buffer. An attacker can leverage this vulnerability to execute code in the context of the current     process. Was ZDI-CAN-21660. (CVE-2023-40474)

  - GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows     remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this     library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the parsing of MXF video files. The issue results from the     lack of proper validation of user-supplied data, which can result in an integer overflow before allocating     a buffer. An attacker can leverage this vulnerability to execute code in the context of the current     process. Was ZDI-CAN-21661. (CVE-2023-40475)

  - GStreamer H265 Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the parsing of H265 encoded video files. The issue results     from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-     length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of     the current process. Was ZDI-CAN-21768. (CVE-2023-40476)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3265 advisory.

  - It is possible for a user in a different organization from the owner of a snapshot to bypass authorization     and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This     functionality is intended to only be available to individuals with the permission to write/edit to the     snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an     unprivileged user in a different organization than the snapshot owner are treated as authorized. Grafana     Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing     this vulnerability. This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from     10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5. (CVE-2024-1313)

  - A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a     resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in     github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function     uses named return parameters to free pkey and ctx if there is an error initializing the context or     setting the different properties. All return statements related to error cases follow the return nil,     nil, fail(...) pattern, meaning that pkey and ctx will be nil inside the deferred function that should     free them. (CVE-2024-1394)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:2980 advisory.

  - hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via     consecutive marks during the process of looking back for base glyphs when attaching marks.
    (CVE-2023-25193)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:2953 advisory.

  - Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack's media     type parser to take much longer than expected, leading to a possible denial of service vulnerability     (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1. (CVE-2024-25126)

  - Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond     with an unexpectedly large response. Responding with such large responses could lead to a denial of     service issue. Vulnerable applications will use the `Rack::File` middleware or the     `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in     3.0.9.1 and 2.2.8.1. (CVE-2024-26141)

  - Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to     take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers     are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are     unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1. (CVE-2024-26146)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:2994 advisory.

  - Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the     LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp. (CVE-2021-32142)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3008 advisory.

  - OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files     via a race condition during execution of library code with UID 0. (CVE-2023-41915)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3095 advisory.

  - Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code     and cause a denial of service during the conversion of wav files to ogg files. (CVE-2023-43361)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:2981 advisory.

  - An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the     bgp_attr_psid_sub() function. (CVE-2023-31490)

  - An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute     length is zero. (CVE-2023-41358)

  - An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c     processes malformed requests with no attributes, leading to a NULL pointer dereference. (CVE-2023-41909)

  - An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data,     leading to a crash. (CVE-2023-46752)

  - An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message     without mandatory attributes, e.g., one with only an unknown transit attribute. (CVE-2023-46753)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3059 advisory.

  - LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a     denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is     available with commit e8131125. (CVE-2022-4645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:3058 advisory.

  - Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12 (CVE-2023-4874)

  - Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12     (CVE-2023-4875)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3233 advisory.

  - A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit     unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into     the command of the features mentioned through the hostname parameter. (CVE-2023-6004)

  - A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by     different supported crypto backends. The return values from these were not properly checked, which could     cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as     an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures,     terminating the connection. (CVE-2023-6918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3203 advisory.

  - A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of     DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS     resolver) to manipulate records. (CVE-2023-7008)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3049 advisory.

  - perl-Convert-ASN1 (aka the Convert::ASN1 module for Perl) through 0.27 allows remote attackers to cause an     infinite loop via unexpected input. (CVE-2013-7488)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3166 advisory.

  - scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by     backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they     intentionally omit validation of anomalous argument transfers because that could stand a great chance     of breaking existing workflows. (CVE-2020-15778)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:2974 advisory.

  - A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer()     function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents     of memory on the system. (CVE-2023-43788)

  - A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user     can trigger an out-of-bounds read error and read contents of memory on the system. (CVE-2023-43789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3105 advisory.

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
    Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer     dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service     (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to     potential disruptions in system availability and stability. This vulnerability has been patched in version     41.0.6. (CVE-2023-49083)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3102 advisory.

  - Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar     to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template,     potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject     arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to     XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
    (CVE-2024-22195)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3268 advisory.

  - Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c. (CVE-2024-26458)

  - Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.
    (CVE-2024-26461)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3214 advisory.

  - GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and     resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.
    (CVE-2021-43618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3017 advisory.

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36763)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36764)

  - EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer     overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result     in a compromise of confidentiality, integrity, and/or availability. (CVE-2022-36765)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or     IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality. (CVE-2023-45229)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality. (CVE-2023-45231)

  - EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45232)

  - EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45233)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3005 advisory.

