The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0559 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.7.0 ESR.

    Security Fix(es):

    * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)

    * Mozilla: Failure to update user input timestamp (CVE-2024-0742)

    * Mozilla: Crash when listing printers on Linux (CVE-2024-0746)

    * Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)

    * Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)

    * Mozilla: Privilege escalation through devtools (CVE-2024-0751)

    * Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)

    * Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7     (CVE-2024-0755)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0580 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: out-of-bounds read in winbind AUTH_CRAP (CVE-2022-2127)

    * samba: infinite loop in mdssvc RPC service for spotlight (CVE-2023-34966)

    * samba: type confusion in mdssvc RPC service for spotlight (CVE-2023-34967)

    * samba: spotlight server-side share path disclosure (CVE-2023-34968)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0588 advisory.

    The python-urllib3 package provides the Python HTTP module with connection pooling and file POST     abilities.

    Security Fix(es):

    * python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

    * urllib3: Request body not stripped after redirect from 303 status changes request method to GET     (CVE-2023-45803)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0575 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue     overhead (CVE-2023-3611)

    * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

    * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: Race Condition leading to UAF in Unix Socket could happen in sk_receive_queue (BZ#2230094)

    * kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c (CVE-2023-0458)

    * kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073)

    * kernel: hid: Use After Free in asus_remove() (CVE-2023-1079)

    * kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() (CVE-2023-1838)

    * kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

    * kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race (CVE-2023-3567)

    * kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params() (CVE-2023-3772)

    * kernel: smsusb: use-after-free caused by do_submit_urb() (CVE-2023-4132)

    * kernel: A heap out-of-bounds write (CVE-2023-5717)

    * kernel: denial of service in atm_tc_enqueue in net/sched/sch_atm.c due to type confusion     (CVE-2023-23455)

    * kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545)

    * kernel: Denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c (CVE-2023-28328)

    * kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove() (CVE-2023-33203)

    * kernel: saa7134: race condition leading to use-after-free in saa7134_finidev() (CVE-2023-35823)

    * kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c() (CVE-2023-35824)

    * kernel: r592: race condition leading to use-after-free in r592_remove() (CVE-2023-35825)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    * kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075)

    * kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855)

    * kernel: Use after free bug in r592_remove (CVE-2023-3141)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [RHEL 8.9] Proactively backport locking fixes from upstream (BZ#2235393)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0584 advisory.

    GNU libmicrohttpd is a small C library that makes it easy to run an HTTP server as part of another     application.

    Security Fix(es):

    * libmicrohttpd: remote DoS (CVE-2023-27371)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0574 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406)

    * ffr: Out of bounds read in bgpd/bgp_label.c (CVE-2023-38407)

    * frr: crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message (CVE-2023-47234)

    * frr: crash from malformed EOR-containing BGP UPDATE message (CVE-2023-47235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0602 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.7.0.

    Security Fix(es):

    * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)

    * Mozilla: Failure to update user input timestamp (CVE-2024-0742)

    * Mozilla: Crash when listing printers on Linux (CVE-2024-0746)

    * Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)

    * Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)

    * Mozilla: Privilege escalation through devtools (CVE-2024-0751)

    * Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)

    * Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7     (CVE-2024-0755)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0573 advisory.

    The libfastjson library provides essential JavaScript Object Notation (JSON) handling functions. The     library enables users to construct JSON objects in C, output them as JSON-formatted strings, and convert     JSON-formatted strings back to the C representation of JSON objects.

    Security Fix(es):

    * json-c, libfastjson: integer overflow and out-of-bounds write via a large JSON file (CVE-2020-12762)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0569 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * QEMU: hcd-ehci: DMA reentrancy issue leads to use-after-free (CVE-2021-3750)

    * QEMU: e1000e: heap use-after-free in e1000e_write_packet_to_guest() (CVE-2023-3019)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0564 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

    * runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0572 advisory.

    Oniguruma is a regular expressions library that supports a variety of character encodings.

    Security Fix(es):

    * oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

    * oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

    * oniguruma: integer overflow in search_in_range function in regexec.c leads to out-of-bounds read     (CVE-2019-19012)

    * oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c     (CVE-2019-19203)

    * oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c     (CVE-2019-19204)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0582 advisory.

    The RPM Package Manager (RPM) is a command-line driven package management system capable of installing,     uninstalling, verifying, querying, and updating software packages.

