According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in Apache HTTP Server 2.4.0     to 2.4.38. When the path component of a request URL     contains multiple consecutive slashes ('/'), directives     such as LocationMatch and RewriteRule must account for     duplicates in regular expressions while other aspects     of the servers processing will implicitly collapse     them.(CVE-2019-0220)

  - A specially crafted request could have crashed the     Apache HTTP Server prior to version 2.4.30, due to an     out of bound access after a size limit is reached by     reading the HTTP header. This vulnerability is     considered very hard if not impossible to trigger in     non-debug mode (both log and build level), so it is     classified as low risk for common server     usage.(CVE-2018-1301)

  - In Apache httpd 2.4.0 to 2.4.29, when mod_session is     configured to forward its session data to CGI     applications (SessionEnv on, not the default), a remote     user may influence their content by using a 'Session'     header. This comes from the 'HTTP_SESSION' variable     name used by mod_session to forward its data to CGIs,     since the prefix 'HTTP_' is also used by the Apache     HTTP Server to pass HTTP header fields, per CGI     specifications.(CVE-2018-1283)

  - mod_lua.c in the mod_lua module in the Apache HTTP     Server 2.3.x and 2.4.x through 2.4.10 does not support     an httpd configuration in which the same Lua     authorization provider is used with different arguments     within different contexts, which allows remote     attackers to bypass intended access restrictions in     opportunistic circumstances by leveraging multiple     Require directives, as demonstrated by a configuration     that specifies authorization for one group to access a     certain directory, and authorization for a second group     to access a second directory.(CVE-2014-8109)

  - In Apache HTTP server 2.4.0 to 2.4.39, Redirects     configured with mod_rewrite that were intended to be     self-referential might be fooled by encoded newlines     and redirect instead to an unexpected URL within the     request URL.(CVE-2019-10098)

  - In Apache HTTP Server 2.4.0-2.4.39, a limited     cross-site scripting issue was reported affecting the     mod_proxy error page. An attacker could cause the link     on the error page to be malformed and instead point to     a page of their choice. This would only be exploitable     where a server was set up with proxying enabled but was     misconfigured in such a way that the Proxy Error page     was displayed.(CVE-2019-10092)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Apache2 was updated to fix bugs and security issues.

Security issues fixed: CVE-2013-5704: Added a change to fix a flaw in the way mod_headers handled chunked requests. Adds 'MergeTrailers' directive to restore legacy behavior [bnc#871310],

CVE-2014-8109: Fixes handling of the Require line when a LuaAuthzProvider is used in multiple Require directives with different arguments.

Bugfixes :

  - changed apache2.service file to fix situation where     apache won't start at boot when using an encrypted     certificate because user isn't prompted for password     during boot [bnc#792309].

  - added <IfModule> around SSLSessionCache to avoid failing     to start [bnc#842377], [bnc#849445] and [bnc#864166].

Updated apache packages fix security vulnerabilities :

Apache HTTPD before 2.4.9 was vulnerable to a denial of service in mod_dav when handling DAV_WRITE requests (CVE-2013-6438).

Apache HTTPD before 2.4.9 was vulnerable to a denial of service when logging cookies (CVE-2014-0098).

A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the apache user (CVE-2014-0226).

A denial of service flaw was found in the mod_proxy httpd module. A remote attacker could send a specially crafted request to a server configured as a reverse proxy using a threaded Multi-Processing Modules (MPM) that would cause the httpd child process to crash (CVE-2014-0117).

A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the DEFLATE input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system (CVE-2014-0118).

A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely (CVE-2014-0231).

A NULL pointer dereference flaw was found in the way the mod_cache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled (CVE-2014-3581).

mod_lua.c in the mod_lua module in the Apache HTTP Server through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory (CVE-2014-8109).

In the mod_lua module in the Apache HTTP Server through 2.4.10, a maliciously crafted websockets PING after a script calls r:wsupgrade() can cause a child process crash (CVE-2015-0228).

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers (CVE-2013-5704).

Note: With this update, httpd has been modified to not merge HTTP Trailer headers with other HTTP request headers. A newly introduced configuration directive MergeTrailers can be used to re-enable the old method of processing Trailer headers, which also re-introduces the aforementioned flaw.

