According to the versions of the apr-util package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility     (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable     Runtime Utility (APR-util) 1.6.1 and prior versions. (CVE-2022-25147)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the apr-util packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility     (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable     Runtime Utility (APR-util) 1.6.1 and prior versions. (CVE-2022-25147)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3147 advisory.

    The Apache Portable Runtime (APR) is a portability library used by the     Apache HTTP Server and other projects. apr-util is a library which provides     additional utility interfaces for APR; including support for XML parsing,     LDAP, database interfaces, URI parsing, and more.

    Security Fix(es):

    * apr-util: out-of-bounds writes in the apr_base64 (CVE-2022-25147)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:3147 advisory.

  - Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility     (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable     Runtime Utility (APR-util) 1.6.1 and prior versions. (CVE-2022-25147)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:3109 advisory.

  - Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility     (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable     Runtime Utility (APR-util) 1.6.1 and prior versions. (CVE-2022-25147)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.7.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.7.0.5 advisory.

  - An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting     methods by supplying a URL that starts with blank characters. (CVE-2023-24329)

  - Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility     (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable     Runtime Utility (APR-util) 1.6.1 and prior versions. (CVE-2022-25147)

  - Every `named` instance configured to run as a recursive resolver maintains a cache database holding the     responses to the queries it has recently sent to authoritative servers. The size limit for that cache     database can be configured using the `max-cache-size` statement in the configuration file; it defaults to     90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the     configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets     from the cache, to keep memory use below the configured limit. It has been discovered that the     effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the     resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size`     limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0     through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2828)

  - An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability.
    In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and     parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be     executed. (CVE-2022-48339)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1684 advisory.

    Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility     (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable     Runtime Utility (APR-util) 1.6.1 and prior versions. (CVE-2022-25147)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
175550	EulerOS 2.0 SP9 : apr-util (EulerOS-SA-2023-1835)	Nessus	Huawei Local Security Checks	5/13/2023	5/18/2023	medium
176049	EulerOS 2.0 SP10 : apr-util (EulerOS-SA-2023-1947)	Nessus	Huawei Local Security Checks	5/18/2023	5/18/2023	medium
179100	EulerOS Virtualization 3.0.6.0 : apr-util (EulerOS-SA-2023-2497)	Nessus	Huawei Local Security Checks	7/31/2023	7/31/2023	medium
175935	RHEL 9 : apr-util (RHSA-2023:3147)	Nessus	Red Hat Local Security Checks	5/17/2023	11/7/2024	medium
176051	AlmaLinux 9 : apr-util (ALSA-2023:3147)	Nessus	Alma Linux Local Security Checks	5/18/2023	5/18/2023	medium
190157	CentOS 8 : apr-util (CESA-2023:3109)	Nessus	CentOS Local Security Checks	2/8/2024	2/8/2024	medium
181762	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.7.0.5)	Nessus	Misc.	9/21/2023	2/1/2024	high
171499	Amazon Linux AMI : apr-util, apr-util-devel, apr-util-freetds (ALAS-2023-1684)	Nessus	Amazon Linux Local Security Checks	2/15/2023	12/11/2024	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

high

medium