The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:1998 advisory.

  - The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit     scenarios when a connection is configured to use PreSharedKeys (authby=secret) and the connection cannot     find a matching configured secret. When such a connection is automatically added on startup using the     auto= keyword, it can cause repeated crashes leading to a Denial of Service. (CVE-2024-2357)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1935 advisory.

  - The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable     to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and     Thunderbird < 115.10. (CVE-2024-2609)

  - There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could     abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125,     Firefox ESR < 115.10, and Thunderbird < 115.10. (CVE-2024-3302)

  - GetBoundName could return the wrong version of an object when JIT optimizations were applied. This     vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. (CVE-2024-3852)

  - In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-     bounds-reads. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
    (CVE-2024-3854)

  - The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free     crashes during garbage collection. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and     Thunderbird < 115.10. (CVE-2024-3857)

  - On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could     be triggered by a malformed OpenType font. This vulnerability affects Firefox < 125, Firefox ESR < 115.10,     and Thunderbird < 115.10. (CVE-2024-3859)

  - If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect     reference count and later use-after-free. This vulnerability affects Firefox < 125, Firefox ESR < 115.10,     and Thunderbird < 115.10. (CVE-2024-3861)

  - Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed     evidence of memory corruption and we presume that with enough effort this could have been exploited to run     arbitrary code. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
    (CVE-2024-3864)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1960 advisory.

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free. We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2002 advisory.

  - A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an     overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph,     this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this     vulnerability to circumvent the secure boot mechanism. (CVE-2022-2601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2004 advisory.

  - A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer     dereference and general protection fault. (CVE-2020-36558)

  - A vulnerability was found in the HCI sockets implementation due to a missing capability check in     net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of     management commands, compromising the confidentiality, integrity, and availability of Bluetooth     communication. (CVE-2023-2002)

  - Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30     may allow an unauthenticated user to potentially enable escalation of privilege via network access.
    (CVE-2023-25775)

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free. We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1959 advisory.

  - A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create     the new variable, it tries to print an error message to the user; however, the number of parameters used     by the logging function doesn't match the format string used by it, leading to a crash under certain     circumstances. (CVE-2023-40546)

  - A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled     values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP     request, leading to a completely controlled out-of-bounds write primitive and complete system compromise.
    This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-     Middle or compromise the boot server to be able to exploit this vulnerability successfully.
    (CVE-2023-40547)

  - A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition     operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is     further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes     memory corruption and can lead to a crash or data integrity issues during the boot phase. (CVE-2023-40548)

  - An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the     load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and     crashing Shim, resulting in a denial of service. (CVE-2023-40549)

  - An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue     may expose sensitive data during the system's boot phase. (CVE-2023-40550)

  - A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or     possible exposure of sensitive data during the system's boot phase. (CVE-2023-40551)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1821 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401,     8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM     Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2024-21011)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22,     17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition:
    20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise     Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible     data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2024-21012)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401-perf,     11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2 and 22; Oracle GraalVM Enterprise     Edition: 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise     Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible     data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a     web service which supplies data to the APIs. This vulnerability also applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. (CVE-2024-21068)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Concurrency). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf,     11.0.22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
    Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web     service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.
    (CVE-2024-21085)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401,     8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM     Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise     Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. (CVE-2024-21094)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssh-8.7p1-38.el9 build changelog.

  - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other     products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the     extension negotiation message), and a client and server may consequently end up with a connection for     which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because     the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and     mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of     ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and     (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API     before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80,     AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0,     Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15,     SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH     through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang     XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd     through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and     LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3,     Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server     before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the     mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh     crate before 0.40.2 for Rust. (CVE-2023-48795)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libssh-0.10.4-12.el9 build changelog.

  - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other     products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the     extension negotiation message), and a client and server may consequently end up with a connection for     which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because     the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and     mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of     ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and     (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API     before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80,     AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0,     Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15,     SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH     through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang     XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd     through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and     LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3,     Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server     before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the     mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh     crate before 0.40.2 for Rust. (CVE-2023-48795)

  - A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit     unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into     the command of the features mentioned through the hostname parameter. (CVE-2023-6004)

  - A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by     different supported crypto backends. The return values from these were not properly checked, which could     cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as     an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures,     terminating the connection. (CVE-2023-6918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the less-590-3.el9 build changelog.

  - close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (CVE-2022-48624)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the kernel-5.14.0-354.el9 build changelog.

  - A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel's IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%. (CVE-2023-1206)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.18-2.el9 build changelog.

  - The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special     character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some     applications, an attacker can bypass a protection mechanism in which application access is granted only     after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be     used for signup). This occurs in email/_parseaddr.py in recent versions of Python. (CVE-2023-27043)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the opensc-0.23.0-4.el9 build changelog.

  - Side-channel leaks while stripping encryption PKCS#1.5 padding (CVE-2023-5992)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the rpm-4.16.1.3-26.el9 build changelog.

  - A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass     the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root     privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2021-35937)

  - A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials     after installing a file. A local unprivileged user could use this flaw to exchange the original file with     a symbolic link to a security-critical file and escalate their privileges on the system. The highest     threat from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2021-35938)

  - It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only     implemented for the parent directory of the file to be created. A local unprivileged user who owns another     ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-35939)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the python- urllib3-1.26.5-5.el9 build changelog.