This update also fixes the following bug :

Prior to this update, the mod_proxy_wstunnel module failed to set up an SSL connection when configured to use a back end server using the wss: URL scheme, causing proxied connections to fail. In these updated packages, SSL is used when proxying to wss: back end servers (rhbz#1141950).

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple ID OD Plug-in
  - AppleGraphicsControl
  - Bluetooth
  - bootp
  - CloudKit
  - CoreMedia Playback
  - CoreText
  - curl
  - Data Detectors Engine
  - Date & Time pref pane
  - Dictionary Application
  - DiskImages
  - dyld
  - FontParser
  - groff
  - ImageIO
  - Install Framework Legacy
  - IOFireWireFamily
  - IOGraphics
  - IOHIDFamily
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - mail_cmds
  - Notification Center OSX
  - ntfs
  - OpenSSH
  - OpenSSL
  - perl
  - PostgreSQL
  - python
  - QL Office
  - Quartz Composer Framework
  - Quick Look
  - QuickTime 7
  - SceneKit
  - Security
  - SMBClient
  - Speech UI
  - sudo
  - tcpdump
  - Text Formats
  - udf 

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote Mac OS X host has a version of OS X Server installed that is prior to 5.0.3. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the mod_headers module that allows HTTP     trailers to replace HTTP headers late during request     processing. A remote attacker can exploit this to inject     arbitrary headers. This can also cause some modules to     function incorrectly or appear to function incorrectly.
    (CVE-2013-5704)

  - A privilege escalation vulnerability exists due to the     'make check' command not properly invoking initdb to     specify authentication requirements for a database     cluster to be used for tests. A local attacker can     exploit this issue to gain temporary server access and     elevated privileges. (CVE-2014-0067)

  - A NULL pointer dereference flaw exists in module     mod_cache. A remote attacker, using an empty HTTP     Content-Type header, can exploit this vulnerability to     crash a caching forward proxy configuration, resulting     in a denial of service if using a threaded MPM.
    (CVE-2014-3581)

  - A out-of-bounds memory read flaw exists in module     mod_proxy_fcgi. An attacker, using a remote FastCGI     server to send long response headers, can exploit this     vulnerability to cause a denial of service by causing     a buffer over-read. (CVE-2014-3583)

  - A flaw exists in module mod_lua when handling a     LuaAuthzProvider used in multiple Require directives     with different arguments. An attacker can exploit this     vulnerability to bypass intended access restrictions.
    (CVE-2014-8109)

  - An information disclosure vulnerability exists due to     improper handling of restricted column values in     constraint-violation error messages. An authenticated,     remote attacker can exploit this to gain access to     sensitive information. (CVE-2014-8161)

  - A flaw exists within the Domain Name Service due to an     error in the code used to follow delegations. A remote     attacker, with a maliciously-constructed zone or query,     can cause the service to issue unlimited queries,     resulting in resource exhaustion. (CVE-2014-8500)

  - A flaw exists in the lua_websocket_read() function in     the 'mod_lua' module due to incorrect handling of     WebSocket PING frames. A remote attacker can exploit     this, by sending a crafted WebSocket PING frame after a     Lua script has called the wsupgrade() function, to crash     a child process, resulting in a denial of service     condition. (CVE-2015-0228)

  - Multiple vulnerabilities exist due to several buffer     overflow errors related to the 'to_char' functions. An     authenticated, remote attacker can exploit these issues     to cause a denial of service or arbitrary code     execution. (CVE-2015-0241)

  - Multiple vulnerabilities exist due to several     stack-based buffer overflow errors in various *printf()     functions. The overflows are due to improper validation     of user-supplied input when formatting a floating point     number where the requested precision is greater than     approximately 500. An authenticated, remote attacker     can exploit these issues to cause a denial of service or     arbitrary code execution. (CVE-2015-0242)

  - Multiple vulnerabilities exist due to an overflow     condition in multiple functions in the 'pgcrypto'     extension. The overflows are due to improper validation     of user-supplied input when tracking memory sizes. An     authenticated, remote attacker can exploit these issues     to cause a denial of service or arbitrary code     execution. (CVE-2015-0243)

