The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0004 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 115.6.0.

    Security Fix(es):

    * Mozilla: Heap-buffer-overflow affecting WebGL <code>DrawElementsInstanced</code> method with Mesa VM     driver (CVE-2023-6856)

    * Mozilla: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6     (CVE-2023-6864)

    * Mozilla: S/MIME signature accepted despite mismatching message date (CVE-2023-50761)

    * Mozilla: Truncated signed text was shown with a valid OpenPGP signature (CVE-2023-50762)

    * Mozilla: Symlinks may resolve to smaller than expected buffers (CVE-2023-6857)

    * Mozilla: Heap buffer overflow in <code>nsTextFragment</code> (CVE-2023-6858)

    * Mozilla: Use-after-free in PR_GetIdentitiesLayer (CVE-2023-6859)

    * Mozilla: Potential sandbox escape due to <code>VideoBridge</code> lack of texture validation     (CVE-2023-6860)

    * Mozilla: Heap buffer overflow affected <code>nsWindow::PickerOpen(void)</code> in headless mode     (CVE-2023-6861)

    * Mozilla: Use-after-free in <code>nsDNSService</code> (CVE-2023-6862)

    * Mozilla: Undefined behavior in <code>ShutdownObserver()</code> (CVE-2023-6863)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7558 advisory.

  - kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

  - kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and     cls_route (CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)

  - kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7543 advisory.

  - c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

  - c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1672 advisory.

  - httpd: HTTP request splitting with mod_rewrite and mod_proxy (CVE-2023-25690)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0137 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * Kerberos: delegation constrain bypass in S4U2Proxy (CVE-2020-17049)

    * ipa: Invalid CSRF protection (CVE-2023-5455)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:7504 advisory.

  - Mozilla: Out-of-bound memory access in WebGL2 blitFramebuffer (CVE-2023-6204)

  - Mozilla: Use-after-free in MessagePort::Entangled (CVE-2023-6205)

  - Mozilla: Clickjacking permission prompts using the fullscreen transition (CVE-2023-6206)

  - Mozilla: Use-after-free in ReadableByteStreamQueueEntry::Buffer (CVE-2023-6207)

  - Mozilla: Using Selection API would copy contents into X11 primary selection. (CVE-2023-6208)

  - Mozilla: Incorrect parsing of relative URLs starting with /// (CVE-2023-6209)

  - Mozilla: Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5 (CVE-2023-6212)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7730 advisory.

  - tracker-miners: sandbox escape (CVE-2023-5557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7786 advisory.

  - postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:5993 advisory.

  - python: TLS handshake bypass (CVE-2023-40217)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7579 advisory.

  - postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)

  - postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

  - postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)

  - postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0397 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

    Security Fix(es):

    * squid: DoS against HTTP and HTTPS (CVE-2023-5824)

    * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724)

    * squid: NULL pointer dereference in the gopher protocol code (CVE-2023-46728)

    * squid: Buffer over-read in the HTTP Message processing feature (CVE-2023-49285)

    * squid: Incorrect Check of Function Return Value In Helper Process management (CVE-2023-49286)

    * squid: denial of service in HTTP request parsing (CVE-2023-50269)

    Bug Fix(es):

    * squid crashes in assertion when a parent peer exists (JIRA:RHEL-18256)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7533 advisory.

  - xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty (CVE-2023-5367)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:7511 advisory.

  - Mozilla: Out-of-bound memory access in WebGL2 blitFramebuffer (CVE-2023-6204)

  - Mozilla: Use-after-free in MessagePort::Entangled (CVE-2023-6205)

  - Mozilla: Clickjacking permission prompts using the fullscreen transition (CVE-2023-6206)

  - Mozilla: Use-after-free in ReadableByteStreamQueueEntry::Buffer (CVE-2023-6207)

  - Mozilla: Using Selection API would copy contents into X11 primary selection. (CVE-2023-6208)

  - Mozilla: Incorrect parsing of relative URLs starting with /// (CVE-2023-6209)

  - Mozilla: Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5 (CVE-2023-6212)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0093 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Security Fix(es):

    * nss: timing attack against RSA decryption (CVE-2023-5388)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1551 advisory.

  - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability     (CVE-2023-1393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1548 advisory.

  - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability     (CVE-2023-1393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0399 advisory.

    The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements     cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

    Security Fix(es):

    * gnutls: timing side-channel in the RSA-PSK authentication (CVE-2023-5981)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7531 advisory.

  - pixman: Integer overflow in pixman_sample_floor_y leading to heap out-of-bounds write (CVE-2022-44638)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:0011 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 115.6.0 ESR.

    Security Fix(es):

    * Mozilla: Heap-buffer-overflow affecting WebGL <code>DrawElementsInstanced</code> method with Mesa VM     driver (CVE-2023-6856)

    * Mozilla: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6     (CVE-2023-6864)

    * Mozilla: Potential exposure of uninitialized data in <code>EncryptingOutputStream</code> (CVE-2023-6865)

    * Mozilla: Symlinks may resolve to smaller than expected buffers (CVE-2023-6857)

    * Mozilla: Heap buffer overflow in <code>nsTextFragment</code> (CVE-2023-6858)

    * Mozilla: Use-after-free in PR_GetIdentitiesLayer (CVE-2023-6859)

    * Mozilla: Potential sandbox escape due to <code>VideoBridge</code> lack of texture validation     (CVE-2023-6860)

    * Mozilla: Heap buffer overflow affected <code>nsWindow::PickerOpen(void)</code> in headless mode     (CVE-2023-6861)

    * Mozilla: Use-after-free in <code>nsDNSService</code> (CVE-2023-6862)

    * Mozilla: Clickjacking permission prompts using the popup transition (CVE-2023-6867)

    * Mozilla: Undefined behavior in <code>ShutdownObserver()</code> (CVE-2023-6863)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0014 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions (CVE-2023-6377)

    * xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty     (CVE-2023-6478)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7539 advisory.

  - hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982)

  - kernel: use-after-free due to race condition occurring in dvb_register_device() (CVE-2022-45884)

  - kernel: use-after-free due to race condition occurring in dvb_net.c (CVE-2022-45886)

  - kernel: use-after-free due to race condition occurring in dvb_ca_en50221.c (CVE-2022-45919)

  - kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

  - kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

  - kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and     cls_route (CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208)

  - kernel: Race between task migrating pages and another task calling exit_mmap to release those same pages     getting invalid opcode BUG in include/linux/swapops.h (CVE-2023-4732)

  - kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

  - kernel: netfilter: potential slab-out-of-bound access due to integer underflow (CVE-2023-42753)

  - kernel: mm/slab_common: slab_caches list corruption after kmem_cache_destroy() (CVE-2023-52562)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7840 advisory.

  - gstreamer: MXF demuxer use-after-free vulnerability (CVE-2023-44446)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7656 advisory.

  - postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868)

  - postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869)

  - postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870)

  - postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7540 advisory.

  - curl: cookie injection with none file (CVE-2023-38546)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7264 advisory.

  - open-vm-tools: SAML token signature bypass (CVE-2023-34058)

  - open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper (CVE-2023-34059)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7544 advisory.

  - libxml2: crafted xml can cause global buffer overflow (CVE-2023-39615)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0456 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    Security Fix(es):

    * grub2: bypass the GRUB password protection feature (CVE-2023-4001)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0452 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: information disclosure by exploiting a mixed case flaw (CVE-2023-46218)

    Bug Fix(es):

    * Cannot upload files bigger than 64K to SSH-2.0-9.99 sshlib server, transfer hangs (RHEL-14836)

    * curl: Incomplete patch for host name wildcard checking (RHEL-20618)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0474 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080)

    * tomcat: FileUpload: DoS due to accumulation of temporary files on Windows (CVE-2023-42794)

    * tomcat: improper cleaning of recycled objects could lead to information leak (CVE-2023-42795)

    * tomcat: incorrectly parsed http trailer headers can cause request smuggling (CVE-2023-45648)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0425 advisory.

    SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A     complete database is stored in a single disk file. The API is designed for convenience and ease of use.
    Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the     administrative hassles of supporting a separate database server.

    Security Fix(es):

    * sqlite: Crash due to misuse of window functions. (CVE-2020-24736)

    * sqlite: an array-bounds overflow if billions of bytes are used in a string argument to a C API     (CVE-2022-35737)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0454 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple     (CVE-2023-27043)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0500 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Security Fix(es):

    * openssl: Incorrect cipher key and IV length processing (CVE-2023-5363)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Backport implicit rejection mechanism for RSA PKCS#1 v1.5 to RHEL-9.2.z (RHEL-14578, BZ#2153471)
    * OpenSSL should provide FIPS-compliant RSA-OAEP (RHEL-14616)
    * NIST SP 800-56Arev3 Section 5.6.2.1 - Missing ECDH Public Key Check (RHEL-15992)
    * In FIPS mode, OpenSSL must not perform any cryptographic operations when rsa_keygen_pairwise_test fails     (RHEL-17110)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0417 advisory.

    The shadow-utils packages include programs for converting UNIX password files to the shadow password     format, as well as utilities for managing user and group accounts.

    Security Fix(es):

    * shadow-utils: possible password leak during passwd(1) change (CVE-2023-4641)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0451 advisory.

    The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements     cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

    Security Fix(es):

    * gnutls: timing side-channel in the RSA-PSK authentication (CVE-2023-5981)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0434 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: information disclosure by exploiting a mixed case flaw (CVE-2023-46218)

    Bug Fix(es):

    * Cannot upload files bigger than 64K to SSH-2.0-9.99 sshlib server, transfer hangs (RHEL-14835)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0433 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0423 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: out-of-bounds read in winbind AUTH_CRAP (CVE-2022-2127)

    * samba: infinite loop in mdssvc RPC service for spotlight (CVE-2023-34966)

    * samba: type confusion in mdssvc RPC service for spotlight (CVE-2023-34967)

    * samba: spotlight server-side share path disclosure (CVE-2023-34968)

    * samba: GnuTLS gnutls_rnd() can fail and give predictable random values (CVE-2022-1615)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0431 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: xfrm_expand_policies() in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice     (CVE-2022-36879)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195)

    * kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

    * kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race (CVE-2023-3567)

    * kernel: use-after-free in netfilter: nf_tables (CVE-2023-3777)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest RHEL-9.0.z Batch 14 (RHEL-17273)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0477 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * ffr: Flowspec overflow in bgpd/bgp_flowspec.c (CVE-2023-38406)

    * ffr: Out of bounds read in bgpd/bgp_label.c (CVE-2023-38407)

    * frr: crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message (CVE-2023-47234)

    * frr: crash from malformed EOR-containing BGP UPDATE message (CVE-2023-47235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0449 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw: intel: Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi (CVE-2022-46329)

    * hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0419 advisory.

    The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving     API.

    Security Fix(es):

    * c-ares: Heap buffer over read in ares_parse_soa_reply (CVE-2020-22217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0406 advisory.

    The protobuf-c packages provide C bindings for Google's Protocol Buffers.

    Security Fix(es):

    * protobuf-c: unsigned integer overflow in parse_required_member (CVE-2022-48468)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0439 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: bpf: Incorrect verifier pruning leads to unsafe code paths being incorrectly marked as safe     (CVE-2023-2163)

    * kernel: use after free in unix_stream_sendpage (CVE-2023-4622)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: eBPF: insufficient stack type checks in dynptr (CVE-2023-39191)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)

    * kernel: Race Condition leading to UAF in Unix Socket could happen in sk_receive_queue (BZ#2230094)

    * kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)

    * kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

    * kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

    * kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

    * kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race (CVE-2023-3567)

    * kernel: use-after-free in netfilter: nf_tables (CVE-2023-3777)

    * kernel: use after free in nft_immediate_deactivate (CVE-2023-4015)

    * kernel: A heap out-of-bounds write (CVE-2023-5717)

    * hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

    * kernel: fbcon: out-of-sync arrays in fbcon_mode_deleted due to wrong con2fb_map assignment     (CVE-2023-38409)

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    * kernel: use-after-free in smb2_is_status_io_timeout() (CVE-2023-1192)

    * kernel: NULL pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c     (CVE-2023-6679)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:0436 advisory.