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP     request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method     changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs.
    Although this behavior is not specified in the section for redirects, it can be inferred by piecing     together information from different sections and we have observed the behavior in other major HTTP client     implementations like curl and web browsers. Because the vulnerability requires a previously trusted     service to become compromised in order to have an impact on confidentiality we believe the exploitability     of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request     bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions     must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information     in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts     redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised.
    This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve     this issue. Users unable to update should disable redirects for services that aren't expecting to respond     with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle     301, 302, and 303 redirects manually by stripping the HTTP request body. (CVE-2023-45803)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the avahi-0.8-20.el9 build changelog.

  - A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
    (CVE-2023-38469)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
    (CVE-2023-38470)

  - A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
    (CVE-2023-38471)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
    (CVE-2023-38472)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name()     function. (CVE-2023-38473)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the toolbox-0.0.99.4-5.el9 build changelog.

  - Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates     containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS     context and allowing for injection of unexpected HTML, if executed with untrusted input. (CVE-2023-24539)

  - Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing     whitespace characters outside of the character set \t\n\f\r\u0020\u2028\u2029 in JavaScript contexts     that also contain actions may not be properly sanitized during execution. (CVE-2023-24540)

  - Templates containing actions in unquoted HTML attributes (e.g. attr={{.}}) executed with empty input can     result in output with unexpected results when parsed due to HTML normalization rules. This may allow     injection of arbitrary attributes into tags. (CVE-2023-29400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the zlib-1.2.11-41.el9 build changelog.

  - MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in     zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported     part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected     zlib version, and exposes the applicable MiniZip code through its compress API. (CVE-2023-45853)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-430.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix connection failure     handling In case immediate MPA request processing fails, the newly created endpoint unlinks the listening     endpoint and is ready to be dropped. This special case was not handled correctly by the code handling the     later TCP socket close, causing a NULL dereference crash in siw_cm_work_handler() when dereferencing a     NULL listener. We now also cancel the useless MPA timeout, if immediate MPA request processing fails. This     patch furthermore simplifies MPA processing in general: Scheduling a useless TCP socket read in     sk_data_ready() upcall is now surpressed, if the socket is already moved out of TCP_ESTABLISHED state.
    (CVE-2023-52513)

  - A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel.
    This issue may allow a network attacker to decrypt ciphertexts or forge signatures, limiting the services     that use that private key. (CVE-2023-6240)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the linux- firmware-20231030-141.el9 build changelog.

  - Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi (RHEL-14264) (CVE-2022-46329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the opensc-0.23.0-3.el9 build changelog.

  - Potential PIN bypass (CVE-2023-40660)

  - Dynamic analyzers reports in pkcs15init (CVE-2023-40661)

  - Out-of-bounds read in MyEID driver handling encryption using symmetric keys (CVE-2023-4535)

  - Side-channel leaks while stripping encryption PKCS#1.5 padding (CVE-2023-5992)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-432.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free     Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit     to avoid the use after free. [wsa: added comment to the code, added Fixes tag] (CVE-2019-25162)

  - In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: Fix null-pointer     dereference in pgtable_cache_add kasprintf() returns a pointer to dynamically allocated memory which can     be NULL upon failure. Ensure the allocation was successful by checking the pointer validity.
    (CVE-2023-52607)

  - In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Fix block process call     transactions According to the Intel datasheets, software must reset the block buffer index twice for block     process call transactions: once before writing the outgoing data to the buffer, and once again before     reading the incoming data from the buffer. The driver is currently missing the second reset, causing the     wrong portion of the block buffer to be read. (CVE-2024-26593)

  - In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability     to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall     slowdowns for everything. So put a lock on the path in order to serialize the accesses to prevent the     ability for this to be called at too high of a frequency and saturate the machine. (CVE-2024-26602)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libxml2-2.9.13-5.el9 build changelog.

  - Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement()     function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via     supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy     SAX1 interface with custom callbacks; there is a crash even without crafted input. (CVE-2023-39615)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the sqlite-3.34.1-7.el9 build changelog.

  - A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects     the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest     Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix     this issue. The associated identifier of this vulnerability is VDB-248999. (CVE-2023-7104)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the pam-1.5.1-19.el9 build changelog.

  - linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login     process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. (CVE-2024-22365)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-435.el9 build changelog.

  - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
    (CVE-2023-52466)

  - In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix NULL pointer     dereference in zone registration error path If device_register() in     thermal_zone_device_register_with_trips() returns an error, the tz variable is set to NULL and     subsequently dereferenced in kfree(tz->tzp). Commit adc8749b150c (thermal/drivers/core: Use put_device()     if device_register() fails) added the tz = NULL assignment in question to avoid a possible double-free     after dropping the reference to the zone device. However, after commit 4649620d9404 (thermal: core: Make     thermal_zone_device_unregister() return after freeing the zone), that assignment has become redundant,     because dropping the reference to the zone device does not cause the zone object to be freed any more.
    Drop it to address the NULL pointer dereference. (CVE-2023-52473)

  - In the Linux kernel, the following vulnerability has been resolved: hwrng: core - Fix page fault dead lock     on mmap-ed hwrng There is a dead-lock in the hwrng device read path. This triggers when the user reads     from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive     read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. (CVE-2023-52615)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the wpa_supplicant-2.10-5.el9 build changelog.

