The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:3139 advisory.

  - squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is     then used by unsquashfs to create the new file during the unsquash. The filename is not validated for     traversal outside of the destination directory, and thus allows writing to locations outside of the     destination. (CVE-2021-40153)

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3022 advisory.

  - A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer()     function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents     of memory on the system. (CVE-2023-43788)

  - A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user     can trigger an out-of-bounds read error and read contents of memory on the system. (CVE-2023-43789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3264 advisory.

  - A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local     network, allowing remote command execution with the privileges of the Redis user. This issue can only be     exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually.
    The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This     flaw affects PCP versions 4.3.4 and newer. (CVE-2024-3019)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3211 advisory.

  - In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command     lines. (CVE-2023-46316)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3163 advisory.

  - linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login     process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. (CVE-2024-22365)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3030 advisory.

  - Multiple signed integers overflow in function au_read_header in src/au.c and in functions mat4_open and     mat4_read_header in src/mat4.c in Libsndfile, allows an attacker to cause Denial of Service or other     unspecified impacts. (CVE-2022-33065)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3275 advisory.

  - eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS     name resolution by quickly sending an invalid packet from the expected IP address and source port, aka a     TuDoor attack. In other words, dnspython does not have the preferred behavior in which the DNS name     resolution algorithm would proceed, within the full time window, in order to wait for a valid packet.
    NOTE: dnspython 2.6.0 is unusable for a different reason that was addressed in 2.6.1. (CVE-2023-29483)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:2952 advisory.

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP     request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method     changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs.
    Although this behavior is not specified in the section for redirects, it can be inferred by piecing     together information from different sections and we have observed the behavior in other major HTTP client     implementations like curl and web browsers. Because the vulnerability requires a previously trusted     service to become compromised in order to have an impact on confidentiality we believe the exploitability     of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request     bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions     must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information     in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts     redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised.
    This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve     this issue. Users unable to update should disable redirects for services that aren't expecting to respond     with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle     301, 302, and 303 redirects manually by stripping the HTTP request body. (CVE-2023-45803)

  - PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable     for a Manger attack. (CVE-2023-52323)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3269 advisory.

  - The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to     it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to     crash an application or overwrite a neighbouring variable. (CVE-2024-2961)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3178 advisory.

  - Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi software may allow a privileged user     to potentially enable escalation of privilege via local access. (CVE-2022-46329)

  - Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a     malicious hypervisor to affect cache line write-back behavior of the CPU leading to a potential loss of     guest virtual machine (VM) memory integrity. (CVE-2023-20592)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3089 advisory.

  - GStreamer FLAC File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with     this library is required to exploit this vulnerability but attack vectors may vary depending on the     implementation. The specific flaw exists within the parsing of FLAC audio files. The issue results from     the lack of proper validation of user-supplied data, which can result in an integer overflow before     allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the     current process. Was ZDI-CAN-20775. (CVE-2023-37327)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3088 advisory.

  - GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This     vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer.
    Interaction with this library is required to exploit this vulnerability but attack vectors may vary     depending on the implementation. The specific flaw exists within the parsing of PGS subtitle files. The     issue results from the lack of proper validation of the length of user-supplied data prior to copying it     to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the     current process. Was ZDI-CAN-20994. (CVE-2023-37328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:2973 advisory.

  - A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function.
    This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on     the system. (CVE-2023-43785)

  - A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw     allows a local user to consume all available system resources and cause a denial of service condition.
    (CVE-2023-43786)

  - A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This     flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated     privileges. (CVE-2023-43787)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:2979 advisory.

  - An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial     of service (DoS) via crafted .pdf file to FoFiType1C::convertToType1 function. (CVE-2020-36024)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3056 advisory.

  - An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through     6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack     integer overflow check. (CVE-2023-51714)

  - An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through     6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a     crafted KTX image file. (CVE-2024-25580)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:3094 advisory.

  - CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.
    (CVE-2023-31484)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:2986 advisory.

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:3270 advisory.

  - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated     users. This may lead to improper authorization issues, granting or denying access to resources     inappropriately. (CVE-2023-3758)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the glib2-2.68.4-15.el9 build changelog.

  - An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-     based client subscribes to signals from a trusted system service such as NetworkManager on a shared     computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will     wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based     client behaving incorrectly, with an application-dependent impact. (CVE-2024-34397)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:2881 advisory.

  - A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution     in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird <     115.11. (CVE-2024-4367)

  - If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly     deleted when the window was closed. This preference is disabled by default in Firefox. This vulnerability     affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11. (CVE-2024-4767)

  - A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user     into granting permissions. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird     < 115.11. (CVE-2024-4768)

  - When importing resources using Web Workers, error messages would distinguish the difference between     `application/javascript` responses and non-script responses. This could have been abused to learn     information cross-origin. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird     < 115.11. (CVE-2024-4769)

  - When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. This     vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11. (CVE-2024-4770)

  - Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and     Thunderbird < 115.11. (CVE-2024-4777)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:1939 advisory.

  - The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable     to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and     Thunderbird < 115.10. (CVE-2024-2609)

  - There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could     abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125,     Firefox ESR < 115.10, and Thunderbird < 115.10. (CVE-2024-3302)

  - GetBoundName could return the wrong version of an object when JIT optimizations were applied. This     vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. (CVE-2024-3852)

  - In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-     bounds-reads. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
    (CVE-2024-3854)

  - The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free     crashes during garbage collection. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and     Thunderbird < 115.10. (CVE-2024-3857)

  - On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could     be triggered by a malformed OpenType font. This vulnerability affects Firefox < 125, Firefox ESR < 115.10,     and Thunderbird < 115.10. (CVE-2024-3859)

  - If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect     reference count and later use-after-free. This vulnerability affects Firefox < 125, Firefox ESR < 115.10,     and Thunderbird < 115.10. (CVE-2024-3861)

  - Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed     evidence of memory corruption and we presume that with enough effort this could have been exploited to run     arbitrary code. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
    (CVE-2024-3864)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2625 advisory.

  - An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive     number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and     CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is     allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an     HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to     be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the     receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header     frames we will process before closing a connection. (CVE-2023-45288)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:1912 advisory.

  - The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable     to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and     Thunderbird < 115.10. (CVE-2024-2609)

  - There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could     abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125,     Firefox ESR < 115.10, and Thunderbird < 115.10. (CVE-2024-3302)

  - GetBoundName could return the wrong version of an object when JIT optimizations were applied. This     vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. (CVE-2024-3852)

  - In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-     bounds-reads. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
    (CVE-2024-3854)

  - The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free     crashes during garbage collection. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and     Thunderbird < 115.10. (CVE-2024-3857)

  - On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could     be triggered by a malformed OpenType font. This vulnerability affects Firefox < 125, Firefox ESR < 115.10,     and Thunderbird < 115.10. (CVE-2024-3859)

  - If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect     reference count and later use-after-free. This vulnerability affects Firefox < 125, Firefox ESR < 115.10,     and Thunderbird < 115.10. (CVE-2024-3861)

  - Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed     evidence of memory corruption and we presume that with enough effort this could have been exploited to run     arbitrary code. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
    (CVE-2024-3864)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2024:1998 advisory.

  - The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit     scenarios when a connection is configured to use PreSharedKeys (authby=secret) and the connection cannot     find a matching configured secret. When such a connection is automatically added on startup using the     auto= keyword, it can cause repeated crashes leading to a Denial of Service. (CVE-2024-2357)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1935 advisory.