    Libcap is a library for getting and setting POSIX.1e (formerly POSIX 6) draft 15 capabilities.

    Security Fix(es):

    * libcap: Integer Overflow in _libcap_strdup() (CVE-2023-2603)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0432 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating     system.

    Security Fix(es):

    * kernel: xfrm_expand_policies() in net/xfrm/xfrm_policy.c can cause a refcount     to be dropped twice (CVE-2022-36879)

    * kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip     (CVE-2022-41858)

    * kernel: use-after-free caused by invalid pointer hostname in fs/cifs/connect.c     (CVE-2023-1195)

    * kernel: UAF during login when accessing the shost ipaddress (CVE-2023-2162)

    * kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race     (CVE-2023-3567)

    * kernel: use-after-free in netfilter: nf_tables (CVE-2023-3777)

    * kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)

    * kernel: use after free in nvmet_tcp_free_crypto in NVMe (CVE-2023-5178)

    * kernel: IGB driver inadequate buffer size for frames larger than MTU     (CVE-2023-45871)

    * kernel: SEV-ES local priv escalation (CVE-2023-46813)

    Bug Fix(es):

    * RHEL 9 Hyper-V: Excessive hv_storvsc driver logging with srb_status     SRB_STATUS_INTERNAL_ERROR  (0x30)

    * RHEL9.0 - s390/qeth: NET2016 - fix use-after-free in HSCI

    * DM multipath showing failed path for an nvme-o-FC LUN when performing I/O     operations

    * XFS: sync to upstream v5.15

    * AMDSERVER 9.4 Bug, Turin: Support larger microcode patches

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0410 advisory.

    The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can     capture and display the packet headers on a particular network interface or on all interfaces.

    Security Fix(es):

    * tcpslice: use-after-free in extract_slice() (CVE-2021-41043)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0455 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)

    * openssh: potential command injection via shell metacharacters (CVE-2023-51385)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0428 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: FTP too eager connection reuse (CVE-2023-27535)

    * curl: GSS delegation too eager connection re-use (CVE-2023-27536)

    * curl: information disclosure by exploiting a mixed case flaw (CVE-2023-46218)

    * curl: Incorrect handling of control code characters in cookies (CVE-2022-35252)

    * curl: Use-after-free triggered by an HTTP proxy deny response (CVE-2022-43552)

    * curl: more POST-after-PUT confusion (CVE-2023-28322)

    Bug Fix(es):

    * Cannot upload files bigger than 64K to SSH-2.0-9.99 sshlib server, transfer hangs (RHEL-5483)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0408 advisory.

    EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package     contains a sample 64-bit UEFI firmware for QEMU and KVM.

    Security Fix(es):

    * edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler()     (CVE-2019-14560)

    * openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0420 advisory.

    FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType     loads, hints, and renders individual glyphs efficiently.