  - The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful     attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1     authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication.
    The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an     adversary to impersonate Enterprise Wi-Fi networks. (CVE-2023-52160)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the openssl-3.0.7-25.el9 build changelog.

  - Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated     data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV     algorithm and want to authenticate empty data entries as associated data can be mislead by removing adding     or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently     unaware of any such applications. The AES-SIV algorithm allows for authentication of multiple associated     data entries along with the encryption. To authenticate empty data the application has to call     EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as the output buffer and 0 as the input     buffer length. The AES-SIV implementation in OpenSSL just returns success for such a call instead of     performing the associated data authentication operation. The empty data thus will not be authenticated. As     this issue does not affect non-empty associated data authentication and we expect it to be rare for an     application to use empty associated data entries this is qualified as Low severity issue. (CVE-2023-2975)

  - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary:
    Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key     or DH parameters may experience long delays. Where the key or parameters that are being checked have been     obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs     various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too     large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is     over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or     parameters that have been supplied. Some of those checks use the supplied modulus value even if it has     already been found to be too large. An application that calls DH_check() and supplies a key or parameters     obtained from an untrusted source could be vulernable to a Denial of Service attack. The function     DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those     other functions may similarly be affected. The other functions affected by this are DH_check_ex() and     EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications     when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The     OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. (CVE-2023-3446)

  - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary:
    Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key     or DH parameters may experience long delays. Where the key or parameters that are being checked have been     obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs     various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter     value can also trigger an overly long computation during some of these checks. A correct q value, if     present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if     q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an     untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself     called by a number of other OpenSSL functions. An application calling any of those other functions may     similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check().
    Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the -check     option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS     providers are not affected by this issue. (CVE-2023-3817)

  - Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths.
    This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers.
    Impact summary: A truncation in the IV can result in non-uniqueness, which could result in loss of     confidentiality for some cipher modes. When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or     EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after the key and IV have been     established. Any alterations to the key length, via the keylen parameter or the IV length, via the     ivlen parameter, within the OSSL_PARAM array will not take effect as intended, potentially causing     truncation or overreading of these values. The following ciphers and cipher modes are impacted: RC2, RC4,     RC5, CCM, GCM and OCB. For the CCM, GCM and OCB cipher modes, truncation of the IV can result in loss of     confidentiality. For example, when following NIST's SP 800-38D section 8.2.1 guidance for constructing a     deterministic IV for AES in GCM mode, truncation of the counter portion could lead to IV reuse. Both     truncations and overruns of the key and overruns of the IV will produce incorrect results and could, in     some cases, trigger a memory exception. However, these issues are not currently assessed as security     critical. Changing the key and/or IV lengths is not considered to be a common operation and the vulnerable     API was recently introduced. Furthermore it is likely that application developers will have spotted this     problem during testing since decryption would fail unless both peers in the communication were similarly     vulnerable. For these reasons we expect the probability of an application being vulnerable to this to be     quite low. However if an application is vulnerable then this issue is considered very serious. For these     reasons we have assessed this issue as Moderate severity overall. The OpenSSL SSL/TLS implementation is     not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this because the     issue lies outside of the FIPS provider boundary. OpenSSL 3.1 and 3.0 are vulnerable to this issue.
    (CVE-2023-5363)

  - Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or     parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to     generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(),     DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may     experience long delays. Where the key or parameters that are being checked have been obtained from an     untrusted source this may lead to a Denial of Service. While DH_check() performs all the necessary checks     (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable     for excessively large P and Q parameters. Likewise, while DH_generate_key() performs a check for an     excessively large P, it doesn't check for an excessively large Q. An application that calls     DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source     could be vulnerable to a Denial of Service attack. DH_generate_key() and DH_check_pub_key() are also     called by a number of other OpenSSL functions. An application calling any of those other functions may     similarly be affected. The other functions affected by this are DH_check_pub_key_ex(),     EVP_PKEY_public_check(), and EVP_PKEY_generate(). Also vulnerable are the OpenSSL pkey command line     application when using the -pubcheck option, as well as the OpenSSL genpkey command line application.
    The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers     are not affected by this issue. (CVE-2023-5678)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the file-5.39-16.el9 build changelog.

