The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-2926:01 advisory.

    * glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation     (CVE-2018-1000001)
    * glibc: Buffer overflow in glob with GLOB_TILDE (CVE-2017-15670)
    * glibc: Buffer overflow during unescaping of user names with the ~ operator (CVE-2017-15804)
    * glibc: denial of service in getnetbyname function (CVE-2014-9402)
    * glibc: DNS resolver NULL pointer dereference with crafted record type (CVE-2015-5180)
    * glibc: Fragmentation attacks possible when EDNS0 is enabled (CVE-2017-12132)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Use-after-free vulnerability in the clntudp_call     function in sunrpc/clnt_udp.c in the GNU C Library (aka     glibc or libc6) before 2.26 allows remote attackers to     have unspecified impact via vectors related to error     path.(CVE-2017-12133)

  - In the GNU C Library (aka glibc or libc6) through 2.28,     the getaddrinfo function would successfully parse a     string that contained an IPv4 address followed by     whitespace and arbitrary characters, which could lead     applications to incorrectly assume that it had parsed a     valid string, without the possibility of embedded HTTP     headers or other potentially dangerous     substrings.(CVE-2016-10739)

  - An AVX-512-optimized implementation of the mempcpy     function in the GNU C Library (aka glibc or libc6) 2.27     and earlier may write data beyond the target buffer,     leading to a buffer overflow in
    __mempcpy_avx512_no_vzeroupper.(CVE-2018-11237)

  - res_query in libresolv in glibc before 2.25 allows     remote attackers to cause a denial of service (NULL     pointer dereference and process crash).(CVE-2015-5180)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2886-1 advisory.

  - res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL     pointer dereference and process crash). (CVE-2015-5180)

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance     the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a     different vulnerability from CVE-2016-10228. (CVE-2020-27618)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2020-29562)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-     based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with     a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the mention of Fixed for glibc 2.33 in the 26649 reference.
    (CVE-2020-29573)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2021-3326)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash). (CVE-2015-5180)

Impact

For this vulnerability, an attacker must have local access to the system and know how to make the glibc function trigger an exploit. The attacker may be able to dereference a NULL pointer and cause an application to restart.

Fragmentation attacks possible when EDNS0 is enabled

The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation.(CVE-2017-12132)

Buffer overflow in glob with GLOB_TILDE

The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~ operator followed by a long string.(CVE-2017-15670)

Denial of service in getnetbyname function

The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being process.(CVE-2014-9402)

DNS resolver NULL pointer dereference with crafted record type

res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash).(CVE-2015-5180)

realpath() buffer underflow when getcwd() returns relative path allows privilege escalation

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.(CVE-2018-1000001)

Buffer overflow during unescaping of user names with the ~ operator

The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the ~ operator.(CVE-2017-15804)

This update for glibc fixes the following security issues :

CVE-2017-15670: Prevent off-by-one error that lead to a heap-based buffer overflow in the glob function, related to the processing of home directories using the ~ operator followed by a long string (bsc#1064583)

CVE-2017-15804: The glob function contained a buffer overflow during unescaping of user names with the ~ operator (bsc#1064580)

CVE-2015-5180: res_query in libresolv allowed remote attackers to cause a denial of service (NULL pointer dereference and process crash) (bsc#941234).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Stack-based buffer overflow in the clntudp_call     function in sunrpc/clnt_udp.c in the GNU C Library (aka     glibc or libc6) allows remote servers to cause a denial     of service (crash) or possibly unspecified other impact     via a flood of crafted ICMP and UDP     packets.(CVE-2016-4429)

  - Integer overflow in the strxfrm function in the GNU C     Library (aka glibc or libc6) before 2.21 allows     context-dependent attackers to cause a denial of     service (crash) or possibly execute arbitrary code via     a long string, which triggers a stack-based buffer     overflow.(CVE-2015-8982)

  - The posix_spawn_file_actions_addopen function in glibc     before 2.20 does not copy its path argument in     accordance with the POSIX specification, which allows     context-dependent attackers to trigger use-after-free     vulnerabilities.(CVE-2014-4043)

  - res_query in libresolv in glibc before 2.25 allows     remote attackers to cause a denial of service (NULL     pointer dereference and process crash).(CVE-2015-5180)

  - A buffer overflow has been discovered in the GNU C     Library (aka glibc or libc6) in the
    __mempcpy_avx512_no_vzeroupper function when particular     conditions are met. An attacker could use this     vulnerability to cause a denial of service or     potentially execute code.(CVE-2018-11237)