  - An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates     memory to process a given task, potentially causing a service to crash by having it run out of memory.
    This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text     argument. (CVE-2023-44271)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3120 advisory.

  - freeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu     function. (CVE-2024-24258)

  - freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the     glutAddMenuEntry function. (CVE-2024-24259)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3043 advisory.

  - An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG     configuration in some scenarios. Information is still included in the output in certain tasks, such as     loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret     values. (CVE-2024-0690)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:2961 advisory.

  - A flaw was found in osbuild-composer. A condition can be triggered that disables GPG verification for     package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted     code to be installed into an image being built. (CVE-2024-2307)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3062 advisory.

  - The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special     character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some     applications, an attacker can bypass a protection mechanism in which application access is granted only     after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be     used for signup). This occurs in email/_parseaddr.py in recent versions of Python. (CVE-2023-27043)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3066 advisory.

  - Buffer Overflow vulnerability in function ID3_Support::ID3v2Frame::getFrameValue in exempi 2.5.0 and     earlier allows remote attackers to cause a denial of service via opening of crafted audio file with ID3V2     frame. (CVE-2020-18651)

  - Buffer Overflow vulnerability in WEBP_Support.cpp in exempi 2.5.0 and earlier allows remote attackers to     cause a denial of service via opening of crafted webp file. (CVE-2020-18652)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:2996 advisory.

  - A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect     calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function     in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible     escalation of privileges or denial of service. (CVE-2023-5367)

  - A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to     a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or     possible remote code execution in cases where X11 forwarding is involved. (CVE-2023-6377)

  - A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or     RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive     information. (CVE-2023-6478)

  - A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for     each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the     X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap     overflow if a bigger value was used. (CVE-2023-6816)

  - An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a     device frozen by a sync grab is reattached to a different master device. This issue may lead to an     application crash, local privilege escalation (if the server runs with extended privileges), or remote     code execution in SSH X11 forwarding environments. (CVE-2024-0229)

  - A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the     buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a     GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the     XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.
    (CVE-2024-0408)

  - A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of     private at creation. It uses the cursor bits type with the cursor as private, and when initiating the     cursor, that overwrites the XSELINUX context. (CVE-2024-0409)

  - A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the     allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can     trigger a heap buffer overflow condition, which may lead to an application crash or remote code execution     in SSH X11 forwarding environments. (CVE-2024-21885)

  - A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may     lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding     environments. (CVE-2024-21886)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:3139 advisory.

  - squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is     then used by unsquashfs to create the new file during the unsquash. The filename is not validated for     traversal outside of the destination directory, and thus allows writing to locations outside of the     destination. (CVE-2021-40153)

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3022 advisory.

  - A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer()     function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents     of memory on the system. (CVE-2023-43788)

  - A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user     can trigger an out-of-bounds read error and read contents of memory on the system. (CVE-2023-43789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3264 advisory.

  - A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local     network, allowing remote command execution with the privileges of the Redis user. This issue can only be     exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually.
    The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This     flaw affects PCP versions 4.3.4 and newer. (CVE-2024-3019)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3211 advisory.

  - In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command     lines. (CVE-2023-46316)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3163 advisory.

  - linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login     process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. (CVE-2024-22365)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3030 advisory.

  - Multiple signed integers overflow in function au_read_header in src/au.c and in functions mat4_open and     mat4_read_header in src/mat4.c in Libsndfile, allows an attacker to cause Denial of Service or other     unspecified impacts. (CVE-2022-33065)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3275 advisory.

  - eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS     name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a     TuDoor attack. In other words, dnspython does not have the preferred behavior in which the DNS name     resolution algorithm would proceed, within the full time window, in order to wait for a valid packet.
    NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. (CVE-2023-29483)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:2952 advisory.

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP     request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method     changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs.
    Although this behavior is not specified in the section for redirects, it can be inferred by piecing     together information from different sections and we have observed the behavior in other major HTTP client     implementations like curl and web browsers. Because the vulnerability requires a previously trusted     service to become compromised in order to have an impact on confidentiality we believe the exploitability     of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request     bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions     must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information     in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts     redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised.
    This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve     this issue. Users unable to update should disable redirects for services that aren't expecting to respond     with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle     301, 302, and 303 redirects manually by stripping the HTTP request body. (CVE-2023-45803)

  - PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable     for a Manger attack. (CVE-2023-52323)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3269 advisory.