    Security Fix(es):

    * FreeType: Buffer overflow in sfnt_init_face (CVE-2022-27404)

    * FreeType: Segmentation violation via FNT_Size_Request (CVE-2022-27405)

    * Freetype: Segmentation violation via FT_Request_Size (CVE-2022-27406)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
189662	RHEL 8 : thunderbird (RHSA-2024:0004)	high
189661	RHEL 8 : kpatch-patch (RHSA-2023:7558)	high
189660	RHEL 8 : c-ares (RHSA-2023:7543)	high
189659	RHEL 8 : httpd:2.4 (RHSA-2023:1672)	critical
189658	RHEL 8 : idm:DL1 (RHSA-2024:0137)	medium
189657	RHEL 8 : thunderbird (RHSA-2023:7504)	high
189656	RHEL 8 : tracker-miners (RHSA-2023:7730)	high
189655	RHEL 8 : postgresql:10 (RHSA-2023:7786)	high
189654	RHEL 8 : python27:2.7 (RHSA-2023:5993)	medium
189653	RHEL 8 : postgresql:13 (RHSA-2023:7579)	high
189652	RHEL 8 : squid:4 (RHSA-2024:0397)	high
189651	RHEL 8 : tigervnc (RHSA-2023:7533)	high
189650	RHEL 8 : firefox (RHSA-2023:7511)	high
189649	RHEL 8 : nss (RHSA-2024:0093)	medium
189648	RHEL 8 : tigervnc (RHSA-2023:1551)	high
189647	RHEL 8 : tigervnc (RHSA-2023:1548)	high
189646	RHEL 8 : gnutls (RHSA-2024:0399)	medium
189645	RHEL 8 : pixman (RHSA-2023:7531)	high
189644	RHEL 8 : firefox (RHSA-2024:0011)	high
189643	RHEL 8 : tigervnc (RHSA-2024:0014)	high
189642	RHEL 8 : kernel (RHSA-2023:7539)	high
189641	RHEL 8 : gstreamer1-plugins-bad-free (RHSA-2023:7840)	high
189640	RHEL 8 : postgresql:12 (RHSA-2023:7656)	high
189639	RHEL 8 : curl (RHSA-2023:7540)	low
189638	RHEL 8 : open-vm-tools (RHSA-2023:7264)	high
189637	RHEL 8 : libxml2 (RHSA-2023:7544)	medium
189588	RHEL 9 : grub2 (RHSA-2024:0456)	medium
189587	RHEL 9 : curl (RHSA-2024:0452)	medium
189586	RHEL 9 : tomcat (RHSA-2024:0474)	medium
189585	RHEL 8 : sqlite (RHSA-2024:0425)	high
189584	RHEL 9 : python3.9 (RHSA-2024:0454)	medium
189583	RHEL 9 : openssl (RHSA-2024:0500)	high
189582	RHEL 8 : shadow-utils (RHSA-2024:0417)	medium
189581	RHEL 9 : gnutls (RHSA-2024:0451)	medium
189580	RHEL 9 : curl (RHSA-2024:0434)	medium
189579	RHEL 9 : linux-firmware (RHSA-2024:0433)	medium
189578	RHEL 8 : samba (RHSA-2024:0423)	medium
189577	RHEL 9 : kernel-rt (RHSA-2024:0431)	high
189576	RHEL 9 : frr (RHSA-2024:0477)	critical
189575	RHEL 9 : linux-firmware (RHSA-2024:0449)	medium
189574	RHEL 8 : c-ares (RHSA-2024:0419)	medium
189573	RHEL 8 : protobuf-c (RHSA-2024:0406)	medium
189572	RHEL 9 : kernel-rt (RHSA-2024:0439)	high
189571	RHEL 9 : libcap (RHSA-2024:0436)	high
189570	RHEL 9 : kernel (RHSA-2024:0432)	high
189569	RHEL 8 : tcpdump (RHSA-2024:0410)	medium
189568	RHEL 9 : openssh (RHSA-2024:0455)	medium
189567	RHEL 8 : curl (RHSA-2024:0428)	medium
189566	RHEL 8 : edk2 (RHSA-2024:0408)	medium
189565	RHEL 8 : freetype (RHSA-2024:0420)	critical

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

high

high

critical

medium

high

high

high

medium

high

high

high

high

medium

high

high

medium

high

high

high

high

high

high

low

high

medium

medium

medium

medium

high

medium

high

medium

medium

medium

medium

medium

high

critical

medium

medium

medium

high

high

high

medium

medium

medium

medium

critical