The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3516 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3516-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Sean Whitton     August 05, 2023                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : burp     Version        : 2.1.32-2+deb10u1     CVE ID         : CVE-2017-16516 CVE-2022-24795 CVE-2023-33460     Debian Bug     : 1040036

    Multiple vulnerabilities have been found in the version of yajl bundled     with burp, a simple cross-platform network BackUp and Restore Program.
    yajl is a JSON parser and small validating JSON generator.

    CVE-2017-16516

      When a crafted JSON file is supplied to yajl, the process might       crash with a SIGABRT in the yajl_string_decode function in       yajl_encode.c.  This potentially results in a denial of service.

    CVE-2022-24795

      The 1.x branch and the 2.x branch of `yajl` contain an integer       overflow which leads to subsequent heap memory corruption when dealing       with large (~2GB) inputs.

    CVE-2023-33460

      There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse       function, which potentially cause the server to run out of memory and       crash.

    For Debian 10 buster, this problem has been fixed in version     2.1.32-2+deb10u1.

    We recommend that you upgrade your burp packages.

    For the detailed security status of burp please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/burp

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6551 advisory.

    Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a     small validating JSON generator.

    Security Fix(es):

    * yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:7057 advisory.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:7057 advisory.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the yajl package has been released.

The version of AHV installed on the remote host is prior to 10.0. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.0 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a     denial of service via a crafted script. (CVE-2020-24736)

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and     1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files     outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.
    When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the     command-line interface), that means that an application which otherwise doesn't have access to the real     user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the     scenes, this directory is actually a bind mount and the data is stored in the per-application directory as     `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory     to still work as intended without general home directory access. However, the application does have write     access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source     directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the     application is started, the bind mount will follow the symlink and mount whatever it points to into the     sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the     patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by     two instances of a malicious app running in parallel. Closing the race condition requires updating or     patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the     patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with     `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar     option, then the version of bubblewrap that needs to be patched is a system copy that is distributed     separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux     distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with     `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is     included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`.
    This configuration is the default when building from source code. For the 1.14.x stable branch, these     changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has     been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10.
    The bundled version of bubblewrap in this release is a Meson wrap subproject, which has been updated to     0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS     distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or     update to newer versions if their stability policy allows it. As a workaround, avoid using applications     using the `persistent` (`--persist`) permission. (CVE-2024-42472)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3478 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3478-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Tobias Frost     July 02, 2023                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : yajl     Version        : 2.1.0-2+deb10u1     CVE ID         : CVE-2023-33460     Debian Bug     : 1039984

    A memory leak has been found in yajl, a JSON parser / small validating     JSON generator written in ANSI C, which might allow an attacker to cause     an out of memory situation and potentially causing a crash.

    For Debian 10 buster, this problem has been fixed in version     2.1.0-2+deb10u1.

    We recommend that you upgrade your yajl packages.

    For the detailed security status of yajl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/yajl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of yajl installed on the remote host is prior to 2.0.4-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2182 advisory.

    There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6233-2 advisory.

    USN-6233-1 fixed vulnerabilities in YAJL. This update provides the corresponding updates for Ubuntu 20.04     LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0074 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-33460:
    There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.101026 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (CVE-2022-48624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
179386	Debian dla-3516 : burp - security update	Nessus	Debian Local Security Checks	2023/8/5	2025/1/22	high
226946	Linux Distros Unpatched Vulnerability : CVE-2023-33460	Nessus	Misc.	2025/3/5	2026/6/29	medium
185123	RHEL 9 : yajl (RHSA-2023:6551)	Nessus	Red Hat Local Security Checks	2023/11/7	2024/11/7	medium
185630	CentOS 8 : yajl (CESA-2023:7057)	Nessus	CentOS Local Security Checks	2023/11/14	2023/11/14	medium
186405	Rocky Linux 8 : yajl (RLSA-2023:7057)	Nessus	Rocky Linux Local Security Checks	2023/11/28	2023/11/28	medium
203651	Photon OS 5.0: Yajl PHSA-2023-5.0-0096	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	medium
310786	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.0)	Nessus	Misc.	2026/4/29	2026/8/13	medium
177886	Debian dla-3478 : libyajl-dev - security update	Nessus	Debian Local Security Checks	2023/7/2	2025/1/22	medium
179789	Amazon Linux 2 : yajl (ALAS-2023-2182)	Nessus	Amazon Linux Local Security Checks	2023/8/14	2024/12/11	medium
186986	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : YAJL vulnerabilities (USN-6233-2)	Nessus	Ubuntu Local Security Checks	2023/12/15	2024/10/29	high
276269	TencentOS Server 4: yajl (TSSA-2025:0074)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	medium
206824	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.101026)	Nessus	Misc.	2024/9/9	2025/10/6	medium
333656	Photon OS 5.0: Yajl PHSA-2023-5.0-91-0096	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/8/10	medium

検出

プラグインの検索

high

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium