リモートホストにインストールされているTenable SecurityCenterアプリケーションはバージョン5.3.0より前であるか、セキュリティパッチがありません。したがって、PHPにバンドルされているPerl-Compatible Regular Expressions（PCRE）ライブラリの複数の脆弱性の影響を受けます。- 繰り返される条件付きグループを処理する時に、ユーザー指定入力の不適切な検証により、PCREライブラリにオーバーフロー状態が存在します。攻撃者がこれを悪用して、特別に細工された正規表現を通じて、バッファオーバーフローを引き起こし、サービス拒否状態につながる可能性があります。（CVE-2015-8383）-「lookbehind」アサーション内の相互再帰を処理するときに、ユーザー指定入力の不適切な検証により、PCREライブラリにオーバーフロー状態が存在します。攻撃者がこれを悪用して、スタックベースのバッファオーバーフローを引き起こし、サービス拒否状態につながる可能性があります。（CVE-2015-8386）-サブルーチン呼び出しを処理するときに、ユーザー指定入力が不適切に検証されているため、PCREライブラリに整数オーバーフロー状態が存在します。攻撃者がこれを悪用して、特別に細工された正規表現を通じて、サービス拒否状態を引き起こす可能性があります。（CVE-2015-8387）-/(?:|a|){100}x/パターンまたはその他の関連パターンが不適切に処理されているため、PCREライブラリに欠陥があります。攻撃者がこれを悪用して、特別に細工された正規表現を通じて、無限再帰を引き起こし、サービス拒否状態につながる可能性があります。（CVE-2015-8389）-文字クラス内の部分文字列[:および\\が不適切に処理されているため、PCREライブラリに欠陥があります。攻撃者がこれを悪用して、特別に細工された正規表現を通じて、初期化されていないメモリ読み取りを引き起こし、サービス拒否状態につながる可能性があります。（CVE-2015-8390）-[:ネスティングが不適切に処理されているため、pcre_compile.cのpcre_compile()関数内のPCREライブラリに欠陥があります。攻撃者がこれを悪用して、特別に細工された正規表現を通じて、CPUリソースの過剰消費を引き起こし、サービス拒否状態につながる可能性があります。（CVE-2015-8391）-バイナリファイルの「-q」オプションが不適切に処理されているため、PCREライブラリに欠陥があります。攻撃者がこれを悪用して、特別に細工されたファイルを介して、秘密情報を漏えいさせる可能性があります。（CVE-2015-8393）-(?(<digits>)および(?(R<digits>)条件を処理するときに、ユーザー指定入力が不適切に検証されているため、PCRE ライブラリに整数オーバーフロー状態が存在します。攻撃者がこれを悪用して、特別に細工された正規表現を通じてサービス拒否状態を引き起こす可能性があります。（CVE-2015-8394）Nessusはこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1132 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is     binary-compatible with MySQL. MariaDB uses PCRE, a Perl-compatible regular expression library, to     implement regular expression support in SQL queries.

    Security Fix(es):

    * It was found that the MariaDB client library did not properly check host names against server identities     noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle     attacker could possibly use this flaw to impersonate a server to a client. (CVE-2016-2047)

    * This update fixes several vulnerabilities in the MariaDB database server. Information about these flaws     can be found on the Oracle Critical Patch Update Advisory page, listed in the References section.
    (CVE-2015-4792, CVE-2015-4802, CVE-2015-4815, CVE-2015-4816, CVE-2015-4819, CVE-2015-4826, CVE-2015-4830,     CVE-2015-4836, CVE-2015-4858, CVE-2015-4861, CVE-2015-4870, CVE-2015-4879, CVE-2015-4895, CVE-2015-4913,     CVE-2016-0505, CVE-2016-0546, CVE-2016-0596, CVE-2016-0597, CVE-2016-0598, CVE-2016-0600, CVE-2016-0606,     CVE-2016-0608, CVE-2016-0609, CVE-2016-0610, CVE-2016-0616, CVE-2016-0640, CVE-2016-0641, CVE-2016-0642,     CVE-2016-0643, CVE-2016-0644, CVE-2016-0646, CVE-2016-0647, CVE-2016-0648, CVE-2016-0649, CVE-2016-0650,     CVE-2016-0651, CVE-2016-0655, CVE-2016-0666, CVE-2016-0668)