  - The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable     to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and     Thunderbird < 115.10. (CVE-2024-2609)

  - There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server could     abuse this to create an Out of Memory condition in the browser. This vulnerability affects Firefox < 125,     Firefox ESR < 115.10, and Thunderbird < 115.10. (CVE-2024-3302)

  - GetBoundName could return the wrong version of an object when JIT optimizations were applied. This     vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10. (CVE-2024-3852)

  - In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-     bounds-reads. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
    (CVE-2024-3854)

  - The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free     crashes during garbage collection. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and     Thunderbird < 115.10. (CVE-2024-3857)

  - On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could     be triggered by a malformed OpenType font. This vulnerability affects Firefox < 125, Firefox ESR < 115.10,     and Thunderbird < 115.10. (CVE-2024-3859)

  - If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect     reference count and later use-after-free. This vulnerability affects Firefox < 125, Firefox ESR < 115.10,     and Thunderbird < 115.10. (CVE-2024-3861)

  - Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed     evidence of memory corruption and we presume that with enough effort this could have been exploited to run     arbitrary code. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.
    (CVE-2024-3864)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1960 advisory.

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free. We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2002 advisory.

  - A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an     overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph,     this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this     vulnerability to circumvent the secure boot mechanism. (CVE-2022-2601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2004 advisory.

  - A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer     dereference and general protection fault. (CVE-2020-36558)

  - A vulnerability was found in the HCI sockets implementation due to a missing capability check in     net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of     management commands, compromising the confidentiality, integrity, and availability of Bluetooth     communication. (CVE-2023-2002)

  - Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30     may allow an unauthenticated user to potentially enable escalation of privilege via network access.
    (CVE-2023-25775)

  - A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local     privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's     recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an     skb locklessly that is being released by garbage collection, resulting in use-after-free. We recommend     upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c. (CVE-2023-4622)

  - A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control)     component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve     (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call     vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling     pointer that can cause a use-after-free. We recommend upgrading past commit     b3d26c5702c7d6c45456326e56d2ccf3f103e60f. (CVE-2023-4623)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1959 advisory.

  - A flaw was found in Shim when an error happened while creating a new ESL variable. If Shim fails to create     the new variable, it tries to print an error message to the user; however, the number of parameters used     by the logging function doesn't match the format string used by it, leading to a crash under certain     circumstances. (CVE-2023-40546)

  - A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled     values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP     request, leading to a completely controlled out-of-bounds write primitive and complete system compromise.
    This flaw is only exploitable during the early boot phase, an attacker needs to perform a Man-in-the-     Middle or compromise the boot server to be able to exploit this vulnerability successfully.
    (CVE-2023-40547)

  - A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition     operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is     further used for memory allocation operations, leading to a heap-based buffer overflow. This flaw causes     memory corruption and can lead to a crash or data integrity issues during the boot phase. (CVE-2023-40548)

  - An out-of-bounds read flaw was found in Shim due to the lack of proper boundary verification during the     load of a PE binary. This flaw allows an attacker to load a crafted PE binary, triggering the issue and     crashing Shim, resulting in a denial of service. (CVE-2023-40549)

  - An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue     may expose sensitive data during the system's boot phase. (CVE-2023-40550)

  - A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or     possible exposure of sensitive data during the system's boot phase. (CVE-2023-40551)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1821 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401,     8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM     Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component,     e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2024-21011)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.22,     17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition:
    20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise     Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible     data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2024-21012)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401-perf,     11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2 and 22; Oracle GraalVM Enterprise     Edition: 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access     via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise     Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible     data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a     web service which supplies data to the APIs. This vulnerability also applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. (CVE-2024-21068)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Concurrency). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf,     11.0.22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
    Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web     service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.
    (CVE-2024-21085)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u401,     8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM     Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise     Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. (CVE-2024-21094)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssh-8.7p1-38.el9 build changelog.

  - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other     products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the     extension negotiation message), and a client and server may consequently end up with a connection for     which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because     the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and     mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of     ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and     (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API     before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80,     AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0,     Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15,     SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH     through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang     XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd     through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and     LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3,     Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server     before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the     mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh     crate before 0.40.2 for Rust. (CVE-2023-48795)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libssh-0.10.4-12.el9 build changelog.

  - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other     products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the     extension negotiation message), and a client and server may consequently end up with a connection for     which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because     the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and     mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of     ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and     (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API     before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80,     AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0,     Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15,     SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH     through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang     XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd     through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and     LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3,     Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server     before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the     mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh     crate before 0.40.2 for Rust. (CVE-2023-48795)

  - A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit     unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into     the command of the features mentioned through the hostname parameter. (CVE-2023-6004)

  - A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by     different supported crypto backends. The return values from these were not properly checked, which could     cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as     an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures,     terminating the connection. (CVE-2023-6918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the less-590-3.el9 build changelog.

  - close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (CVE-2022-48624)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the kernel-5.14.0-354.el9 build changelog.

  - A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel's IPv6     functionality when a user makes a new kind of SYN flood attack. A user located in the local network or     with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up     to 95%. (CVE-2023-1206)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.18-2.el9 build changelog.

  - The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special     character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some     applications, an attacker can bypass a protection mechanism in which application access is granted only     after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be     used for signup). This occurs in email/_parseaddr.py in recent versions of Python. (CVE-2023-27043)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the opensc-0.23.0-4.el9 build changelog.

  - Side-channel leaks while stripping encryption PKCS#1.5 padding (CVE-2023-5992)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the rpm-4.16.1.3-26.el9 build changelog.

  - A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass     the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root     privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2021-35937)

  - A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials     after installing a file. A local unprivileged user could use this flaw to exchange the original file with     a symbolic link to a security-critical file and escalate their privileges on the system. The highest     threat from this vulnerability is to data confidentiality and integrity as well as system availability.
    (CVE-2021-35938)

  - It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only     implemented for the parent directory of the file to be created. A local unprivileged user who owns another     ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this     vulnerability is to data confidentiality and integrity as well as system availability. (CVE-2021-35939)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the python- urllib3-1.26.5-5.el9 build changelog.

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP     request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method     changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs.
    Although this behavior is not specified in the section for redirects, it can be inferred by piecing     together information from different sections and we have observed the behavior in other major HTTP client     implementations like curl and web browsers. Because the vulnerability requires a previously trusted     service to become compromised in order to have an impact on confidentiality we believe the exploitability     of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request     bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions     must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information     in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts     redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised.
    This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve     this issue. Users unable to update should disable redirects for services that aren't expecting to respond     with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle     301, 302, and 303 redirects manually by stripping the HTTP request body. (CVE-2023-45803)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the avahi-0.8-20.el9 build changelog.

  - A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
    (CVE-2023-38469)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
    (CVE-2023-38470)

  - A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
    (CVE-2023-38471)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
    (CVE-2023-38472)

  - A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name()     function. (CVE-2023-38473)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the toolbox-0.0.99.4-5.el9 build changelog.

  - Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates     containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS     context and allowing for injection of unexpected HTML, if executed with untrusted input. (CVE-2023-24539)

  - Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing     whitespace characters outside of the character set \t\n\f\r\u0020\u2028\u2029 in JavaScript contexts     that also contain actions may not be properly sanitized during execution. (CVE-2023-24540)

  - Templates containing actions in unquoted HTML attributes (e.g. attr={{.}}) executed with empty input can     result in output with unexpected results when parsed due to HTML normalization rules. This may allow     injection of arbitrary attributes into tags. (CVE-2023-29400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the zlib-1.2.11-41.el9 build changelog.

  - MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in     zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported     part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected     zlib version, and exposes the applicable MiniZip code through its compress API. (CVE-2023-45853)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-430.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix connection failure     handling In case immediate MPA request processing fails, the newly created endpoint unlinks the listening     endpoint and is ready to be dropped. This special case was not handled correctly by the code handling the     later TCP socket close, causing a NULL dereference crash in siw_cm_work_handler() when dereferencing a     NULL listener. We now also cancel the useless MPA timeout, if immediate MPA request processing fails. This     patch furthermore simplifies MPA processing in general: Scheduling a useless TCP socket read in     sk_data_ready() upcall is now surpressed, if the socket is already moved out of TCP_ESTABLISHED state.
    (CVE-2023-52513)

  - A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel.
    This issue may allow a network attacker to decrypt ciphertexts or forge signatures, limiting the services     that use that private key. (CVE-2023-6240)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the linux- firmware-20231030-141.el9 build changelog.

  - Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi (RHEL-14264) (CVE-2022-46329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the opensc-0.23.0-3.el9 build changelog.

  - Potential PIN bypass (CVE-2023-40660)

  - Dynamic analyzers reports in pkcs15init (CVE-2023-40661)

  - Out-of-bounds read in MyEID driver handling encryption using symmetric keys (CVE-2023-4535)

  - Side-channel leaks while stripping encryption PKCS#1.5 padding (CVE-2023-5992)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-432.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: i2c: Fix a potential use after free     Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit     to avoid the use after free. [wsa: added comment to the code, added Fixes tag] (CVE-2019-25162)

  - In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: Fix null-pointer     dereference in pgtable_cache_add kasprintf() returns a pointer to dynamically allocated memory which can     be NULL upon failure. Ensure the allocation was successful by checking the pointer validity.
    (CVE-2023-52607)

  - In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Fix block process call     transactions According to the Intel datasheets, software must reset the block buffer index twice for block     process call transactions: once before writing the outgoing data to the buffer, and once again before     reading the incoming data from the buffer. The driver is currently missing the second reset, causing the     wrong portion of the block buffer to be read. (CVE-2024-26593)

  - In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability     to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall     slowdowns for everything. So put a lock on the path in order to serialize the accesses to prevent the     ability for this to be called at too high of a frequency and saturate the machine. (CVE-2024-26602)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libxml2-2.9.13-5.el9 build changelog.

  - Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement()     function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via     supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy     SAX1 interface with custom callbacks; there is a crash even without crafted input. (CVE-2023-39615)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the sqlite-3.34.1-7.el9 build changelog.

  - A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects     the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest     Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix     this issue. The associated identifier of this vulnerability is VDB-248999. (CVE-2023-7104)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the pam-1.5.1-19.el9 build changelog.

  - linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login     process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. (CVE-2024-22365)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-435.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: hwrng: core - Fix page fault dead lock     on mmap-ed hwrng There is a dead-lock in the hwrng device read path. This triggers when the user reads     from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive     read which then dead-locks. Fix this by using a stack buffer when calling copy_to_user. (CVE-2023-52615)

  - In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix NULL pointer     dereference in zone registration error path If device_register() in     thermal_zone_device_register_with_trips() returns an error, the tz variable is set to NULL and     subsequently dereferenced in kfree(tz->tzp). Commit adc8749b150c (thermal/drivers/core: Use put_device()     if device_register() fails) added the tz = NULL assignment in question to avoid a possible double-free     after dropping the reference to the zone device. However, after commit 4649620d9404 (thermal: core: Make     thermal_zone_device_unregister() return after freeing the zone), that assignment has become redundant,     because dropping the reference to the zone device does not cause the zone object to be freed any more.
    Drop it to address the NULL pointer dereference. (CVE-2023-52473)

  - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
    (CVE-2023-52466)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the wpa_supplicant-2.10-5.el9 build changelog.