    Security Fix(es):

    * rpm: TOCTOU race in checks for unsafe symlinks (CVE-2021-35937)

    * rpm: races with chown/chmod/capabilities calls during installation (CVE-2021-35938)

    * rpm: checks for unsafe symlinks are not performed for intermediary directories (CVE-2021-35939)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0579 advisory.

    HTTP::Tiny is a small and simple HTTP/1.1 client written in Perl.

    Security Fix(es):

    * http-tiny: insecure TLS cert default (CVE-2023-31486)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0593 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0563 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

    * kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

    * kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0606 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)

    * openssh: potential command injection via shell metacharacters (CVE-2023-51385)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0598 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.7.0.

    Security Fix(es):

    * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)

    * Mozilla: Failure to update user input timestamp (CVE-2024-0742)

    * Mozilla: Crash when listing printers on Linux (CVE-2024-0746)

    * Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)

    * Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)

    * Mozilla: Privilege escalation through devtools (CVE-2024-0751)

    * Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)

    * Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7     (CVE-2024-0755)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0604 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.7.0 ESR.

    Security Fix(es):

    * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)

    * Mozilla: Failure to update user input timestamp (CVE-2024-0742)

    * Mozilla: Crash when listing printers on Linux (CVE-2024-0746)

    * Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)

    * Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)

    * Mozilla: Privilege escalation through devtools (CVE-2024-0751)

    * Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)

    * Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7     (CVE-2024-0755)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0596 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.7.0 ESR.

    Security Fix(es):

    * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)

    * Mozilla: Failure to update user input timestamp (CVE-2024-0742)

    * Mozilla: Crash when listing printers on Linux (CVE-2024-0746)

    * Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)

    * Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)

    * Mozilla: Privilege escalation through devtools (CVE-2024-0751)

    * Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)

    * Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7     (CVE-2024-0755)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0577 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw: intel: Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi (CVE-2022-46329)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0600 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.7.0 ESR.

    Security Fix(es):

    * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)

    * Mozilla: Failure to update user input timestamp (CVE-2024-0742)

    * Mozilla: Crash when listing printers on Linux (CVE-2024-0746)

    * Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)

    * Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)

    * Mozilla: Privilege escalation through devtools (CVE-2024-0751)

    * Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)

    * Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7     (CVE-2024-0755)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0576 advisory.

    Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero     Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware     applications allow you to plug your computer into a network and, with no configuration, view other people     to chat with, view printers to print with, and find shared files on other computers.

    Security Fix(es):

    * avahi: Local DoS by event-busy-loop from writing long lines to /run/avahi-daemon/socket (CVE-2021-3468)

    * avahi: Reachable assertion in avahi_dns_packet_append_record (CVE-2023-38469)

    * avahi: Reachable assertion in avahi_escape_label (CVE-2023-38470)

    * avahi: Reachable assertion in dbus_set_host_name (CVE-2023-38471)

    * avahi: Reachable assertion in avahi_rdata_parse (CVE-2023-38472)

    * avahi: Reachable assertion in avahi_alternative_host_name (CVE-2023-38473)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0603 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.7.0 ESR.

    Security Fix(es):

    * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)

    * Mozilla: Failure to update user input timestamp (CVE-2024-0742)

    * Mozilla: Crash when listing printers on Linux (CVE-2024-0746)

    * Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)

    * Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)

    * Mozilla: Privilege escalation through devtools (CVE-2024-0751)

    * Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)

    * Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7     (CVE-2024-0755)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0594 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)

    * openssh: potential command injection via shell metacharacters (CVE-2023-51385)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0601 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.7.0.

    Security Fix(es):

    * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)

    * Mozilla: Failure to update user input timestamp (CVE-2024-0742)

    * Mozilla: Crash when listing printers on Linux (CVE-2024-0746)

    * Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)

    * Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)

    * Mozilla: Privilege escalation through devtools (CVE-2024-0751)

    * Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)

    * Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7     (CVE-2024-0755)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0562 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)

    * kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

    * kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

    * kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * LPAR is crashed by Phyp when doing DLPAR CPU operations (BZ#2193378)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0557 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer (CVE-2023-6816)

    * xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access     (CVE-2024-0229)

    * xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent (CVE-2024-21885)

    * xorg-x11-server: heap buffer overflow in DisableDevice (CVE-2024-21886)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0597 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer (CVE-2023-6816)

    * xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access     (CVE-2024-0229)

    * xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent (CVE-2024-21885)

    * xorg-x11-server: heap buffer overflow in DisableDevice (CVE-2024-21886)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0571 advisory.

    The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can     capture and display the packet headers on a particular network interface or on all interfaces.