  - A SQL injection vulnerability exists due to improper     sanitization of user-supplied input when handling     crafted binary data within a command parameter. An     authenticated, remote attacker can exploit this issue     to inject or manipulate SQL queries, allowing the     manipulation or disclosure of arbitrary data.
    (CVE-2015-0244)

  - A NULL pointer dereference flaw exists in the     read_request_line() function due to a failure to     initialize the protocol structure member. A remote     attacker can exploit this flaw, on installations that     enable the INCLUDES filter and has an ErrorDocument 400     directive specifying a local URI, by sending a request     that lacks a method, to cause a denial of service     condition. (CVE-2015-0253)

  - A denial of service vulnerability exists due to an error     relating to DNSSEC validation and the managed-keys     feature. A remote attacker can trigger an incorrect     trust-anchor management scenario in which no key is     ready for use, resulting in an assertion failure and     daemon crash. (CVE-2015-1349)

  - A flaw exists in PostgreSQL client disconnect timeout     expiration that is triggered when a timeout interrupt     is fired partway through the session shutdown sequence.     (CVE-2015-3165)

  - A flaw exists in the printf() functions due to a failure     to check for errors. A remote attacker can use this to     gain access to sensitive information. (CVE-2015-3166)

  - The pgcrypto component in PostgreSQL has multiple error     messages for decryption with an incorrect key. A remote     attacker can use this to recover keys from other     systems. (CVE-2015-3167)

  - A flaw exists in the chunked transfer coding     implementation due to a failure to properly parse chunk     headers. A remote attacker can exploit this to conduct     HTTP request smuggling attacks. (CVE-2015-3183)

  - A flaw exists in the ap_some_auth_required() function     due to a failure to consider that a Require directive     may be associated with an authorization setting rather     than an authentication setting. A remote attacker can     exploit this, if a module that relies on the 2.2 API     behavior exists, to bypass intended access restrictions.
    (CVE-2015-3185)

  - Multiple unspecified XML flaws exist in the Wiki Server     based on Twisted. (CVE-2015-5911)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 Apache HTTP Server 2.3.x 和 2.4.x 至 2.4.10 中，mod_lua 模組的 mod_lua.c 不支援在不同內容中以不同引數使用相同 Lua 授權提供者的 httpd 組態，進而允許遠端攻擊者繞過預定透過利用多個 Require 指示詞，在機會性情況下設定存取限制，指定授權給一個群組存取特定目錄，以及授權第二個群組存取第二個目錄的組態即為一例。 (CVE-2014-8109)

請注意，Nessus 依賴供應商報告的套件存在。

Apache2 已更新，修正了多個錯誤和安全性問題。

修正的安全性問題：CVE-2013-5704：新增變更，修正 mod_headers 處理區塊要求之方式中的一個瑕疵。新增「MergeTrailers」指示詞以還原舊版行為 [bnc#871310]。

CVE-2014-8109：修正 LuaAuthzProvider 用於多個含有不同引數的 Require 指示詞時，Require 行的處理方式。

錯誤修正：

- 變更 apache2.service 檔案，修正 apache 在使用加密憑證時，因系統在開機期間未提示使用者提供密碼，而無法在開機時啟動的情況 [bnc#792309]。

- 新增有關 SSLSessionCache 的 <IfModule> 指示詞，避免啟動失敗 [bnc#842377]、[bnc#849445] 和 [bnc#864166]。

更新版 apache 套件可修正多個安全性弱點：

2.4.9 版之前的 Apache HTTPD 處理 DAV_WRITE 要求時，容易受到 mod_dav 中的一個拒絕服務弱點影響 (CVE-2013-6438)。

2.4.9 版之前的 Apache HTTPD 記錄 cookie 時，容易受到一個拒絕服務弱點影響 (CVE-2014-0098)。

在 mod_status httpd 模組中發現導致堆積型緩衝區溢位的爭用情形瑕疵。能夠在伺服器上使用階層式多處理模組 (MPM) 存取 mod_status 提供服務之狀態頁面的遠端攻擊者，可能傳送特製要求，導致 httpd 子處理程序損毀，或可能讓攻擊者以‘apache’使用者的權限執行任意程式碼 (CVE-2014-0226)。