    * Multiple flaws were found in the way PCRE handled malformed regular expressions. An attacker able to     make MariaDB execute an SQL query with a specially crafted regular expression could use these flaws to     cause it to crash or, possibly, execute arbitrary code. (CVE-2015-3210, CVE-2015-3217, CVE-2015-5073,     CVE-2015-8381, CVE-2015-8383, CVE-2015-8384, CVE-2015-8385, CVE-2015-8386, CVE-2015-8388, CVE-2015-8391,     CVE-2015-8392, CVE-2015-8395, CVE-2016-1283, CVE-2016-3191)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-462:01 advisory.

    MariaDB is a community developed branch of MySQL.
    MariaDB is a multi-user, multi-threaded SQL database server.
    It is a client/server implementation consisting of a server daemon (mysqld)     and many different client programs and libraries. The base package     contains the standard MariaDB/MySQL client programs and generic MySQL files.
    Security issues fixed with this release:
    CVE-2015-3210
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-3217
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4792     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier     and 5.6.26 and earlier allows remote authenticated users to affect     availability via unknown vectors related to Server : Partition, a     different vulnerability than CVE-2015-4802.
    CVE-2015-4802     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier     and 5.6.26 and earlier allows remote authenticated users to affect     availability via unknown vectors related to Server : Partition, a     different vulnerability than CVE-2015-4792.
    CVE-2015-4815     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier     and 5.6.26 and earlier allows remote authenticated users to affect     availability via vectors related to Server : DDL.
    CVE-2015-4816     Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier     allows remote authenticated users to affect availability via unknown     vectors related to Server : InnoDB.
    CVE-2015-4819     Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier,     and 5.6.25 and earlier, allows local users to affect confidentiality,     integrity, and availability via unknown vectors related to Client     programs.
    CVE-2015-4826     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier     and 5.6.26 and earlier allows remote authenticated users to affect     confidentiality via unknown vectors related to Server : Types.
    CVE-2015-4830     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier     and 5.6.26 and earlier allows remote authenticated users to affect     integrity via unknown vectors related to Server : Security :
    Privileges.
    CVE-2015-4836     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier,     and 5.6.26 and earlier, allows remote authenticated users to affect     availability via unknown vectors related to Server : SP.
    CVE-2015-4858     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier,     and 5.6.26 and earlier, allows remote authenticated users to affect     availability via vectors related to DML, a different vulnerability     than CVE-2015-4913.
    CVE-2015-4861     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier,     and 5.6.26 and earlier, allows remote authenticated users to affect     availability via unknown vectors related to Server : InnoDB.
    CVE-2015-4870     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier,     and 5.6.26 and earlier, allows remote authenticated users to affect     availability via unknown vectors related to Server : Parser.
    CVE-2015-4879     Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier,     and 5.6.25 and earlier, allows remote authenticated users to affect     confidentiality, integrity, and availability via vectors related to     DML.
    CVE-2015-4895     Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier     allows remote authenticated users to affect availability via unknown     vectors related to Server : InnoDB.
    CVE-2015-4913     Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier     and 5.6.26 and earlier allows remote authenticated users to affect     availability via vectors related to Server : DML, a different     vulnerability than CVE-2015-4858.
    CVE-2015-5073
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-8381     The compile_regex function in pcre_compile.c in PCRE before 8.38 and     pcre2_compile.c in PCRE2 before 10.2x mishandles the     /(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/ and     /(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/     patterns, and related patterns with certain group references, which     allows remote attackers to cause a denial of service (heap-based     buffer overflow) or possibly have unspecified other impact via a     crafted regular expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror.
    CVE-2015-8383     PCRE before 8.38 mishandles certain repeated conditional groups, which     allows remote attackers to cause a denial of service (buffer overflow)     or possibly have unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp object encountered     by Konqueror.
    CVE-2015-8384     PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and     related patterns with certain recursive back references, which allows     remote attackers to cause a denial of service (buffer overflow) or     possibly have unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp object encountered     by Konqueror, a related issue to CVE-2015-8392 and CVE-2015-8395.
    CVE-2015-8385     PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and     related patterns with certain forward references, which allows remote     attackers to cause a denial of service (buffer overflow) or possibly     have unspecified other impact via a crafted regular expression, as     demonstrated by a JavaScript RegExp object encountered by Konqueror.
    CVE-2015-8386     PCRE before 8.38 mishandles the interaction of lookbehind assertions     and mutually recursive subpatterns, which allows remote attackers to     cause a denial of service (buffer overflow) or possibly have     unspecified other impact via a crafted regular expression, as     demonstrated by a JavaScript RegExp object encountered by Konqueror.
    CVE-2015-8388     PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and     related patterns with an unmatched closing parenthesis, which allows     remote attackers to cause a denial of service (buffer overflow) or     possibly have unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp object encountered     by Konqueror.
    CVE-2015-8391     The pcre_compile function in pcre_compile.c in PCRE before 8.38     mishandles certain [: nesting, which allows remote attackers to cause     a denial of service (CPU consumption) or possibly have unspecified     other impact via a crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by Konqueror.
    CVE-2015-8392     PCRE before 8.38 mishandles certain instances of the (?| substring,     which allows remote attackers to cause a denial of service (unintended     recursion and buffer overflow) or possibly have unspecified other     impact via a crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by Konqueror, a related issue to     CVE-2015-8384 and CVE-2015-8395.
    CVE-2015-8395     PCRE before 8.38 mishandles certain references, which allows remote     attackers to cause a denial of service or possibly have unspecified     other impact via a crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by Konqueror, a related issue to     CVE-2015-8384 and CVE-2015-8392.
    CVE-2016-0505     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27     and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users     to affect availability via unknown vectors related to Options.
    CVE-2016-0546     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27     and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows local users to affect     confidentiality, integrity, and availability via unknown vectors     related to Client.  NOTE: the previous information is from the January     2016 CPU. Oracle has not commented on third-party claims that these     are multiple buffer overflows in the mysqlshow tool that allow remote     database servers to have unspecified impact via a long table or     database name.
    CVE-2016-0596     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and     5.6.27 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23,     and 10.1.x before 10.1.10 allows remote authenticated users to affect     availability via vectors related to DML.
    CVE-2016-0597     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27     and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users     to affect availability via unknown vectors related to Optimizer.
    CVE-2016-0598     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27     and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users     to affect availability via vectors related to DML.
    CVE-2016-0600     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27     and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users     to affect availability via unknown vectors related to InnoDB.
    CVE-2016-0606     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27     and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users     to affect integrity via unknown vectors related to encryption.
    CVE-2016-0608     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27     and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users     to affect availability via vectors related to UDF.
    CVE-2016-0609     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27     and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before     10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users     to affect availability via unknown vectors related to privileges.
    CVE-2016-0610     Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and     MariaDB before 10.0.22 and 10.1.x before 10.1.9 allows remote     authenticated users to affect availability via unknown vectors related     to InnoDB.
    CVE-2016-0616     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and     MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before     10.1.10 allows remote authenticated users to affect availability via     unknown vectors related to Optimizer.
    CVE-2016-0640     Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28     and earlier, and 5.7.10 and earlier allows local users to affect     integrity and availability via vectors related to DML.
    CVE-2016-0641     Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28     and earlier, and 5.7.10 and earlier allows local users to affect     confidentiality and availability via vectors related to MyISAM.
    CVE-2016-0642     Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29     and earlier, and 5.7.11 and earlier allows local users to affect     integrity and availability via vectors related to Federated.
    CVE-2016-0643     Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29     and earlier, and 5.7.11 and earlier allows local users to affect     confidentiality via vectors related to DML.
    CVE-2016-0644     Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28     and earlier, and 5.7.10 and earlier allows local users to affect     availability via vectors related to DDL.
    CVE-2016-0646     Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28     and earlier, and 5.7.10 and earlier allows local users to affect     availability via vectors related to DML.
    CVE-2016-0647     Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29     and earlier, and 5.7.11 and earlier allows local users to affect     availability via vectors related to FTS.
    CVE-2016-0648     Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29     and earlier, and 5.7.11 and earlier allows local users to affect     availability via vectors related to PS.
    CVE-2016-0649     Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28     and earlier, and 5.7.10 and earlier allows local users to affect     availability via vectors related to PS.
    CVE-2016-0650     Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28     and earlier, and 5.7.10 and earlier allows local users to affect     availability via vectors related to Replication.
    CVE-2016-0651     Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows     local users to affect availability via vectors related to Optimizer.
    CVE-2016-0655     Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and     5.7.11 and earlier allows local users to affect availability via     vectors related to InnoDB.
    CVE-2016-0666     Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29     and earlier, and 5.7.11 and earlier allows local users to affect     availability via vectors related to Security: Privileges.
    CVE-2016-0668     Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and     5.7.10 and earlier allows local users to affect availability via     vectors related to InnoDB.
    CVE-2016-1283     The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles     the     /((?:F? (?:^(?(R)a \){99}-     ))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/     pattern and related patterns with named subgroups, which allows remote     attackers to cause a denial of service (heap-based buffer overflow) or     possibly have unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp object encountered     by Konqueror.
    CVE-2016-2047     The ssl_verify_server_cert function in sql-common/client.c in MariaDB     before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10;
    Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and     earlier; and Percona Server do not properly verify that the server     hostname matches a domain name in the subject's Common Name (CN) or     subjectAltName field of the X.509 certificate, which allows     man-in-the-middle attackers to spoof SSL servers via a /CN= string     in a field in a certificate, as demonstrated by     /OU=/CN=bar.com/CN=foo.com.
    CVE-2016-3191     The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39     and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns     containing an (*ACCEPT) substring in conjunction with nested     parentheses, which allows remote attackers to execute arbitrary code     or cause a denial of service (stack-based buffer overflow) via a     crafted regular expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror, aka ZDI-CAN-3542.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 8.38 and fix various CVE's