  - File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: File is the name     of an Open Source project. (CVE-2022-48554)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-437.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: mm/sparsemem: fix race in accessing     memory_section->usage The below race is observed on a PFN which falls into the device memory region with     the system memory configuration where PFN's are such that [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL]. Since     normal zone start and end pfn contains the device memory PFN's as well, the compaction triggered will try     on the device memory PFN's too though they end up in NOP(because pfn_to_online_page() returns NULL for     ZONE_DEVICE memory sections). When from other core, the section mappings are being removed for the     ZONE_DEVICE region, that the PFN in question belongs to, on which compaction is currently being operated     is resulting into the kernel crash with CONFIG_SPASEMEM_VMEMAP enabled. The crash logs can be seen at [1].
    compact_zone() memunmap_pages ------------- --------------- __pageblock_pfn_to_page ...... (a)pfn_valid():
    valid_section()//return true (b)__remove_pages()-> sparse_remove_section()-> section_deactivate(): [Free     the array ms->usage and set ms->usage = NULL] pfn_section_valid() [Access ms->usage which is NULL] NOTE:
    From the above it can be said that the race is reduced to between the pfn_valid()/pfn_section_valid() and     the section deactivate with SPASEMEM_VMEMAP enabled. The commit b943f045a9af(mm/sparse: fix kernel crash     with pfn_section_valid check) tried to address the same problem by clearing the SECTION_HAS_MEM_MAP with     the expectation of valid_section() returns false thus ms->usage is not accessed. Fix this issue by the     below steps: a) Clear SECTION_HAS_MEM_MAP before freeing the ->usage. b) RCU protected read side critical     section will either return NULL when SECTION_HAS_MEM_MAP is cleared or can successfully access ->usage. c)     Free the ->usage with kfree_rcu() and set ms->usage = NULL. No attempt will be made to access ->usage     after this as the SECTION_HAS_MEM_MAP is cleared thus valid_section() return false. Thanks to David/Pavan     for their inputs on this patch. [1] https://lore.kernel.org/linux-     mm/994410bb-89aa-d987-1f50-f514903c55aa@quicinc.com/ On Snapdragon SoC, with the mentioned memory     configuration of PFN's as [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL], we are able to see bunch of issues daily     while testing on a device farm. For this particular issue below is the log. Though the below log is not     directly pointing to the pfn_section_valid(){ ms->usage;}, when we loaded this dump on T32 lauterbach     tool, it is pointing. [ 540.578056] Unable to handle kernel NULL pointer dereference at virtual address     0000000000000000 [ 540.578068] Mem abort info: [ 540.578070] ESR = 0x0000000096000005 [ 540.578073] EC =     0x25: DABT (current EL), IL = 32 bits [ 540.578077] SET = 0, FnV = 0 [ 540.578080] EA = 0, S1PTW = 0 [     540.578082] FSC = 0x05: level 1 translation fault [ 540.578085] Data abort info: [ 540.578086] ISV = 0,     ISS = 0x00000005 [ 540.578088] CM = 0, WnR = 0 [ 540.579431] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO
    -DIT -SSBSBTYPE=--) [ 540.579436] pc : __pageblock_pfn_to_page+0x6c/0x14c [ 540.579454] lr :
    compact_zone+0x994/0x1058 [ 540.579460] sp : ffffffc03579b510 [ 540.579463] x29: ffffffc03579b510 x28:
    0000000000235800 x27:000000000000000c [ 540.579470] x26: 0000000000235c00 x25: 0000000000000068     x24:ffffffc03579b640 [ 540.579477] x23: 0000000000000001 x22: ffffffc03579b660 x21:0000000000000000 [     540.579483] x20: 0000000000235bff x19: ffffffdebf7e3940 x18:ffffffdebf66d140 [ 540.579489] x17:
    00000000739ba063 x16: 00000000739ba063 x15:00000000009f4bff [ 540.579495] x14: 0000008000000000 x13:
    0000000000000000 x12:0000000000000001 [ 540.579501] x11: 0000000000000000 x10: 0000000000000000 x9     :ffffff897d2cd440 [ 540.579507] x8 : 0000000000000000 x7 : 0000000000000000 x6 :ffffffc03579b5b4 [     540.579512] x5 : 0000000000027f25 x4 : ffffffc03579b5b8 x3 :0000000000000 ---truncated--- (CVE-2023-52489)