在 mod_proxy httpd 模組中發現一個拒絕服務瑕疵。遠端攻擊者可傳送特製要求給伺服器，而其設定為使用階層式多處理模組 (MPM) 的反向代理伺服器，這可能造成 httpd 子處理程序損毀 (CVE-2014-0117)。

在 httpd 的 mod_deflate 模組處理要求內文解壓縮 (透過 DEFLATE 輸入篩選設定) 的方式中發現拒絕服務瑕疵。能夠傳送其內文會遭到解壓縮之要求的遠端攻擊者可能會利用此瑕疵在目標系統上消耗過量系統記憶體與 CPU (CVE-2014-0118)。

在 httpd 的 mod_cgid 模組執行並非從標準輸入讀取資料之 CGI 指令碼的方式中發現拒絕服務瑕疵。遠端攻擊者可能會提交特製的要求，導致 httpd 子處理程序無限期懸置 (CVE-2014-0231)。

在 mod_cache httpd 模組處理 Content-Type 標頭的方式中，發現一個 NULL 指標解除參照瑕疵。Apache HTTP Server 設為以啟用快取功能的伺服器作為代理伺服器時，惡意的 HTTP Server 可能會造成 httpd 子處理程序損毀 (CVE-2014-3581)。

在 2.4.10 版及其之前版本的 Apache HTTP Server 中，mod_lua 模組的 mod_lua.c 不支援 httpd 組態，而其中相同的 Lua 授權提供者在其他內容中，會使用不同的引數，其允許遠端攻擊者利用多個 Require 指示詞，而有機會繞過預定的存取限制；將組態設為指定授權給一個群組存取特定目錄，而第二個群組有授權存取另一個目錄，此情況即為一例 (CVE-2014-8109)。

在 2.4.10 版及其之前版本的 Apache HTTP Server 的 mod_lua 模組中，指令碼呼叫 r:wsupgrade() 之後出現的惡意特製 websocket PING 可造成子處理程序損毀 (CVE-2015-0228)。

使用區塊編碼處理要求時，在 httpd 處置 HTTP Trailer 標頭的方式中發現一個瑕疵。惡意用戶端可利用 Trailer 標頭，在其他模組執行過標頭處理後設定額外的 HTTP 標頭。舉例而言，這可導致繞過以 mod_headers 定義的標頭限制 (CVE-2013-5704)。

注意：透過此更新，httpd 會修改為不將 HTTP Trailer 標頭和其他 HTTP 要求標頭合併。最新引入的組態指示詞 MergeTrailers 可用於重新啟用 Trailer 標頭的舊處理方式，但其也會重新引入前述瑕疵。

此更新也可修正下列錯誤：

在此更新之前，mod_proxy_wstunnel 模組設定為使用配置為 wss: URL 的後端伺服器時，會無法設定 SSL 連線，這會造成代理連線失敗。在這些更新版套件中，代理設定至 wss: 後端伺服器時會使用 SSL (rhbz#1141950)。

遠端主機執行的 Mac OS X 10.10.x 版本比 10.10.5 版舊。因此受到下列元件中的多個弱點影響：

- apache
 - apache_mod_php
 - Apple ID OD Plug-in
 - AppleGraphicsControl
 - Bluetooth
 - bootp
 - CloudKit
 - CoreMedia Playback
 - CoreText
 - curl
 - Data Detectors Engine
 - Date & Time pref pane
 - Dictionary Application
 - DiskImages
 - dyld
 - FontParser
 - groff
 - ImageIO
 - Install Framework Legacy
 - IOFireWireFamily
 - IOGraphics
 - IOHIDFamily
 - Kernel
 - Libc
 - Libinfo
 - libpthread
 - libxml2
 - libxpc
 - mail_cmds
 - Notification Center OSX
 - ntfs
 - OpenSSH
 - OpenSSL
 - perl
 - PostgreSQL
 - python
 - QL Office
 - Quartz Composer Framework
 - Quick Look
 - QuickTime 7
 - SceneKit
 - Security
 - SMBClient
 - Speech UI
 - sudo
 - tcpdump
 - Text Formats
 - udf