    Security Fix(es):

    * tcpslice: use-after-free in extract_slice() (CVE-2021-41043)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0558 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer (CVE-2023-6816)

    * xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access     (CVE-2024-0229)

    * xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent (CVE-2024-21885)

    * xorg-x11-server: heap buffer overflow in DisableDevice (CVE-2024-21886)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0589 advisory.

    SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A     complete database is stored in a single disk file. The API is designed for convenience and ease of use.
    Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the     administrative hassles of supporting a separate database server.

    Security Fix(es):

    * sqlite: heap-buffer-overflow at sessionfuzz (CVE-2023-7104)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0615 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.7.0 ESR.

    Security Fix(es):

    * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)

    * Mozilla: Failure to update user input timestamp (CVE-2024-0742)

    * Mozilla: Crash when listing printers on Linux (CVE-2024-0746)

    * Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)

    * Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)

    * Mozilla: Privilege escalation through devtools (CVE-2024-0751)

    * Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)

    * Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7     (CVE-2024-0755)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0586 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: use after free in heappushpop() of heapq module (CVE-2022-48560)

    * python: DoS when processing malformed Apple Property List files in binary format (CVE-2022-48564)

    * python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple     (CVE-2023-27043)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0607 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer (CVE-2023-6816)

    * xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access     (CVE-2024-0229)

    * xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent (CVE-2024-21885)

    * xorg-x11-server: heap buffer overflow in DisableDevice (CVE-2024-21886)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0608 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.7.0 ESR.

    Security Fix(es):

    * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)

    * Mozilla: Failure to update user input timestamp (CVE-2024-0742)

    * Mozilla: Crash when listing printers on Linux (CVE-2024-0746)

    * Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)

    * Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)

    * Mozilla: Privilege escalation through devtools (CVE-2024-0751)

    * Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)

    * Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7     (CVE-2024-0755)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0616 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.7.0.

    Security Fix(es):

    * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741)

    * Mozilla: Failure to update user input timestamp (CVE-2024-0742)

    * Mozilla: Crash when listing printers on Linux (CVE-2024-0746)

    * Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747)

    * Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749)

    * Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750)

    * Mozilla: Privilege escalation through devtools (CVE-2024-0751)

    * Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753)

    * Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7     (CVE-2024-0755)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0614 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer (CVE-2023-6816)

    * xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access     (CVE-2024-0229)

    * xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent (CVE-2024-21885)

    * xorg-x11-server: heap buffer overflow in DisableDevice (CVE-2024-21886)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0561 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

    * hw: amd: Cross-Process Information Leak (CVE-2023-20593)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0587 advisory.

    pip is a package management system used to install and manage software packages written in Python. Many     packages can be found in the Python Package Index (PyPI). pip is a recursive acronym that can stand for     either Pip Installs Packages or Pip Installs Python.

    Security Fix(es):

    * python: tarfile module directory traversal (CVE-2007-4559)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0554 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: net/sched: sch_qfq component can be exploited if in qfq_change_agg function happens qfq_enqueue     overhead (CVE-2023-3611)

    * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

    * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0532 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0538 advisory.

    libssh is a library which implements the SSH protocol. It can be used to implement client and server     applications.

    Security Fix(es):

    * libssh: NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667)

    * libssh: authorization bypass in pki_verify_data_signature (CVE-2023-2283)

    * ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0539 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0533 advisory.

    The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements     cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

    Security Fix(es):

    * gnutls: timing side-channel in the RSA-PSK authentication (CVE-2023-5981)

    * gnutls: incomplete fix for CVE-2023-5981 (CVE-2024-0553)

    * gnutls: rejects certificate chain with distributed trust (CVE-2024-0567)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1582 advisory.

  - glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  - c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

  - http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

  - Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

  - Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)

  - Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

  - Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

  - Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1583 advisory.

  - glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  - http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

  - Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

  - Node.js: OpenSSL error handling issues in nodejs crypto library (CVE-2023-23919)

  - Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

  - Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936)

  - Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7528 advisory.

  - python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

  - python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0154 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Security Fix(es):

    * openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)

    * OpenSSL: Excessive time spent checking DH q parameter value (CVE-2023-3817)

    * openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or     parameters may be very slow (CVE-2023-5678)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * openssl: Excessive time spent checking DH q parameter value (JIRA:RHEL-14238)

    * openssl: Excessive time spent checking DH keys and parameters (JIRA:RHEL-14244)

    * openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or     parameters may be very slow (JIRA:RHEL-16537)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7464 advisory.

  - samba: smbd allows client access to unix domain sockets on the file system as root (CVE-2023-3961)

  - samba: SMB clients can truncate files with read-only permissions (CVE-2023-4091)

  - samba: rpcecho development server allows denial of service via sleep() call on AD DC (CVE-2023-42669)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7883 advisory.

  - postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)

  - postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

  - postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)

  - postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)

  - postgresql: MERGE fails to enforce UPDATE or SELECT row security policies (CVE-2023-39418)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
189816	RHEL 8 : firefox (RHSA-2024:0559)	high
189815	RHEL 8 : samba (RHSA-2024:0580)	medium
189814	RHEL 8 : python-urllib3 (RHSA-2024:0588)	high
189813	RHEL 8 : kernel (RHSA-2024:0575)	high
189812	RHEL 8 : libmicrohttpd (RHSA-2024:0584)	medium
189811	RHEL 8 : frr (RHSA-2024:0574)	critical
189810	RHEL 9 : thunderbird (RHSA-2024:0602)	high
189809	RHEL 8 : libfastjson (RHSA-2024:0573)	high
189808	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2024:0569)	high
189807	RHEL 8 : container-tools:3.0 (RHSA-2024:0564)	high
189806	RHEL 8 : oniguruma (RHSA-2024:0572)	critical
189805	RHEL 8 : rpm (RHSA-2024:0582)	medium
189804	RHEL 8 : perl-HTTP-Tiny (RHSA-2024:0579)	high
189803	RHEL 8 : kpatch-patch (RHSA-2024:0593)	high
189802	RHEL 8 : kernel-rt (RHSA-2024:0563)	high
189801	RHEL 8 : openssh (RHSA-2024:0606)	medium
189800	RHEL 8 : thunderbird (RHSA-2024:0598)	high
189799	RHEL 9 : firefox (RHSA-2024:0604)	high
189798	RHEL 8 : firefox (RHSA-2024:0596)	high
189797	RHEL 8 : linux-firmware (RHSA-2024:0577)	medium
189796	RHEL 7 : firefox (RHSA-2024:0600)	high
189795	RHEL 8 : avahi (RHSA-2024:0576)	medium
189794	RHEL 9 : firefox (RHSA-2024:0603)	high
189793	RHEL 8 : openssh (RHSA-2024:0594)	medium
189792	RHEL 7 : thunderbird (RHSA-2024:0601)	high
189791	RHEL 8 : kernel (RHSA-2024:0562)	high
189790	RHEL 9 : tigervnc (RHSA-2024:0557)	critical
189789	RHEL 8 : tigervnc (RHSA-2024:0597)	critical
189788	RHEL 8 : tcpdump (RHSA-2024:0571)	medium
189787	RHEL 8 : tigervnc (RHSA-2024:0558)	critical
189786	RHEL 8 : sqlite (RHSA-2024:0589)	high
189785	RHEL 9 : firefox (RHSA-2024:0615)	high
189784	RHEL 8 : python3 (RHSA-2024:0586)	medium
189783	RHEL 8 : tigervnc (RHSA-2024:0607)	critical
189782	RHEL 8 : firefox (RHSA-2024:0608)	high
189781	RHEL 9 : thunderbird (RHSA-2024:0616)	high
189780	RHEL 9 : tigervnc (RHSA-2024:0614)	critical
189779	RHEL 8 : linux-firmware (RHSA-2024:0561)	medium
189778	RHEL 8 : python-pip (RHSA-2024:0587)	medium
189750	RHEL 8 : kpatch-patch (RHSA-2024:0554)	high
189744	RHEL 8 : tomcat (RHSA-2024:0532)	high
189743	RHEL 8 : libssh (RHSA-2024:0538)	medium
189742	RHEL 8 : tomcat (RHSA-2024:0539)	high
189741	RHEL 9 : gnutls (RHSA-2024:0533)	high
189669	RHEL 8 : nodejs:16 (RHSA-2023:1582)	high
189668	RHEL 8 : nodejs:18 (RHSA-2023:1583)	high
189667	RHEL 8 : fence-agents (RHSA-2023:7528)	critical
189665	RHEL 8 : openssl (RHSA-2024:0154)	medium
189664	RHEL 8 : samba (RHSA-2023:7464)	critical
189663	RHEL 8 : postgresql:15 (RHSA-2023:7883)	high

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

medium

high

high

medium

critical

high

high

high

high

critical

medium

high

high

high

medium

high

high

high

medium

high

medium

high

medium

high

high

critical

critical

medium

critical

high

high

medium

critical

high

high

critical

medium

medium

high

high

medium

high

high

high

high

critical

medium

critical

high