  - In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Fix uninit-value     access in __smsc75xx_read_reg syzbot reported the following uninit-value access issue:
    ===================================================== BUG: KMSAN: uninit-value in smsc75xx_wait_ready     drivers/net/usb/smsc75xx.c:975 [inline] BUG: KMSAN: uninit-value in smsc75xx_bind+0x5c9/0x11e0     drivers/net/usb/smsc75xx.c:1482 CPU: 0 PID: 8696 Comm: kworker/0:3 Not tainted 5.8.0-rc5-syzkaller #0     Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue:
    usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x21c/0x280     lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121 __msan_warning+0x58/0xa0     mm/kmsan/kmsan_instr.c:215 smsc75xx_wait_ready drivers/net/usb/smsc75xx.c:975 [inline]     smsc75xx_bind+0x5c9/0x11e0 drivers/net/usb/smsc75xx.c:1482 usbnet_probe+0x1152/0x3f90     drivers/net/usb/usbnet.c:1737 usb_probe_interface+0xece/0x1550 drivers/usb/core/driver.c:374     really_probe+0xf20/0x20b0 drivers/base/dd.c:529 driver_probe_device+0x293/0x390 drivers/base/dd.c:701
    __device_attach_driver+0x63f/0x830 drivers/base/dd.c:807 bus_for_each_drv+0x2ca/0x3f0     drivers/base/bus.c:431 __device_attach+0x4e2/0x7f0 drivers/base/dd.c:873 device_initial_probe+0x4a/0x60     drivers/base/dd.c:920 bus_probe_device+0x177/0x3d0 drivers/base/bus.c:491 device_add+0x3b0e/0x40d0     drivers/base/core.c:2680 usb_set_configuration+0x380f/0x3f10 drivers/usb/core/message.c:2032     usb_generic_driver_probe+0x138/0x300 drivers/usb/core/generic.c:241 usb_probe_device+0x311/0x490     drivers/usb/core/driver.c:272 really_probe+0xf20/0x20b0 drivers/base/dd.c:529     driver_probe_device+0x293/0x390 drivers/base/dd.c:701 __device_attach_driver+0x63f/0x830     drivers/base/dd.c:807 bus_for_each_drv+0x2ca/0x3f0 drivers/base/bus.c:431 __device_attach+0x4e2/0x7f0     drivers/base/dd.c:873 device_initial_probe+0x4a/0x60 drivers/base/dd.c:920 bus_probe_device+0x177/0x3d0     drivers/base/bus.c:491 device_add+0x3b0e/0x40d0 drivers/base/core.c:2680 usb_new_device+0x1bd4/0x2a30     drivers/usb/core/hub.c:2554 hub_port_connect drivers/usb/core/hub.c:5208 [inline] hub_port_connect_change     drivers/usb/core/hub.c:5348 [inline] port_event drivers/usb/core/hub.c:5494 [inline]     hub_event+0x5e7b/0x8a70 drivers/usb/core/hub.c:5576 process_one_work+0x1688/0x2140 kernel/workqueue.c:2269     worker_thread+0x10bc/0x2730 kernel/workqueue.c:2415 kthread+0x551/0x590 kernel/kthread.c:292     ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 Local variable ----buf.i87@smsc75xx_bind created at:
    __smsc75xx_read_reg drivers/net/usb/smsc75xx.c:83 [inline] smsc75xx_wait_ready     drivers/net/usb/smsc75xx.c:968 [inline] smsc75xx_bind+0x485/0x11e0 drivers/net/usb/smsc75xx.c:1482
    __smsc75xx_read_reg drivers/net/usb/smsc75xx.c:83 [inline] smsc75xx_wait_ready     drivers/net/usb/smsc75xx.c:968 [inline] smsc75xx_bind+0x485/0x11e0 drivers/net/usb/smsc75xx.c:1482 This     issue is caused because usbnet_read_cmd() reads less bytes than requested (zero byte in the reproducer).
    In this case, 'buf' is not properly filled. This patch fixes the issue by returning -ENODATA if     usbnet_read_cmd() reads less bytes than requested. (CVE-2023-52528)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the freerdp-2.4.1-5.el9 build changelog.

  - Fix length checks in parallel driver (#2136152) (CVE-2022-39282)

  - Add missing length check in video channel (#2136154) (CVE-2022-39283)

  - FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of     bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to     read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in     the 2.9.0 release. Users are advised to upgrade. (CVE-2022-39316)

  - Add missing length checks in zgfx (#2145140) (CVE-2022-39317)

  - Fix division by zero in urbdrc channel (#2145140) (CVE-2022-39318)

  - Add missing length checks in urbdrc channel (#2145140) (CVE-2022-39319)

  - Ensure urb_create_iocompletion uses size_t (#2145140) (CVE-2022-39320)

  - Fix path validation in drive channel (#2145140) (CVE-2022-39347)

  - Add missing length check in drive channel (#2145140) (CVE-2022-41877)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the glibc-2.34-83.el9.3 build changelog.

  - Stack read overflow in getaddrinfo in no-aaaa mode (#2234716) (CVE-2023-4527)

  - potential use-after-free in gaih_inet (RHEL-2438) (CVE-2023-4813)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the nss-3.90.0-4.el9 build changelog.

  - NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could     potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124,     Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2023-5388)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the openssl-3.0.7-18.el9 build changelog.

  - Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied     by a server. That function may return a negative return value to indicate an internal error (for example     out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such     as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error()     to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be returned by     OpenSSL if the application has previously called SSL_CTX_set_cert_verify_callback(). Since most     applications do not do this the SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be     totally unexpected and applications may not behave correctly as a result. The exact behaviour will depend     on the application but it could result in crashes, infinite loops or other similar incorrect responses.
    This issue is made more serious in combination with a separate bug in OpenSSL 3.0 that will cause     X509_verify_cert() to indicate an internal error when processing a certificate chain. This will occur     where a certificate does not include the Subject Alternative Name extension but where a Certificate     Authority has enforced name constraints. This issue can occur even with valid chains. By combining the two     issues an attacker could induce incorrect, application dependent behaviour. Fixed in OpenSSL 3.0.1     (Affected 3.0.0). (CVE-2021-4044)

  - The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop     forever for non-prime moduli. Internally this function is used when parsing certificates that contain     elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point     encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has     invalid explicit curve parameters. Since certificate parsing happens prior to verification of the     certificate signature, any process that parses an externally supplied certificate may thus be subject to a     denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they     can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients     consuming server certificates - TLS servers consuming client certificates - Hosting providers taking     certificates or private keys from customers - Certificate authorities parsing certification requests from     subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that     use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS     issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate     which makes it slightly harder to trigger the infinite loop. However any operation which requires the     public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-     signed certificate to trigger the loop during verification of the certificate signature. This issue     affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the     15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected     1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc). (CVE-2022-0778)