  - The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to     it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to     crash an application or overwrite a neighbouring variable. (CVE-2024-2961)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3178 advisory.

  - Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user     to potentially enable escalation of privilege via local access. (CVE-2022-46329)

  - Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a     malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of     guest virtual machine (VM) memory integrity. (CVE-2023-20592)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3089 advisory.

  - GStreamer FLAC File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the parsing of FLAC audio files. The issue results from     the lack of proper validation of user-supplied data, which can result in an integer overflow before     allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the     current process. Was ZDI-CAN-20775. (CVE-2023-37327)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3088 advisory.

  - GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This     vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer.
    Interaction with this library is required to exploit this vulnerability but attack vectors may vary     depending on the implementation. The specific flaw exists within the parsing of PGS subtitle files. The     issue results from the lack of proper validation of the length of user-supplied data prior to copying it     to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the     current process. Was ZDI-CAN-20994. (CVE-2023-37328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:2973 advisory.

  - A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function.
    This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on     the system. (CVE-2023-43785)

  - A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw     allows a local user to consume all available system resources and cause a denial of service condition.
    (CVE-2023-43786)

  - A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This     flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated     privileges. (CVE-2023-43787)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:2979 advisory.

  - An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial     of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function. (CVE-2020-36024)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3056 advisory.

  - An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through     6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack     integer overflow check. (CVE-2023-51714)

  - An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through     6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a     crafted KTX image file. (CVE-2024-25580)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3094 advisory.

  - CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.
    (CVE-2023-31484)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:2986 advisory.

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3270 advisory.

  - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated     users. This may lead to improper authorization issues, granting or denying access to resources     inappropriately. (CVE-2023-3758)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the glib2-2.68.4-15.el9 build changelog.

  - An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-     based client subscribes to signals from a trusted system service such as NetworkManager on a shared     computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will     wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based     client behaving incorrectly, with an application-dependent impact. (CVE-2024-34397)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:2881 advisory.

  - A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution     in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird <     115.11. (CVE-2024-4367)

  - If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly     deleted when the window was closed. This preference is disabled by default in Firefox. This vulnerability     affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11. (CVE-2024-4767)

  - A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user     into granting permissions. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird     < 115.11. (CVE-2024-4768)

  - When importing resources using Web Workers, error messages would distinguish the difference between     `application/javascript` responses and non-script responses. This could have been abused to learn     information cross-origin. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird     < 115.11. (CVE-2024-4769)

  - When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. This     vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11. (CVE-2024-4770)

  - Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and     Thunderbird < 115.11. (CVE-2024-4777)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:1939 advisory.

  - The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable     to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and     Thunderbird < 115.10. (CVE-2024-2609)

  - There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could     abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125,     Firefox ESR < 115.10, and Thunderbird < 115.10. (CVE-2024-3302)

  - GetBoundName could return the wrong version of an object when JIT optimizations were applied. This     vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. (CVE-2024-3852)

  - In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-     bounds-reads. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
    (CVE-2024-3854)

  - The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free     crashes during garbage collection. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and     Thunderbird < 115.10. (CVE-2024-3857)

  - On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could     be triggered by a malformed OpenType font. This vulnerability affects Firefox < 125, Firefox ESR < 115.10,     and Thunderbird < 115.10. (CVE-2024-3859)

  - If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect     reference count and later use-after-free. This vulnerability affects Firefox < 125, Firefox ESR < 115.10,     and Thunderbird < 115.10. (CVE-2024-3861)

  - Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed     evidence of memory corruption and we presume that with enough effort this could have been exploited to run     arbitrary code. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
    (CVE-2024-3864)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2625 advisory.

  - An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive     number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and     CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is     allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an     HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to     be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the     receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header     frames we will process before closing a connection. (CVE-2023-45288)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:1912 advisory.

  - The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable     to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and     Thunderbird < 115.10. (CVE-2024-2609)

  - There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could     abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125,     Firefox ESR < 115.10, and Thunderbird < 115.10. (CVE-2024-3302)

  - GetBoundName could return the wrong version of an object when JIT optimizations were applied. This     vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. (CVE-2024-3852)

  - In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-     bounds-reads. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
    (CVE-2024-3854)

  - The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free     crashes during garbage collection. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and     Thunderbird < 115.10. (CVE-2024-3857)

  - On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could     be triggered by a malformed OpenType font. This vulnerability affects Firefox < 125, Firefox ESR < 115.10,     and Thunderbird < 115.10. (CVE-2024-3859)

