Red Hat Enterprise Linux 9 update for avahi
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 5 |
| CVE-ID | CVE-2023-38469 CVE-2023-38470 CVE-2023-38471 CVE-2023-38472 CVE-2023-38473 |
| CWE-ID | CWE-617 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Red Hat Enterprise Linux for ARM 64 Operating systems & Components / Operating system Red Hat Enterprise Linux for Power, little endian Operating systems & Components / Operating system Red Hat Enterprise Linux for IBM z Systems Operating systems & Components / Operating system Red Hat Enterprise Linux for x86_64 Operating systems & Components / Operating system avahi-ui-tools-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component avahi-ui-gtk3-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component avahi-ui-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component avahi-tools-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component avahi-libs-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component avahi-gobject-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component avahi-glib-devel (Red Hat package) Operating systems & Components / Operating system package or component avahi-glib-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component avahi-dnsconfd-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component avahi-devel (Red Hat package) Operating systems & Components / Operating system package or component avahi-debugsource (Red Hat package) Operating systems & Components / Operating system package or component avahi-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component avahi-compat-libdns_sd-devel (Red Hat package) Operating systems & Components / Operating system package or component avahi-compat-libdns_sd-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component avahi-compat-libdns_sd (Red Hat package) Operating systems & Components / Operating system package or component avahi-compat-howl-devel (Red Hat package) Operating systems & Components / Operating system package or component avahi-compat-howl-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component avahi-compat-howl (Red Hat package) Operating systems & Components / Operating system package or component avahi-autoipd-debuginfo (Red Hat package) Operating systems & Components / Operating system package or component avahi-tools (Red Hat package) Operating systems & Components / Operating system package or component avahi-glib (Red Hat package) Operating systems & Components / Operating system package or component |
| Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
1) Reachable Assertion
EUVDB-ID: #VU79306
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-38469
CWE-ID:
CWE-617 - Reachable Assertion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion within the avahi_dns_packet_append_record() function. A remote attacker can send specially crafted packets to the system and perform a denial of service (DoS) attack.
Install updates from vendor's website.
Red Hat Enterprise Linux for ARM 64: 9
Red Hat Enterprise Linux for Power, little endian: 9
Red Hat Enterprise Linux for IBM z Systems: 9
Red Hat Enterprise Linux for x86_64: 9
avahi-ui-tools-debuginfo (Red Hat package): before 0.8-20.el9
avahi-ui-gtk3-debuginfo (Red Hat package): before 0.8-20.el9
avahi-ui-debuginfo (Red Hat package): before 0.8-20.el9
avahi-tools-debuginfo (Red Hat package): before 0.8-20.el9
avahi-libs-debuginfo (Red Hat package): before 0.8-20.el9
avahi-gobject-debuginfo (Red Hat package): before 0.8-20.el9
avahi-glib-devel (Red Hat package): before 0.8-20.el9
avahi-glib-debuginfo (Red Hat package): before 0.8-20.el9
avahi-dnsconfd-debuginfo (Red Hat package): before 0.8-20.el9
avahi-devel (Red Hat package): before 0.8-20.el9
avahi-debugsource (Red Hat package): before 0.8-20.el9
avahi-debuginfo (Red Hat package): before 0.8-20.el9
avahi-compat-libdns_sd-devel (Red Hat package): before 0.8-20.el9
avahi-compat-libdns_sd-debuginfo (Red Hat package): before 0.8-20.el9
avahi-compat-libdns_sd (Red Hat package): before 0.8-20.el9
avahi-compat-howl-devel (Red Hat package): before 0.8-20.el9
avahi-compat-howl-debuginfo (Red Hat package): before 0.8-20.el9
avahi-compat-howl (Red Hat package): before 0.8-20.el9
avahi-autoipd-debuginfo (Red Hat package): before 0.8-20.el9
avahi-tools (Red Hat package): before 0.8-20.el9
avahi-glib (Red Hat package): before 0.8-20.el9
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64:9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian:9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems:9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux:9:*:*:*:*:*:*:*
- cpe:2.3:o:red_hat:avahi-ui-tools-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-ui-gtk3-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-ui-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-tools-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-libs-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-gobject-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-glib-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-glib-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-dnsconfd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-debugsource_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-libdns_sd-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-libdns_sd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-libdns_sd_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-howl-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-howl-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-howl_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-autoipd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-tools_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-glib_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2024:2433
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Reachable Assertion
EUVDB-ID: #VU79307
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-38470
CWE-ID:
CWE-617 - Reachable Assertion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion within the avahi_escape_label() function. A remote attacker can send specially crafted packets to the system and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat Enterprise Linux for ARM 64: 9
Red Hat Enterprise Linux for Power, little endian: 9
Red Hat Enterprise Linux for IBM z Systems: 9