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for pcre to version 8.39 (bsc#972127) fixes several issues. If you use pcre extensively please be aware that this is an update to a new version. Please make sure that your software works with the updated version. This version fixes a number of vulnerabilities that affect pcre and applications using the libary when accepting untrusted input as regular expressions or as part thereof. Remote attackers could have caused the application to crash, disclose information or potentially execute arbitrary code. These security issues were fixed :

  - CVE-2014-8964: Heap-based buffer overflow in PCRE     allowed remote attackers to cause a denial of service     (crash) or have other unspecified impact via a crafted     regular expression, related to an assertion that allows     zero repeats (bsc#906574).

  - CVE-2015-2325: Heap buffer overflow in compile_branch()     (bsc#924960).

  - CVE-2015-3210: Heap buffer overflow in pcre_compile2() /     compile_regex() (bsc#933288)

  - CVE-2015-3217: PCRE Library Call Stack Overflow     Vulnerability in match() (bsc#933878).

  - CVE-2015-5073: Library Heap Overflow Vulnerability in     find_fixedlength() (bsc#936227).

  - bsc#942865: heap overflow in compile_regex()

  - CVE-2015-8380: The pcre_exec function in pcre_exec.c     mishandled a // pattern with a \01 string, which allowed     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror (bsc#957566).

  - CVE-2015-2327: PCRE mishandled certain patterns with     internal recursive back references, which allowed remote     attackers to cause a denial of service (segmentation     fault) or possibly have unspecified other impact via a     crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by Konqueror     (bsc#957567).

  - bsc#957598: Various security issues

  - CVE-2015-8381: Heap Overflow in compile_regex()     (bsc#957598).

  - CVE-2015-8382: Regular Expression Uninitialized Pointer     Information Disclosure Vulnerability     (ZDI-CAN-2547)(bsc#957598).

  - CVE-2015-8383: Buffer overflow caused by repeated     conditional group(bsc#957598).

  - CVE-2015-8384: Buffer overflow caused by recursive back     reference by name within certain group(bsc#957598).

  - CVE-2015-8385: Buffer overflow caused by forward     reference by name to certain group(bsc#957598).

  - CVE-2015-8386: Buffer overflow caused by lookbehind     assertion(bsc#957598).

  - CVE-2015-8387: Integer overflow in subroutine     calls(bsc#957598).