請注意，如果成功惡意利用多數嚴重問題，將會導致任意程式碼執行。

遠端 Mac OS X 主機上安裝的 OS X Server 為 5.0.3 之前的版本。因此受到以下弱點影響：

- mod_headers 模組中存在一個瑕疵，其允許在要求處理後期以 HTTP 結尾取代 HTTP 標頭。遠端攻擊者可惡意利用此弱點插入任意標頭。這還可能導致部分模組無法正常運作，或是似乎不正常運作。
 (CVE-2013-5704)

- 存在一個權限提升弱點，是因 'make check’ 命令未正確叫用 initdb 來為資料庫叢集指定供測試之用的驗證需求所導致。本機攻擊者可惡意利用此問題，藉此取得暫時伺服器存取權和提升的權限。(CVE-2014-0067)

- 模組 mod_cache 中存有一個 NULL 指標解除參照瑕疵。遠端攻擊者可使用空白的 HTTP 內容類型標頭來惡意利用此弱點，藉此損毀快取正向 Pproxy 組態，若使用階層式 MPM 則會導致拒絕服務。
 (CVE-2014-3581)

- 模組 mod_proxy_fcgi 中存有一個超出邊界記憶體讀取瑕疵。攻擊者可使用遠端 FastCGI 伺服器傳送長回應時間標頭來惡意利用此弱點，導致緩衝區過度讀取因而造成拒絕服務。(CVE-2014-3583)

- 處理具有不同引數的多個 Require 指示詞中使用的 LuaAuthzProvider 時，模組 mod_lua 中存有瑕疵。攻擊者可惡意利用此弱點，藉此繞過預定的存取限制。
 (CVE-2014-8109)

- 存在一個資訊洩漏弱點，是因不當處理限制違規錯誤訊息中的受限欄值所導致。經驗證的遠端攻擊者可利用此弱點取得敏感資訊的存取權。(CVE-2014-8161)

- 網域名稱服務中存有一個瑕疵，這是因為用於遵循委派的程式碼出錯而引起的。遠端攻擊者若擁有惡意建構的區域或查詢，就能造成服務發出無限制的查詢，進而導致資源耗盡。(CVE-2014-8500)

- 由於不正確處理 WebSocket PING 框架，而導致「mod_lua」模組中的 lua_websocket_read() 函式出現一個瑕疵。遠端攻擊者可惡意利用這點，在 Lua 指令碼呼叫 wsupgrade() 函式之後傳送特製的 WebSocket PING 框架，造成子處理程序損毀，進而導致拒絕服務情形。(CVE-2015-0228)

- 存在多個弱點，是因與「to_char」函式有關的多個緩衝區溢位錯誤所導致。經驗證的遠端攻擊者可惡意利用這些問題，造成拒絕服務或任意程式碼執行。(CVE-2015-0241)

- 存在多個弱點，是因多種 *printf() 函式中的數個堆疊型緩衝區溢位錯誤所導致。溢位發生的原因是格式化浮點數時 (要求的準確度高於大約 500) 不當驗證使用者提供的輸入。經驗證的遠端攻擊者可惡意利用這些問題，造成拒絕服務或任意程式碼執行。(CVE-2015-0242)

- 存在多個弱點，是因「pgcrypto」延伸模組中的數個函式發生溢位情形所導致。溢位發生的原因是追蹤記憶體大小時不當驗證使用者提供的輸入。經驗證的遠端攻擊者可惡意利用這些問題，造成拒絕服務或任意程式碼執行。(CVE-2015-0243)

- 存在 SQL 插入弱點，是因處理命令參數中的特製二進位資料時，不當清理使用者提供的輸入所導致。經驗證的遠端攻擊者可惡意利用此問題來插入或操控 SQL 查詢，進而允許操控或洩漏任意資料。
 (CVE-2015-0244)

