The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2009-433:12 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system.  The     kernel handles the basic functions of the operating system:  memory allocation, process allocation, device     input and output, etc.
    Security bug fixed with this release:
    CVE-2009-2695     The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and     other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer     dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low     boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes     allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the     CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr     protection mechanism and certain application programs.
    CVE-2009-2908     The d_delete function in fs/ecryptfs/inode.c in eCryptfs in the Linux kernel 2.6.31 allows local users to     cause a denial of service (kernel OOPS) and possibly execute arbitrary code via unspecified vectors that     cause a negative dentry and trigger a NULL pointer dereference, as demonstrated via a Mutt temporary     directory in an eCryptfs mount.
    CVE-2009-3228     The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before     2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__pad1 and (2) tcm__pad2 structure     members, which might allow local users to obtain sensitive information from kernel memory via unspecified     vectors.
    CVE-2009-3286     NFSv4 in the Linux kernel 2.6.18, and possibly other versions, does not properly clean up an inode when an     O_EXCL create fails, which causes files to be created with insecure settings such as setuid bits, and     possibly allows local users to gain privileges, related to the execution of the do_open_permission     function even when a create fails.
    CVE-2009-3547     Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a     denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an     anonymous pipe via a /proc/*/fd/ pathname.
    CVE-2009-3613     The swiotlb functionality in the r8169 driver in drivers/net/r8169.c in the Linux kernel before 2.6.27.22     allows remote attackers to cause a denial of service (IOMMU space exhaustion and system crash) by using     jumbo frames for a large amount of network traffic, as demonstrated by a flood ping.
    Other fixed bugs:
    - removed a warning message that would appear at boot time when  HPET is enabled in the  BIOS

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several components and third-party libraries :

  - libpng
  - VMnc Codec
  - vmrun
  - VMware Remote Console (VMrc)
  - VMware Tools
  - vmware-authd

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
284097	MiracleLinux 3 : kernel-2.6.18-128.13AXS3 (AXSA:2009-433:12)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/2/12	high
89740	VMware ESX / ESXi Third-Party Libraries and Components (VMSA-2010-0009) (remote check)	Nessus	VMware ESX Local Security Checks	2016/3/8	2021/1/6	critical

检测

插件搜索

high

critical