  - CVE-2015-8388: Buffer overflow caused by certain     patterns with an unmatched closing     parenthesis(bsc#957598).

  - CVE-2015-8389: Infinite recursion in JIT compiler when     processing certain patterns(bsc#957598).

  - CVE-2015-8390: Reading from uninitialized memory when     processing certain patterns(bsc#957598).

  - CVE-2015-8391: Some pathological patterns causes     pcre_compile() to run for a very long time(bsc#957598).

  - CVE-2015-8392: Buffer overflow caused by certain     patterns with duplicated named groups(bsc#957598).

  - CVE-2015-8393: Information leak when running pcgrep -q     on crafted binary(bsc#957598).

  - CVE-2015-8394: Integer overflow caused by missing check     for certain conditions(bsc#957598).

  - CVE-2015-8395: Buffer overflow caused by certain     references(bsc#957598).

  - CVE-2015-2328: PCRE mishandled the /((?(R)a|(?1)))+/     pattern and related patterns with certain recursion,     which allowed remote attackers to cause a denial of     service (segmentation fault) or possibly have     unspecified other impact via a crafted regular     expression (bsc#957600).

  - CVE-2016-1283: The pcre_compile2 function in     pcre_compile.c in PCRE mishandled certain patterns with     named subgroups, which allowed remote attackers to cause     a denial of service (heap-based buffer overflow) or     possibly have unspecified other impact via a crafted     regular expression (bsc#960837).

  - CVE-2016-3191: The compile_branch function in     pcre_compile.c in pcre2_compile.c mishandled patterns     containing an (*ACCEPT) substring in conjunction with     nested parentheses, which allowed remote attackers to     execute arbitrary code or cause a denial of service     (stack-based buffer overflow) via a crafted regular     expression (bsc#971741).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.18. It is, therefore, affected by multiple vulnerabilities :

  - The Perl-Compatible Regular Expressions (PCRE) library     is affected by multiple vulnerabilities related to the     handling of regular expressions, subroutine calls, and     binary files. A remote attacker can exploit these to     cause a denial of service, obtain sensitive information,     or have other unspecified impact. (CVE-2015-8383,     CVE-2015-8386, CVE-2015-8387, CVE-2015-8389,     CVE-2015-8390, CVE-2015-8391, CVE-2015-8393,     CVE-2015-8394)

  - A flaw exists in file ext/standard/exec.c in the     escapeshellcmd() and escapeshellarg() functions due to     the program truncating NULL bytes in strings. A remote     attacker can exploit this to bypass restrictions.

  - A flaw exists in file ext/standard/streamsfuncs.c in the     stream_get_meta_data() function due to a failure to     restrict writing user-supplied data to fields not     already set. A remote attacker can exploit this to     falsify the output of the function, resulting in the     insertion of malicious metadata.

  - A type confusion error exists in file ext/wddx/wddx.c in     the php_wddx_pop_element() function when deserializing     WDDX packets. A remote attacker can exploit this to have     an unspecified impact.

  - A flaw exists in file ext/phar/phar_object.c in the     PharFileInfo::getContent() method due to the use of     uninitialized memory causing improper validation of     user-supplied input. A remote attacker can exploit this     to corrupt memory, resulting in a denial of service or     the execution of arbitrary code.

  - A NULL pointer dereference flaw exists in file     ext/phar/tar.c in the phar_tar_setupmetadata() function     when parsing metadata from a crafted TAR file. A remote     attacker can exploit this to cause a denial of service.

  - An integer overflow condition exists in file     ext/standard/iptc.c in the iptcembed() function due to     improper validation of user-supplied input. A remote     attacker can exploit this to cause a heap-based buffer     overflow, resulting in a denial of service or the     execution of arbitrary code.