Red Hat Enterprise Linux for x86_64: 9
avahi-ui-tools-debuginfo (Red Hat package): before 0.8-20.el9
avahi-ui-gtk3-debuginfo (Red Hat package): before 0.8-20.el9
avahi-ui-debuginfo (Red Hat package): before 0.8-20.el9
avahi-tools-debuginfo (Red Hat package): before 0.8-20.el9
avahi-libs-debuginfo (Red Hat package): before 0.8-20.el9
avahi-gobject-debuginfo (Red Hat package): before 0.8-20.el9
avahi-glib-devel (Red Hat package): before 0.8-20.el9
avahi-glib-debuginfo (Red Hat package): before 0.8-20.el9
avahi-dnsconfd-debuginfo (Red Hat package): before 0.8-20.el9
avahi-devel (Red Hat package): before 0.8-20.el9
avahi-debugsource (Red Hat package): before 0.8-20.el9
avahi-debuginfo (Red Hat package): before 0.8-20.el9
avahi-compat-libdns_sd-devel (Red Hat package): before 0.8-20.el9
avahi-compat-libdns_sd-debuginfo (Red Hat package): before 0.8-20.el9
avahi-compat-libdns_sd (Red Hat package): before 0.8-20.el9
avahi-compat-howl-devel (Red Hat package): before 0.8-20.el9
avahi-compat-howl-debuginfo (Red Hat package): before 0.8-20.el9
avahi-compat-howl (Red Hat package): before 0.8-20.el9
avahi-autoipd-debuginfo (Red Hat package): before 0.8-20.el9
avahi-tools (Red Hat package): before 0.8-20.el9
avahi-glib (Red Hat package): before 0.8-20.el9
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64:9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian:9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems:9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux:9:*:*:*:*:*:*:*
- cpe:2.3:o:red_hat:avahi-ui-tools-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-ui-gtk3-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-ui-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-tools-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-libs-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-gobject-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-glib-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-glib-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-dnsconfd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-debugsource_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-libdns_sd-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-libdns_sd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-libdns_sd_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-howl-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-howl-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-howl_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-autoipd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-tools_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-glib_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2024:2433
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Reachable Assertion
EUVDB-ID: #VU79308
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-38471
CWE-ID:
CWE-617 - Reachable Assertion
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion within the dbus_set_host_name() function. A local user can perform a denial of service (DoS) attack.
Install updates from vendor's website.
Red Hat Enterprise Linux for ARM 64: 9
Red Hat Enterprise Linux for Power, little endian: 9
Red Hat Enterprise Linux for IBM z Systems: 9
Red Hat Enterprise Linux for x86_64: 9
avahi-ui-tools-debuginfo (Red Hat package): before 0.8-20.el9
avahi-ui-gtk3-debuginfo (Red Hat package): before 0.8-20.el9
avahi-ui-debuginfo (Red Hat package): before 0.8-20.el9
avahi-tools-debuginfo (Red Hat package): before 0.8-20.el9
avahi-libs-debuginfo (Red Hat package): before 0.8-20.el9
avahi-gobject-debuginfo (Red Hat package): before 0.8-20.el9
avahi-glib-devel (Red Hat package): before 0.8-20.el9
avahi-glib-debuginfo (Red Hat package): before 0.8-20.el9
avahi-dnsconfd-debuginfo (Red Hat package): before 0.8-20.el9
avahi-devel (Red Hat package): before 0.8-20.el9
avahi-debugsource (Red Hat package): before 0.8-20.el9
avahi-debuginfo (Red Hat package): before 0.8-20.el9
avahi-compat-libdns_sd-devel (Red Hat package): before 0.8-20.el9
avahi-compat-libdns_sd-debuginfo (Red Hat package): before 0.8-20.el9
avahi-compat-libdns_sd (Red Hat package): before 0.8-20.el9
avahi-compat-howl-devel (Red Hat package): before 0.8-20.el9
avahi-compat-howl-debuginfo (Red Hat package): before 0.8-20.el9
avahi-compat-howl (Red Hat package): before 0.8-20.el9
avahi-autoipd-debuginfo (Red Hat package): before 0.8-20.el9
avahi-tools (Red Hat package): before 0.8-20.el9
avahi-glib (Red Hat package): before 0.8-20.el9
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64:9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian:9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems:9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux:9:*:*:*:*:*:*:*
- cpe:2.3:o:red_hat:avahi-ui-tools-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-ui-gtk3-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-ui-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-tools-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-libs-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-gobject-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-glib-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-glib-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-dnsconfd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-debugsource_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-libdns_sd-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-libdns_sd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-libdns_sd_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-howl-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-howl-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-howl_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-autoipd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-tools_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-glib_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2024:2433
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Reachable Assertion
EUVDB-ID: #VU83303
Risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-38472
CWE-ID:
CWE-617 - Reachable Assertion
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion within the avahi_rdata_parse() function. A local user can pass specially crafted data to the application and perform a denial of service (DoS) attack.
Install updates from vendor's website.