  - The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful     attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1     authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication.
    The attack vector is sending an EAP-TLV Success packet instead of starting Phase 2. This allows an     adversary to impersonate Enterprise Wi-Fi networks. (CVE-2023-52160)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
197666	CentOS 8 : squashfs-tools (CESA-2024:3139)	high
197665	CentOS 8 : motif (CESA-2024:3022)	medium
197664	CentOS 8 : pcp (CESA-2024:3264)	high
197663	CentOS 8 : traceroute (CESA-2024:3211)	medium
197662	CentOS 8 : pam (CESA-2024:3163)	medium
197661	CentOS 8 : libsndfile (CESA-2024:3030)	high
197660	CentOS 8 : python-dns (CESA-2024:3275)	high
197659	CentOS 8 : resource-agents (CESA-2024:2952)	medium
197658	CentOS 8 : glibc (CESA-2024:3269)	high
197657	CentOS 8 : linux-firmware (CESA-2024:3178)	medium
197656	CentOS 8 : gstreamer1-plugins-good (CESA-2024:3089)	high
197655	CentOS 8 : gstreamer1-plugins-base (CESA-2024:3088)	high
197654	CentOS 8 : libX11 (CESA-2024:2973)	high
197653	CentOS 8 : poppler (CESA-2024:2979)	medium
197652	CentOS 8 : qt5-qtbase (CESA-2024:3056)	critical
197651	CentOS 8 : perl-CPAN (CESA-2024:3094)	high
197650	CentOS 8 : python3.11-urllib3 (CESA-2024:2986)	high
197649	CentOS 8 : sssd (CESA-2024:3270)	high
197516	CentOS 9 : glib2-2.68.4-15.el9	medium
197198	CentOS 7 : firefox (RHSA-2024:2881)	high
195023	CentOS 8 : thunderbird (CESA-2024:1939)	high
194881	CentOS 7 : rhc-worker-script (RHSA-2024:2625)	high
194736	CentOS 8 : firefox (CESA-2024:1912)	high
193960	CentOS 8 : libreswan (CESA-2024:1998)	medium
193959	CentOS 7 : thunderbird (RHSA-2024:1935)	high
193958	CentOS 7 : kpatch-patch (RHSA-2024:1960)	high
193957	CentOS 7 : grub2 (RHSA-2024:2002)	high
193956	CentOS 7 : kernel (RHSA-2024:2004)	critical
193955	CentOS 7 : shim (RHSA-2024:1959)	high
193954	CentOS 7 : java-11-openjdk (RHSA-2024:1821)	low
193947	CentOS 9 : openssh-8.7p1-38.el9	medium
193946	CentOS 9 : libssh-0.10.4-12.el9	medium
193945	CentOS 9 : less-590-3.el9	high
193944	CentOS 9 : kernel-5.14.0-354.el9	medium
193943	CentOS 9 : python3.9-3.9.18-2.el9	medium
193942	CentOS 9 : opensc-0.23.0-4.el9	medium
193941	CentOS 9 : rpm-4.16.1.3-26.el9	medium
193940	CentOS 9 : python-urllib3-1.26.5-5.el9	medium
193939	CentOS 9 : avahi-0.8-20.el9	medium
193938	CentOS 9 : toolbox-0.0.99.4-5.el9	critical
193937	CentOS 9 : zlib-1.2.11-41.el9	critical
193936	CentOS 9 : kernel-5.14.0-430.el9	medium
193935	CentOS 9 : linux-firmware-20231030-141.el9	medium
193934	CentOS 9 : opensc-0.23.0-3.el9	medium
193933	CentOS 9 : kernel-5.14.0-432.el9	high
193932	CentOS 9 : libxml2-2.9.13-5.el9	medium
193931	CentOS 9 : sqlite-3.34.1-7.el9	high
193930	CentOS 9 : pam-1.5.1-19.el9	medium
193929	CentOS 9 : kernel-5.14.0-435.el9	medium
193928	CentOS 9 : wpa_supplicant-2.10-5.el9	medium

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

medium

high

medium

medium

high

high

medium

high

medium

high

high

high

medium

critical

high

high

high

medium

high

high

high

high

medium

high

high

high

critical

high

low

medium

medium

high

medium

medium

medium

medium

medium

medium

critical

critical

medium

medium

medium

high

medium

high

medium

medium

medium