  - An overflow condition exists in file ext/phar/tar.c in     the phar_parse_tarfile() function due to improper     validation of user-supplied input when decompressing     TAR files. A remote attacker can exploit this to cause     a stack-based buffer overflow, resulting in a denial of     service or the execution of arbitrary code.
    (CVE-2016-2554)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201607-02 (libpcre: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in libpcre. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

The Tenable SecurityCenter application installed on the remote host is either prior to version 5.3.0 or is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the Perl-Compatible Regular Expressions (PCRE) library bundled with PHP :

  - An overflow condition exists in the PCRE library due to     improper validation of user-supplied input when handling     repeated conditional groups. An attacker can exploit     this, via a specially crafted regular expression, to     cause a buffer overflow, resulting in a denial of     service condition. (CVE-2015-8383)

  - An overflow condition exists in the PCRE library due to     improper validation of user-supplied input when handling     mutual recursions within a 'lookbehind' assertion. An     attacker can exploit this to cause a stack-based buffer     overflow, resulting in a denial of service condition.
    (CVE-2015-8386)

  - An integer overflow condition exists in the PCRE library     due to improper validation of user-supplied input when     handling subroutine calls. An attacker can exploit this,     via a specially crafted regular expression, to cause a     denial of service condition. (CVE-2015-8387)

  - A flaw exists in the PCRE library due to improper     handling of the /(?:|a|){100}x/ pattern or other related     patterns. An attacker can exploit this, via a specially     crafted regular expression, to cause an infinite     recursion, resulting in a denial of service condition.
    (CVE-2015-8389)

  - A flaw exists in the PCRE library due to improper     handling of the [: and \\ substrings in character     classes. An attacker can exploit this, via a specially     crafted regular expression, to cause an uninitialized     memory read, resulting in a denial of service condition.
    (CVE-2015-8390)

  - A flaw exists in the PCRE library in the pcre_compile()     function in pcre_compile.c due to improper handling of     [: nesting. An attacker can exploit this, via a     specially crafted regular expression, to cause an     excessive consumption of CPU resources, resulting in a     denial of service condition. (CVE-2015-8391)

  - A flaw exists in the PCRE library due to improper     handling of the '-q' option for binary files. An     attacker can exploit this, via a specially crafted file,     to disclose sensitive information. (CVE-2015-8393)

  - An integer overflow condition exists in the PCRE library     due to improper validation of user-supplied input when     handling the (?(<digits>) and (?(R<digits>) conditions.
    An attacker can exploit this, via a specially crafted     regular expression, to cause a denial of service     condition. (CVE-2015-8394)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This release fixes these vulnerabilies: CVE-2015-8383, CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8393, CVE-2015-8394. It also fixes compiling comments with auto-callouts, compiling expressions with negated classes in UCP mode, compiling expressions with an isolated \E between an item and its qualifier with auto-callouts, a crash in regexec() if REG_STARTEND option is set and pmatch argument is NULL, a stack overflow when formatting a 32-bit integer in pcregrep tool, compiling expressions with an empty \Q\E sequence between an item and its qualifier with auto-callouts, compiling expressions with global extended modifier that is disabled by local no-extended option at the start of the expression just after a whitespace, a possible crash in pcre_copy_named_substring() if a named substring has number greater than the space in the ovector, a buffer overflow when compiling an expression with named groups with a group that reset capture numbers, and a crash in pcre_get_substring_list() if the use of \K caused the start of the match to be earlier than the end.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2943-1 advisory.

    It was discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use     this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly     execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

PHP reports :

- Core :

- Fixed bug #71039 (exec functions ignore length but look for NULL termination).

- Fixed bug #71323 (Output of stream_get_meta_data can be falsified by its input).

- Fixed bug #71459 (Integer overflow in iptcembed()).

- PCRE :

- Upgraded bundled PCRE library to 8.38.(CVE-2015-8383, CVE-2015-8386, CVE-2015-8387, CVE-2015-8389, CVE-2015-8390, CVE-2015-8391, CVE-2015-8393, CVE-2015-8394)

- Phar :

- Fixed bug #71354 (Heap corruption in tar/zip/phar parser).

- Fixed bug #71391 (NULL pointer Dereference in phar_tar_setupmetadata()).

- Fixed bug #71488 (Stack overflow when decompressing tar archives).
(CVE-2016-2554)

- WDDX :

- Fixed bug #71335 (Type Confusion in WDDX Packet Deserialization).