- read_request_line() 函式中存在因無法初始化通訊協定結構成員所致的 NULL 指標解除參照瑕疵。遠端攻擊者可惡意利用此瑕疵，針對啟用了 INCLUDES 篩選器且具有指定本機 URI 之 ErrorDocument 400 指示詞的安裝，傳送缺少方法的要求，造成拒絕服務情形。(CVE-2015-0253)

- 存在一個拒絕服務弱點，是因與 DNSSEC 驗證和受管理金鑰功能有關的錯誤所導致。遠端攻擊者可觸發錯誤的信任錨點管理狀況，該狀況下無任何就緒金鑰可供使用，進而導致宣告失敗和程序損毀。(CVE-2015-1349)

- PostgreSQL 用戶端中斷連線逾時到期存在一個瑕疵，該瑕疵會在工作階段關機序列過程中發生逾時中斷時觸發。(CVE-2015-3165)

- printf() 函式中存在一個瑕疵，這是因為檢查錯誤失敗所致。遠端攻擊者可利用此瑕疵取得敏感資訊的存取權。(CVE-2015-3166)

- 針對具有錯誤金鑰的解密，PostgreSQL 的 pgcrypto 元件有多個錯誤訊息。遠端攻擊者可加以惡意利用，藉此從其他系統還原金鑰。(CVE-2015-3167)

- 在區塊傳輸編碼實作中，存在因無法正確剖析區塊標頭所致的瑕疵。遠端攻擊者可惡意利用這點，發動 HTTP 要求走私攻擊。(CVE-2015-3183)

- 在 ap_some_auth_required() 函式中，存在因無法考慮 Require 指示詞可能與授權設定而非驗證設定相關聯所致的瑕疵。如果依賴 2.2 API 行為的模組存在，遠端攻擊者可惡意利用這點，繞過預定的存取限制。
 (CVE-2015-3185)

- 以 Twisted 為基礎的 Wiki Server 中存在多個不明 XML 瑕疵。(CVE-2015-5911)

Versions of Apache HTTP Server 2.3.x / 2.4.x prior to 2.4.12 are affected by an authorization bypass vulnerability because of insufficient authorization enforcement in LuaAuthzProvider. Specifically, this issue affects the 'mod_lua.c' module when LuaAuthzProvider is used in multiple Require directives with different arguments. Attackers can exploit this issue using readily available tools to obtain sensitive information that may aid in further attacks.

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.5. The installed version is affected by multiple vulnerabilities in the following components :

