The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-d22162d9ba advisory.

    Backport fix for CVE-2023-34969.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4498 advisory.

    D-Bus is a system for sending messages between applications. It is used both for the system-wide message     bus service, and as a per-user-login-session messaging facility.

    Security Fix(es):

    * dbus: dbus-daemon: assertion failure when a monitor is active and a message from the driver cannot be     delivered (CVE-2023-34969)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6372-1 advisory.

    It was discovered that DBus incorrectly handled certain invalid messages. A local attacker could possibly     use this issue to cause DBus to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the dbus package has been released.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:2879-1 advisory.

    - CVE-2023-34969: Fixed a possible dbus-daemon crash by an unprivileged users (bsc#1212126).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the dbus packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with     control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus     traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-     daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus,     this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.
    (CVE-2023-34969)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2023:0092 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-34969:
    D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with     control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus     traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-     daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus,     this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:4498 advisory.

  - D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with     control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus     traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-     daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus,     this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.
    (CVE-2023-34969)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:4569 advisory.

  - D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with     control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus     traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-     daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus,     this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.
    (CVE-2023-34969)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of dbus installed on the remote host is prior to 1.10.24-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2428 advisory.

    D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with     control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus     traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-     daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus,     this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.
    (CVE-2023-34969)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-213 advisory.

    D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with     control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus     traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-     daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus,     this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.
    (CVE-2023-34969)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6317:06 advisory.

    dbus: dbus-daemon: assertion failure when a monitor is active and a message     from the driver cannot be delivered (CVE-2023-34969)     CVE(s):
    CVE-2023-34969

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-4569 advisory.

    - Fix CVE-2023-34969 (#2213402)
    - Fix CVE-2022-42010 (#2133647)
    - Fix CVE-2022-42011 (#2133641)
    - Fix CVE-2022-42012 (#2133635)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.100173 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may     allow an authenticated client to cause a denial of service. (CVE-2023-1667)

  - A vulnerability was found in libssh, where the authentication check of the connecting client can be     bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen     if there is insufficient memory or the memory usage is limited. The problem is caused by the return value     `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call     `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the     cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
    (CVE-2023-2283)

  - A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange     differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. (CVE-2023-5981)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.216 advisory.

  - The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path,     leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in     /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an     incomplete fix for CVE-2016-10009. (CVE-2023-38408)

  - A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may     allow an authenticated client to cause a denial of service. (CVE-2023-1667)

  - A vulnerability was found in libssh, where the authentication check of the connecting client can be     bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen     if there is insufficient memory or the memory usage is limited. The problem is caused by the return value     `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call     `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the     cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
    (CVE-2023-2283)

  - Every `named` instance configured to run as a recursive resolver maintains a cache database holding the     responses to the queries it has recently sent to authoritative servers. The size limit for that cache     database can be configured using the `max-cache-size` statement in the configuration file; it defaults to     90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the     configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets     from the cache, to keep memory use below the configured limit. It has been discovered that the     effectiveness of the cache-cleaning algorithm used in `named` can be severely diminished by querying the     resolver for specific RRsets in a certain order, effectively allowing the configured `max-cache-size`     limit to be significantly exceeded. This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0     through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1.
    (CVE-2023-2828)

  - Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a     denial of service via a crafted script. (CVE-2020-24736)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
177598	Fedora 38 : mingw-dbus (2023-d22162d9ba)	Nessus	Fedora Local Security Checks	2023/6/25	2024/11/14	medium
179398	RHEL 8 : dbus (RHSA-2023:4498)	Nessus	Red Hat Local Security Checks	2023/8/7	2024/11/7	medium
181452	Ubuntu 16.04 ESM : DBus vulnerability (USN-6372-1)	Nessus	Ubuntu Local Security Checks	2023/9/14	2024/8/27	medium
203919	Photon OS 3.0: Dbus PHSA-2024-3.0-0722	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	medium
204242	Photon OS 4.0: Dbus PHSA-2024-4.0-0618	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	medium
178587	SUSE SLES15: dbus-1 / dbus-1-devel / dbus-1-x11 / libdbus-1-3 / etc (SUSE-SU-2023:2879-1)	Nessus	SuSE Local Security Checks	2023/7/20	2026/6/25	medium
179522	EulerOS 2.0 SP9 : dbus (EulerOS-SA-2023-2579)	Nessus	Huawei Local Security Checks	2023/8/8	2023/8/8	medium
179542	EulerOS 2.0 SP9 : dbus (EulerOS-SA-2023-2609)	Nessus	Huawei Local Security Checks	2023/8/8	2023/8/8	medium
188145	EulerOS 2.0 SP8 : dbus (EulerOS-SA-2023-3122)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	medium
236167	Alibaba Cloud Linux 3 : 0092: dbus (ALINUX3-SA-2023:0092)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
179442	AlmaLinux 8 : dbus (ALSA-2023:4498)	Nessus	Alma Linux Local Security Checks	2023/8/8	2023/8/8	medium
179611	AlmaLinux 9 : dbus (ALSA-2023:4569)	Nessus	Alma Linux Local Security Checks	2023/8/9	2023/8/9	medium
189319	Amazon Linux 2 : dbus (ALAS-2024-2428)	Nessus	Amazon Linux Local Security Checks	2024/1/23	2024/12/11	medium
177679	Amazon Linux 2023 : dbus, dbus-common, dbus-daemon (ALAS2023-2023-213)	Nessus	Amazon Linux Local Security Checks	2023/6/28	2024/12/11	medium
293079	MiracleLinux 8 : dbus-1.12.8-24.el8.1 (AXSA:2023-6317:06)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
179857	Oracle Linux 9 : dbus (ELSA-2023-4569)	Nessus	Oracle Linux Local Security Checks	2023/8/15	2025/9/9	medium
206823	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.100173)	Nessus	Misc.	2024/9/9	2025/2/17	low
181785	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.216)	Nessus	Misc.	2023/9/22	2025/2/19	critical

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

low

critical