  - c_rehash script allows command injection (CVE-2022-1292)

  - Signer certificate verification returned inaccurate response when using OCSP_NOCHECKS (CVE-2022-1343)

  - OPENSSL_LH_flush() breaks reuse of memory (CVE-2022-1473)

  - the c_rehash script allows command injection (CVE-2022-2068)

  - AES OCB fails to encrypt some bytes on 32-bit x86 (CVE-2022-2097)

  - X.509 Email Address Buffer Overflow (CVE-2022-3602, CVE-2022-3786)

  - A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed the malicious certificate or for the application to continue certificate verification despite     failure to construct a path to a trusted issuer. The read buffer overrun might result in a crash which     could lead to a denial of service attack. In theory it could also result in the disclosure of private     memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working     exploit leading to memory contents disclosure as of the time of release of this advisory. In a TLS client,     this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the     server requests client authentication and a malicious client connects. (CVE-2022-4203)

  - A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient     to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful     decryption an attacker would have to be able to send a very large number of trial messages for decryption.
    The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS     connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An     attacker that had observed a genuine connection between a client and a server could use this flaw to send     trial messages to the server and record the time taken to process them. After a sufficiently large number     of messages the attacker could recover the pre-master secret used for the original connection and thus be     able to decrypt the application data sent over that connection. (CVE-2022-4304)

  - The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the name (e.g.
    CERTIFICATE), any header data and the payload data. If the function succeeds then the name_out,     header and data arguments are populated with pointers to buffers containing the relevant decoded data.
    The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results     in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate     the header argument with a pointer to a buffer that has already been freed. If the caller also frees this     buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an     attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service     attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and     therefore these functions are also directly affected. These functions are also called indirectly by a     number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file()     which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the     caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations     include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL     asn1parse command line application is also impacted by this issue. (CVE-2022-4450)

  - The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is     primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may     also be called directly by end user applications. The function receives a BIO from the caller, prepends a     new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the     BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid,     the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this     case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal     pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then     a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the     internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call     BIO_pop() on the BIO. This internal function is in turn called by the public API functions     PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1,     SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include     i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL     cms and smime command line applications are similarly affected. (CVE-2023-0215)

  - An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7     data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is     an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL     does not call this function however third party applications might call these functions on untrusted data.
    (CVE-2023-0216)

  - An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA     public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash.
    This function can be called on public keys supplied from untrusted sources which could allow an attacker     to cause a denial of service attack. The TLS implementation in OpenSSL does not call this function but     applications might call the function if there are additional security requirements imposed by standards     such as FIPS 140-3. (CVE-2023-0217)

  - There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName.
    X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME     incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently     interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL     checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may     allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or     enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate     chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these     inputs, the other input must already contain an X.400 address as a CRL distribution point, which is     uncommon. As such, this vulnerability is most likely to only affect applications which have implemented     their own functionality for retrieving CRLs over a network. (CVE-2023-0286)

  - A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or     signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library     but the implementation of the hash algorithm is not available the digest initialization will fail. There     is a missing check for the return value from the initialization function which later leads to invalid     usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused     by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider.
    PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS     implementation in OpenSSL does not call these functions however third party applications would be affected     if they call these functions to verify signatures on untrusted data. (CVE-2023-0401)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.18-1.el9 build changelog.

  - An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x     before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If     a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly,     there is a brief window where the SSLSocket instance will detect the socket as not connected and won't     initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not     be authenticated if the server-side TLS peer is expecting client certificate authentication, and is     indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the     buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path     requires that the connection be closed on initialization of the SSLSocket.) (CVE-2023-40217)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the sudo-1.9.5p2-10.el9 build changelog.

  - Sudo does not escape control characters in log messages (CVE-2023-28486)

  - Sudo does not escape control characters in sudoreplay output (CVE-2023-28487)

  - Targeted Corruption of Register and Stack Variables (CVE-2023-42465)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:1644 advisory.

  - A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a     resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in     github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function     uses named return parameters to free pkey and ctx if there is an error initializing the context or     setting the different properties. All return statements related to error cases follow the return nil,     nil, fail(...) pattern, meaning that pkey and ctx will be nil inside the deferred function that should     free them. (CVE-2024-1394)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:1874 advisory.

  - The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid     JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any     value, or when the UnmarshalOptions.DiscardUnknown option is set. (CVE-2024-24786)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1817 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401,     8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM     Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2024-21011)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401-perf,     11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2 and 22; Oracle GraalVM Enterprise     Edition: 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise     Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible     data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a     web service which supplies data to the APIs. This vulnerability also applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. (CVE-2024-21068)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Concurrency). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf,     11.0.22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
    Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web     service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.
    (CVE-2024-21085)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401,     8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM     Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise     Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. (CVE-2024-21094)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:1751 advisory.

  - A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside     the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to     port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to     manipulate a running instance, potentially altering forwarders, allowing them to track all queries     forwarded by the local resolver, and, in some cases, disrupting resolving altogether. (CVE-2024-1488)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:1494 advisory.

  - NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could     potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124,     Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2023-5388)

  - An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This     vulnerability affects Firefox < 122, Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2024-0743)

  - The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary     other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email     message, the user might accidentally leak the confidential subject to a third party. While this update     fixes the bug and avoids future message contamination, it does not automatically repair existing     contaminations. Users are advised to use the repair folder functionality, which is available from the     context menu of email folders, which will erase incorrect subject assignments. This vulnerability affects     Thunderbird < 115.8.1. (CVE-2024-1936)

  - Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:*     This issue only affected Armv7-A systems. Other operating systems are unaffected. This vulnerability     affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2024-2607)

  - `AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could     have experienced integer overflows, causing underallocation of an output buffer leading to an out of     bounds write. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
    (CVE-2024-2608)

  - Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass     strict content security policies. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and     Thunderbird < 115.9. (CVE-2024-2610)

  - A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into     granting permissions. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird <     115.9. (CVE-2024-2611)

  - If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered     a crash or potentially be leveraged to achieve code execution. This vulnerability affects Firefox < 124,     Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2024-2612)

  - Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and     Thunderbird < 115.9. (CVE-2024-2614)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:1484 advisory.

  - NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could     potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124,     Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2023-5388)

  - An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This     vulnerability affects Firefox < 122, Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2024-0743)

  - Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:*     This issue only affected Armv7-A systems. Other operating systems are unaffected. This vulnerability     affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2024-2607)

  - `AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could     have experienced integer overflows, causing underallocation of an output buffer leading to an out of     bounds write. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
    (CVE-2024-2608)

  - Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass     strict content security policies. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and     Thunderbird < 115.9. (CVE-2024-2610)

  - A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into     granting permissions. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird <     115.9. (CVE-2024-2611)

  - If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered     a crash or potentially be leveraged to achieve code execution. This vulnerability affects Firefox < 124,     Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2024-2612)

  - Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and     Thunderbird < 115.9. (CVE-2024-2614)

  - To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead     of attempt to continue. This vulnerability affects Firefox ESR < 115.9 and Thunderbird < 115.9.
    (CVE-2024-2616)

  - An attacker was able to inject an event handler into a privileged object that would allow arbitrary     JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does     not affect mobile versions of Firefox. This vulnerability affects Firefox < 124.0.1 and Firefox ESR <     115.9.1. (CVE-2024-29944)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:1610 advisory.

  - close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (CVE-2022-48624)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:1615 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:1601 advisory.

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

  - This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the     specific series of conditions are met. libcurl performs transfers. In its API, an application creates     easy handles that are the individual handles for single transfers. libcurl provides a function call that     duplicates en easy handle called     [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies     enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the     actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned     version of the handle would instead store the file name as `none` (using the four ASCII letters, no     quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from     would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in     the current directory of the program using libcurl. And if using the correct file format of course.
    (CVE-2023-38546)

  - This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in     curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a     cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though     `co.uk` is listed as a PSL domain. (CVE-2023-46218)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1486 advisory.

  - NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could     potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124,     Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2023-5388)

  - An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This     vulnerability affects Firefox < 122, Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2024-0743)

  - Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:*     This issue only affected Armv7-A systems. Other operating systems are unaffected. This vulnerability     affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2024-2607)

  - `AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could     have experienced integer overflows, causing underallocation of an output buffer leading to an out of     bounds write. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
    (CVE-2024-2608)

  - Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass     strict content security policies. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and     Thunderbird < 115.9. (CVE-2024-2610)

  - A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into     granting permissions. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird <     115.9. (CVE-2024-2611)

  - If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered     a crash or potentially be leveraged to achieve code execution. This vulnerability affects Firefox < 124,     Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2024-2612)

  - Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and     Thunderbird < 115.9. (CVE-2024-2614)

  - To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead     of attempt to continue. This vulnerability affects Firefox ESR < 115.9 and Thunderbird < 115.9.
    (CVE-2024-2616)

  - An attacker was able to inject an event handler into a privileged object that would allow arbitrary     JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does     not affect mobile versions of Firefox. This vulnerability affects Firefox < 124.0.1 and Firefox ESR <     115.9.1. (CVE-2024-29944)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1498 advisory.

  - NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could     potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124,     Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2023-5388)

  - An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This     vulnerability affects Firefox < 122, Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2024-0743)

  - The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary     other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email     message, the user might accidentally leak the confidential subject to a third party. While this update     fixes the bug and avoids future message contamination, it does not automatically repair existing     contaminations. Users are advised to use the repair folder functionality, which is available from the     context menu of email folders, which will erase incorrect subject assignments. This vulnerability affects     Thunderbird < 115.8.1. (CVE-2024-1936)

  - Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:*     This issue only affected Armv7-A systems. Other operating systems are unaffected. This vulnerability     affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2024-2607)

  - `AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could     have experienced integer overflows, causing underallocation of an output buffer leading to an out of     bounds write. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
    (CVE-2024-2608)

  - Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass     strict content security policies. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and     Thunderbird < 115.9. (CVE-2024-2610)

  - A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into     granting permissions. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird <     115.9. (CVE-2024-2611)

  - If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered     a crash or potentially be leveraged to achieve code execution. This vulnerability affects Firefox < 124,     Firefox ESR < 115.9, and Thunderbird < 115.9. (CVE-2024-2612)

  - Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and     Thunderbird < 115.9. (CVE-2024-2614)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:1435 advisory.

  - pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note     this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value     must be immediately preceded by a minus. There must be a second placeholder for a string value after the     first placeholder; both must be on the same line. By constructing a matching string payload, the attacker     can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL     Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.
    (CVE-2024-1597)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:1335 advisory.

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1323 advisory.

  - There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect     and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively)     remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within     proximity of the victim. We recommend upgrading past commit https://www.google.com/url     https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4     https://www.google.com/url (CVE-2022-42896)

  - qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write     because lmax can exceed QFQ_MIN_LMAX. (CVE-2023-31436)

  - An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel     before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. (CVE-2023-45871)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to     achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending     network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug     and lack of error checking in agg_dequeue(). We recommend upgrading past commit     8fc134fee27f2263988ae38920bc03da416b03d8. (CVE-2023-4921)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
193960	CentOS 8 : libreswan (CESA-2024:1998)	medium
193959	CentOS 7 : thunderbird (RHSA-2024:1935)	high
193958	CentOS 7 : kpatch-patch (RHSA-2024:1960)	high
193957	CentOS 7 : grub2 (RHSA-2024:2002)	high
193956	CentOS 7 : kernel (RHSA-2024:2004)	critical
193955	CentOS 7 : shim (RHSA-2024:1959)	high
193954	CentOS 7 : java-11-openjdk (RHSA-2024:1821)	low
193947	CentOS 9 : openssh-8.7p1-38.el9	medium
193946	CentOS 9 : libssh-0.10.4-12.el9	medium
193945	CentOS 9 : less-590-3.el9	high
193944	CentOS 9 : kernel-5.14.0-354.el9	medium
193943	CentOS 9 : python3.9-3.9.18-2.el9	medium
193942	CentOS 9 : opensc-0.23.0-4.el9	medium
193941	CentOS 9 : rpm-4.16.1.3-26.el9	medium
193940	CentOS 9 : python-urllib3-1.26.5-5.el9	medium
193939	CentOS 9 : avahi-0.8-20.el9	medium
193938	CentOS 9 : toolbox-0.0.99.4-5.el9	critical
193937	CentOS 9 : zlib-1.2.11-41.el9	critical
193936	CentOS 9 : kernel-5.14.0-430.el9	medium
193935	CentOS 9 : linux-firmware-20231030-141.el9	medium
193934	CentOS 9 : opensc-0.23.0-3.el9	medium
193933	CentOS 9 : kernel-5.14.0-432.el9	high
193932	CentOS 9 : libxml2-2.9.13-5.el9	medium
193931	CentOS 9 : sqlite-3.34.1-7.el9	high
193930	CentOS 9 : pam-1.5.1-19.el9	medium
193929	CentOS 9 : kernel-5.14.0-435.el9	medium
193928	CentOS 9 : wpa_supplicant-2.10-5.el9	medium
193927	CentOS 9 : openssl-3.0.7-25.el9	high
193926	CentOS 9 : file-5.39-16.el9	medium
193925	CentOS 9 : kernel-5.14.0-437.el9	medium
193924	CentOS 9 : freerdp-2.4.1-5.el9	high
193923	CentOS 9 : glibc-2.34-83.el9.3	medium
193922	CentOS 9 : nss-3.90.0-4.el9	medium
193921	CentOS 9 : openssl-3.0.7-18.el9	critical
193920	CentOS 9 : python3.9-3.9.18-1.el9	medium
193919	CentOS 9 : sudo-1.9.5p2-10.el9	high
193758	CentOS 8 : grafana-pcp (CESA-2024:1644)	high
193479	CentOS 7 : rhc-worker-script (RHSA-2024:1874)	high
193437	CentOS 7 : java-1.8.0-openjdk (RHSA-2024:1817)	low
193200	CentOS 8 : unbound (CESA-2024:1751)	high
192981	CentOS 8 : thunderbird (CESA-2024:1494)	high
192980	CentOS 8 : firefox (CESA-2024:1484)	high
192979	CentOS 8 : less (CESA-2024:1610)	high
192857	CentOS 8 : expat (CESA-2024:1615)	high
192757	CentOS 8 : curl (CESA-2024:1601)	medium
192540	CentOS 7 : firefox (RHSA-2024:1486)	high
192539	CentOS 7 : thunderbird (RHSA-2024:1498)	high
192305	CentOS 8 : postgresql-jdbc (CESA-2024:1435)	critical
192133	CentOS 8 : dnsmasq (CESA-2024:1335)	high
192097	CentOS 7 : kpatch-patch (RHSA-2024:1323)	high

Detections

Analytics

CentOS Local Security Checks Family for Nessus

medium

high

high

high

critical

high

low

medium

medium

high

medium

medium

medium

medium

medium

medium

critical

critical

medium

medium

medium

high

medium

high

medium

medium

medium

high

medium

medium

high

medium

medium

critical

medium

high

high

high

low

high

high

high

high

high

medium

high

high

critical

high

high