 - apache (CVE-2014-3581, CVE-2014-3583, CVE-2014-8109, CVE-2015-0228, CVE-2015-0253, CVE-2015-3183, CVE-2015-3185)
 - apache_mod_php (CVE-2015-2783, CVE-2015-2787, CVE-2015-3307, CVE-2015-3329, CVE-2015-3330, CVE-2015-4021, CVE-2015-4022, CVE-2015-4024, CVE-2015-4025, CVE-2015-4026, CVE-2015-4147, CVE-2015-4148)
 - Apple ID OD Plug-in (CVE-2015-3799)
 - AppleGraphicsControl (CVE-2015-5768)
 - Bluetooth (CVE-2015-3777, CVE-2015-3779, CVE-2015-3780, CVE-2015-3786, CVE-2015-3787)
 - bootp (CVE-2015-3778)
 - CloudKit (CVE-2015-3782)
 - CoreMedia Playback (CVE-2015-5777, CVE-2015-5778)
 - CoreText (CVE-2015-5761, CVE-2015-5755)
 - curl (CVE-2014-3613, CVE-2014-3620, CVE-2014-3707, CVE-2014-8150, CVE-2014-8151, CVE-2015-3143, CVE-2015-3144, CVE-2015-3145, CVE-2015-3148, CVE-2015-3153)
 - Data Detectors Engine (CVE-2015-5750)
 - Date & Time pref pane (CVE-2015-3757)
 - Dictionary Application (CVE-2015-3774)
 - DiskImages (CVE-2015-3800)
 - dyld (CVE-2015-3760)
 - FontParser (CVE-2015-3804, CVE-2015-5775, CVE-2015-5756)
 - groff (CVE-2009-5044, CVE-2009-5078)
 - ImageIO (CVE-2015-5758, CVE-2015-5781, CVE-2015-5782)
 - Install Framework Legacy (CVE-2015-5784, CVE-2015-5754)
 - IOFireWireFamily (CVE-2015-3769, CVE-2015-3771, CVE-2015-3772)
 - IOGraphics (CVE-2015-3770, CVE-2015-5783)
 - IOHIDFamily (CVE-2015-5774)
 - Kernel (CVE-2015-3766, CVE-2015-3768, CVE-2015-5747, CVE-2015-5748, CVE-2015-3806, CVE-2015-3803, CVE-2015-3802, CVE-2015-3805, CVE-2015-3776, CVE-2015-3761)
 - Libc (CVE-2015-3796, CVE-2015-3797, CVE-2015-3798)
 - Libinfo (CVE-2015-5776)
 - libpthread (CVE-2015-5757)
 - libxml2 (CVE-2014-0191, CVE-2014-3660, CVE-2015-3807)
 - libxpc (CVE-2015-3795)
 - mail_cmds (CVE-2014-7844)
 - Notification Center OSX (CVE-2015-3764)
 - ntfs (CVE-2015-5763)
 - OpenSSH (CVE-2015-5600)
 - OpenSSL (CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792)
 - perl (CVE-2013-7422)
 - PostgreSQL (CVE-2014-0067, CVE-2014-8161, CVE-2015-0241, CVE-2015-0242, CVE-2015-0243, CVE-2015-0244)
 - python (CVE-2013-7040, CVE-2013-7338, CVE-2014-1912, CVE-2014-7185, CVE-2014-9365)
 - QL Office (CVE-2015-5773, CVE-2015-3784)
 - Quartz Composer Framework (CVE-2015-5771)
 - Quick Look (CVE-2015-3781)
 - QuickTime 7 (CVE-2015-3779, CVE-2015-5753, CVE-2015-5779, CVE-2015-3765, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751)
 - SceneKit (CVE-2015-5772, CVE-2015-3783)
 - Security (CVE-2015-3775)
 - SMBClient (CVE-2015-3773)
 - Speech UI (CVE-2015-3794)
 - sudo (CVE-2013-1775, CVE-2013-1776, CVE-2013-2776, CVE-2013-2777, CVE-2014-0106, CVE-2014-9680)
 - tcpdump (CVE-2014-8767, CVE-2014-8769, CVE-2014-9140)
 - Text Formats (CVE-2015-3762)
 - udf (CVE-2015-3767)

 Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
135617	EulerOS Virtualization 3.0.2.2 : httpd (EulerOS-SA-2020-1455)	Nessus	Huawei Local Security Checks	2020/4/16	2024/3/15	medium
80300	openSUSE Security Update : apache2 (openSUSE-SU-2014:1726-1)	Nessus	SuSE Local Security Checks	2014/12/30	2021/1/19	medium
82346	Mandriva Linux Security Advisory : apache (MDVSA-2015:093)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	medium
85408	Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2015/8/17	2024/5/28	high
86066	Mac OS X : OS X Server < 5.0.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2015/9/22	2019/11/22	critical
218553	Linux Distros 未修補弱點：CVE-2014-8109	Nessus	Misc.	2025/3/4	2025/3/4	high
80300	openSUSE 安全性更新：apache2 (openSUSE-SU-2014:1726-1)	Nessus	SuSE Local Security Checks	2014/12/30	2021/1/19	medium
82346	Mandriva Linux 安全性公告：apache (MDVSA-2015:093)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	medium
85408	Mac OS X 10.10.x < 10.10.5 多個弱點	Nessus	MacOS X Local Security Checks	2015/8/17	2024/5/28	high
86066	Mac OS X：OS X Server < 5.0.3 多個弱點	Nessus	MacOS X Local Security Checks	2015/9/22	2019/11/22	critical
8587	Apache HTTP Server 2.3.x / 2.4.x < 2.4.12 Authorization Bypass	Nessus Network Monitor	Web Servers	2015/2/4	2019/3/6	low
8981	Mac OS X < 10.10.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	2015/10/16	2019/3/6	high

检测

插件搜索

medium

medium

medium

high

critical

high

medium

medium

high

critical

low

high