  - In the GNU C Library (aka glibc or libc6) through 2.29,     proceed_next_node in posix/regexec.c has a heap-based     buffer over-read via an attempted case-insensitive     regular-expression match.(CVE-2019-9169)

  - The iconv program in the GNU C Library (aka glibc or     libc6) 2.25 and earlier, when invoked with the -c     option, enters an infinite loop when processing invalid     multi-byte input sequences, leading to a denial of     service.(CVE-2016-10228)

  - The DNS stub resolver in the GNU C Library (aka glibc     or libc6) before version 2.26, when EDNS support is     enabled, will solicit large UDP responses from name     servers, potentially simplifying off-path DNS spoofing     attacks due to IP fragmentation.(CVE-2017-12132)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL     pointer dereference and process crash). (CVE-2015-5180)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-0805 advisory.

    - CVE-2018-1000001: Fix realpath() buffer underflow (#1534635)
    - CVE-2017-15670: glob: Fix one-byte overflow with GLOB_TILDE (#1504809)
    - CVE-2017-15804: glob: Fix buffer overflow in GLOB_TILDE unescaping (#1504809)
    - CVE-2017-1213: Fragmentation attacks possible when ENDS0 is enabled       (#1487063)
    - CVE-2016-3706: Stack (frame) overflow in getaddrinfo when called       with AF_INET, AF_INET6 (#1329674)
    - CVE-2015-5180: resolv: Fix crash with internal QTYPE (#1497131)
    - CVE-2014-9402: denial of service in getnetbyname function (#1497132)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for glibc is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es) :

* glibc: realpath() buffer underflow when getcwd() returns relative path allows privilege escalation (CVE-2018-1000001)

* glibc: Buffer overflow in glob with GLOB_TILDE (CVE-2017-15670)

* glibc: Buffer overflow during unescaping of user names with the ~ operator (CVE-2017-15804)

* glibc: denial of service in getnetbyname function (CVE-2014-9402)

* glibc: DNS resolver NULL pointer dereference with crafted record type (CVE-2015-5180)

* glibc: Fragmentation attacks possible when EDNS0 is enabled (CVE-2017-12132)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank halfdog for reporting CVE-2018-1000001.
The CVE-2015-5180 issue was discovered by Florian Weimer (Red Hat Product Security).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

An update of [curl,glibc,postgresql] packages of photonOS has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
288895	MiracleLinux 7 : glibc-2.17-222.el7 (AXSA:2018-2926:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/2/10	critical
131629	EulerOS 2.0 SP2 : glibc (EulerOS-SA-2019-2476)	Nessus	Huawei Local Security Checks	2019/12/4	2021/1/6	high
164426	SUSE SLES12 Security Update : glibc (SUSE-SU-2022:2886-1)	Nessus	SuSE Local Security Checks	2022/8/25	2023/7/14	high
99204	F5 Networks BIG-IP : glibc vulnerability (K55001100)	Nessus	F5 Networks Local Security Checks	2017/4/6	2025/12/26	high
109699	Amazon Linux AMI : glibc (ALAS-2018-1017)	Nessus	Amazon Linux Local Security Checks	2018/5/11	2024/10/9	critical
117804	SUSE SLES11 Security Update : glibc (SUSE-SU-2018:2883-1)	Nessus	SuSE Local Security Checks	2018/9/27	2024/8/1	critical
129223	EulerOS 2.0 SP3 : glibc (EulerOS-SA-2019-2030)	Nessus	Huawei Local Security Checks	2019/9/24	2021/1/6	critical
218790	Linux Distros Unpatched Vulnerability : CVE-2015-5180	Nessus	Misc.	2025/3/4	2025/9/4	high
109105	Oracle Linux 7 : glibc (ELSA-2018-0805)	Nessus	Oracle Linux Local Security Checks	2018/4/18	2024/11/1	critical
109371	CentOS 7 : glibc (CESA-2018:0805)	Nessus	CentOS Local Security Checks	2018/4/27	2024/10/22	critical
111897	Photon OS 1.0: Curl / Glibc PHSA-2017-0048 (deprecated)	Nessus	PhotonOS Local Security Checks	2018/8/17	2019/2/7	medium

检测

插件搜索

critical

high

high

high

critical

critical

critical

high

critical

critical

medium