Red Hat Enterprise Linux for ARM 64: 9
Red Hat Enterprise Linux for Power, little endian: 9
Red Hat Enterprise Linux for IBM z Systems: 9
Red Hat Enterprise Linux for x86_64: 9
avahi-ui-tools-debuginfo (Red Hat package): before 0.8-20.el9
avahi-ui-gtk3-debuginfo (Red Hat package): before 0.8-20.el9
avahi-ui-debuginfo (Red Hat package): before 0.8-20.el9
avahi-tools-debuginfo (Red Hat package): before 0.8-20.el9
avahi-libs-debuginfo (Red Hat package): before 0.8-20.el9
avahi-gobject-debuginfo (Red Hat package): before 0.8-20.el9
avahi-glib-devel (Red Hat package): before 0.8-20.el9
avahi-glib-debuginfo (Red Hat package): before 0.8-20.el9
avahi-dnsconfd-debuginfo (Red Hat package): before 0.8-20.el9
avahi-devel (Red Hat package): before 0.8-20.el9
avahi-debugsource (Red Hat package): before 0.8-20.el9
avahi-debuginfo (Red Hat package): before 0.8-20.el9
avahi-compat-libdns_sd-devel (Red Hat package): before 0.8-20.el9
avahi-compat-libdns_sd-debuginfo (Red Hat package): before 0.8-20.el9
avahi-compat-libdns_sd (Red Hat package): before 0.8-20.el9
avahi-compat-howl-devel (Red Hat package): before 0.8-20.el9
avahi-compat-howl-debuginfo (Red Hat package): before 0.8-20.el9
avahi-compat-howl (Red Hat package): before 0.8-20.el9
avahi-autoipd-debuginfo (Red Hat package): before 0.8-20.el9
avahi-tools (Red Hat package): before 0.8-20.el9
avahi-glib (Red Hat package): before 0.8-20.el9
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64:9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian:9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems:9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux:9:*:*:*:*:*:*:*
- cpe:2.3:o:red_hat:avahi-ui-tools-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-ui-gtk3-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-ui-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-tools-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-libs-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-gobject-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-glib-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-glib-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-dnsconfd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-debugsource_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-libdns_sd-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-libdns_sd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-libdns_sd_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-howl-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-howl-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-howl_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-autoipd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-tools_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-glib_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2024:2433
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Reachable Assertion
EUVDB-ID: #VU83304
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-38473
CWE-ID:
CWE-617 - Reachable Assertion
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion within the avahi_alternative_host_name() function. A local user can pass specially crafted data to the application and perform a denial of service (DoS) attack.
Install updates from vendor's website.
Red Hat Enterprise Linux for ARM 64: 9
Red Hat Enterprise Linux for Power, little endian: 9
Red Hat Enterprise Linux for IBM z Systems: 9
Red Hat Enterprise Linux for x86_64: 9
avahi-ui-tools-debuginfo (Red Hat package): before 0.8-20.el9
avahi-ui-gtk3-debuginfo (Red Hat package): before 0.8-20.el9
avahi-ui-debuginfo (Red Hat package): before 0.8-20.el9
avahi-tools-debuginfo (Red Hat package): before 0.8-20.el9
avahi-libs-debuginfo (Red Hat package): before 0.8-20.el9
avahi-gobject-debuginfo (Red Hat package): before 0.8-20.el9
avahi-glib-devel (Red Hat package): before 0.8-20.el9
avahi-glib-debuginfo (Red Hat package): before 0.8-20.el9
avahi-dnsconfd-debuginfo (Red Hat package): before 0.8-20.el9
avahi-devel (Red Hat package): before 0.8-20.el9
avahi-debugsource (Red Hat package): before 0.8-20.el9
avahi-debuginfo (Red Hat package): before 0.8-20.el9
avahi-compat-libdns_sd-devel (Red Hat package): before 0.8-20.el9
avahi-compat-libdns_sd-debuginfo (Red Hat package): before 0.8-20.el9
avahi-compat-libdns_sd (Red Hat package): before 0.8-20.el9
avahi-compat-howl-devel (Red Hat package): before 0.8-20.el9
avahi-compat-howl-debuginfo (Red Hat package): before 0.8-20.el9
avahi-compat-howl (Red Hat package): before 0.8-20.el9
avahi-autoipd-debuginfo (Red Hat package): before 0.8-20.el9
avahi-tools (Red Hat package): before 0.8-20.el9
avahi-glib (Red Hat package): before 0.8-20.el9
CPE2.3- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_arm_64:9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian:9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems:9:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:red_hat_enterprise_linux:9:*:*:*:*:*:*:*
- cpe:2.3:o:red_hat:avahi-ui-tools-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-ui-gtk3-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-ui-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-tools-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-libs-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-gobject-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-glib-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-glib-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-dnsconfd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-debugsource_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-libdns_sd-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-libdns_sd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-libdns_sd_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-howl-devel_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-howl-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-compat-howl_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-autoipd-debuginfo_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-tools_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:o:red_hat:avahi-glib_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2024:2433
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