  - If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect     reference count and later use-after-free. This vulnerability affects Firefox < 125, Firefox ESR < 115.10,     and Thunderbird < 115.10. (CVE-2024-3861)

  - Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed     evidence of memory corruption and we presume that with enough effort this could have been exploited to run     arbitrary code. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
    (CVE-2024-3864)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
197693	CentOS 8 : gstreamer1-plugins-bad-free (CESA-2024:3060)	high
197692	CentOS 8 : grafana (CESA-2024:3265)	medium
197691	CentOS 8 : harfbuzz (CESA-2024:2980)	high
197690	CentOS 8 : pcs (CESA-2024:2953)	high
197689	CentOS 8 : LibRaw (CESA-2024:2994)	high
197688	CentOS 8 : pmix (CESA-2024:3008)	high
197687	CentOS 8 : vorbis-tools (CESA-2024:3095)	high
197686	CentOS 8 : frr (CESA-2024:2981)	high
197685	CentOS 8 : libtiff (CESA-2024:3059)	medium
197684	CentOS 8 : mutt (CESA-2024:3058)	medium
197683	CentOS 8 : libssh (CESA-2024:3233)	medium
197682	CentOS 8 : systemd (CESA-2024:3203)	medium
197681	CentOS 8 : perl-Convert-ASN1 (CESA-2024:3049)	high
197680	CentOS 8 : openssh (CESA-2024:3166)	high
197679	CentOS 8 : libXpm (CESA-2024:2974)	medium
197678	CentOS 8 : python3.11-cryptography (CESA-2024:3105)	high
197677	CentOS 8 : python-jinja2 (CESA-2024:3102)	medium
197676	CentOS 8 : krb5 (CESA-2024:3268)	medium
197675	CentOS 8 : gmp (CESA-2024:3214)	high
197674	CentOS 8 : edk2 (CESA-2024:3017)	high
197673	CentOS 8 : python-pillow (CESA-2024:3005)	high
197672	CentOS 8 : freeglut (CESA-2024:3120)	high
197671	CentOS 8 : ansible-core bug fix, enhancement, and (CESA-2024:3043)	medium
197670	CentOS 8 : Image builder components bug fix, enhancement and (CESA-2024:2961)	medium
197669	CentOS 8 : python3.11 (CESA-2024:3062)	medium
197668	CentOS 8 : exempi (CESA-2024:3066)	medium
197667	CentOS 8 : xorg-x11-server-Xwayland (CESA-2024:2996)	critical
197666	CentOS 8 : squashfs-tools (CESA-2024:3139)	high
197665	CentOS 8 : motif (CESA-2024:3022)	medium
197664	CentOS 8 : pcp (CESA-2024:3264)	high
197663	CentOS 8 : traceroute (CESA-2024:3211)	medium
197662	CentOS 8 : pam (CESA-2024:3163)	medium
197661	CentOS 8 : libsndfile (CESA-2024:3030)	high
197660	CentOS 8 : python-dns (CESA-2024:3275)	high
197659	CentOS 8 : resource-agents (CESA-2024:2952)	medium
197658	CentOS 8 : glibc (CESA-2024:3269)	high
197657	CentOS 8 : linux-firmware (CESA-2024:3178)	medium
197656	CentOS 8 : gstreamer1-plugins-good (CESA-2024:3089)	high
197655	CentOS 8 : gstreamer1-plugins-base (CESA-2024:3088)	high
197654	CentOS 8 : libX11 (CESA-2024:2973)	high
197653	CentOS 8 : poppler (CESA-2024:2979)	medium
197652	CentOS 8 : qt5-qtbase (CESA-2024:3056)	critical
197651	CentOS 8 : perl-CPAN (CESA-2024:3094)	high
197650	CentOS 8 : python3.11-urllib3 (CESA-2024:2986)	high
197649	CentOS 8 : sssd (CESA-2024:3270)	high
197516	CentOS 9 : glib2-2.68.4-15.el9	medium
197198	CentOS 7 : firefox (RHSA-2024:2881)	high
195023	CentOS 8 : thunderbird (CESA-2024:1939)	high
194881	CentOS 7 : rhc-worker-script (RHSA-2024:2625)	high
194736	CentOS 8 : firefox (CESA-2024:1912)	high

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

medium

high

high

high

high

high

high

medium

medium

medium

medium

high

high

medium

high

medium

medium

high

high

high

high

medium

medium

medium

medium

critical

high

medium

high

medium

medium

high

high

medium

high

medium

high

high

high

medium

critical

high

high

high

medium

high

high

high

high