Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - GNU cpio 容易受到其封存成員清單功能中輸出編碼不當或逸出的問題。當透過 cpio -it 列出封存成員時，成員名稱會直接列印到輸出中，而不使用引號或逸出。攻擊者可以製作包含內嵌新行字元或 ANSI 逸出序列的成員名稱的 cpio 封存，從而在顯示清單時造成偽造的清單項目或終端控制序列插入。此問題已在提交 2ff9600c9ef32e88759843cdbde74c8db5ae9b30 （CVE-2026-66486） 中修正

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - GNU cpio 容易受到其存档成员列表功能中错误编码或输出转义的影响。通过 cpio -it 列出存档成员时，成员名称直接打印到输出，而不加引用或转义。攻击者可构建包含成员名称并嵌入了换行符或 ANSI 转义序列的 cpio 存档，从而在显示该列表时造成伪造的列表条目或终端控制序列注入。此问题已在提交 2ff9600c9ef32e88759843cdbde74c8db5ae9b30 （CVE-2026-66486） 中修复

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - GNU cpio は、そのアーカイブメンバーリスト機能での出力の不適切なエンコーディングまたはエスケープに対して脆弱です。cpio -it でアーカイブメンバーをリストする場合、メンバー名は引用符やエスケープなしで直接出力されます。攻撃者が、改行文字または ANSI エスケープシーケンスが組み込まれたメンバー名を含む cpio アーカイブを細工し、リストが表示されるときに偽造されたリストエントリまたはターミナルコントロールシーケンスの注入を引き起こす可能性があります。この問題はコミット2ff9600c9ef32e88759843cdbde74c8db5ae9b30で修正されました(CVE-2026-66486)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing     functionality. When listing archive members via cpio -it, member names are printed directly to output     without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded     newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence     injection when the listing is displayed. This issue has been fixed in commit     2ff9600c9ef32e88759843cdbde74c8db5ae9b30 (CVE-2026-66486)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0856 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-66486:
    GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing     functionality. When listing archive members via cpio -it, member names are printed directly to output     without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded     newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence     injection when the listing is displayed.

    CVE-2026-66485:
    GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c.
    The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an     archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long     nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio     process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial     of service.

    CVE-2026-66484:
    GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When     extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name     is normalized but the tar hard-link target is passed to the link_to_name function without equivalent     sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link     entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create     a hard link to an existing file outside the intended extraction directory.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
334440	Linux Distros 未修補弱點：CVE-2026-66486	Nessus	Misc.	2026/8/10	2026/9/1	medium
334440	Linux Distros 未修补的漏洞：CVE-2026-66486	Nessus	Misc.	2026/8/10	2026/9/1	medium
334440	Linux Distros のパッチ未適用の脆弱性: CVE-2026-66486	Nessus	Misc.	2026/8/10	2026/9/1	medium
334440	Linux Distros Unpatched Vulnerability : CVE-2026-66486	Nessus	Misc.	2026/8/10	2026/9/1	medium
339171	TencentOS Server 4: cpio (TSSA-2026:0856)	Nessus	Tencent Local Security Checks	2026/8/25	2026/8/25	medium

检测

插件搜索

medium

medium

medium

medium

medium