According to its banner, the version of PHP running on the remote web server is 5.5.x prior to 5.5.32. It is, therefore, affected by multiple vulnerabilities :

  - The Perl-Compatible Regular Expressions (PCRE) library     is affected by multiple vulnerabilities related to the     handling of regular expressions, subroutine calls, and     binary files. A remote attacker can exploit these to     cause a denial of service, obtain sensitive information,     or have other unspecified impact. (CVE-2015-8383,     CVE-2015-8386, CVE-2015-8387, CVE-2015-8389,     CVE-2015-8390, CVE-2015-8391, CVE-2015-8393,     CVE-2015-8394)

  - A flaw exists in file ext/standard/exec.c in the     escapeshellcmd() and escapeshellarg() functions due to     the program truncating NULL bytes in strings. A remote     attacker can exploit this to bypass restrictions.

  - A flaw exists in file ext/standard/streamsfuncs.c in the     stream_get_meta_data() function due to a failure to     restrict writing user-supplied data to fields not     already set. A remote attacker can exploit this to     falsify the output of the function, resulting in the     insertion of malicious metadata.

  - A type confusion error exists in file ext/wddx/wddx.c in     the php_wddx_pop_element() function when deserializing     WDDX packets. A remote attacker can exploit this to have     an unspecified impact.

  - A flaw exists in file ext/phar/phar_object.c in the     PharFileInfo::getContent() method due to the use of     uninitialized memory causing improper validation of     user-supplied input. A remote attacker can exploit this     to corrupt memory, resulting in a denial of service or     the execution of arbitrary code.

  - A NULL pointer dereference flaw exists in file     ext/phar/tar.c in the phar_tar_setupmetadata() function     when parsing metadata from a crafted TAR file. A remote     attacker can exploit this to cause a denial of service.

  - An integer overflow condition exists in file     ext/standard/iptc.c in the iptcembed() function due to     improper validation of user-supplied input. A remote     attacker can exploit this to cause a heap-based buffer     overflow, resulting in a denial of service or the     execution of arbitrary code.

  - An overflow condition exists in file ext/phar/tar.c in     the phar_parse_tarfile() function due to improper     validation of user-supplied input when decompressing     TAR files. A remote attacker can exploit this to cause     a stack-based buffer overflow, resulting in a denial of     service or the execution of arbitrary code.
    (CVE-2016-2554)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.3. It is, therefore, affected by multiple vulnerabilities :

  - The Perl-Compatible Regular Expressions (PCRE) library     is affected by multiple vulnerabilities related to the     handling of regular expressions, subroutine calls, and     binary files. A remote attacker can exploit these to     cause a denial of service, obtain sensitive information,     or have other unspecified impact. (CVE-2015-8383,     CVE-2015-8386, CVE-2015-8387, CVE-2015-8389,     CVE-2015-8390, CVE-2015-8391, CVE-2015-8393,     CVE-2015-8394)

  - A flaw exists in file ext/standard/exec.c in the     escapeshellcmd() and escapeshellarg() functions due to     the program truncating NULL bytes in strings. A remote     attacker can exploit this to bypass restrictions.

  - A flaw exists in file ext/standard/streamsfuncs.c in the     stream_get_meta_data() function due to a failure to     restrict writing user-supplied data to fields not     already set. A remote attacker can exploit this to     falsify the output of the function, resulting in the     insertion of malicious metadata.

  - A type confusion error exists in file ext/wddx/wddx.c in     the php_wddx_pop_element() function when deserializing     WDDX packets. A remote attacker can exploit this to have     an unspecified impact.

  - A flaw exists in file ext/phar/phar_object.c in the     PharFileInfo::getContent() method due to the use of     uninitialized memory causing improper validation of     user-supplied input. A remote attacker can exploit this     to corrupt memory, resulting in a denial of service or     the execution of arbitrary code.

  - A NULL pointer dereference flaw exists in file     ext/phar/tar.c in the phar_tar_setupmetadata() function     when parsing metadata from a crafted TAR file. A remote     attacker can exploit this to cause a denial of service.

  - An integer overflow condition exists in file     ext/standard/iptc.c in the iptcembed() function due to     improper validation of user-supplied input. A remote     attacker can exploit this to cause a heap-based buffer     overflow, resulting in a denial of service or the     execution of arbitrary code.

  - An overflow condition exists in file ext/phar/tar.c in     the phar_parse_tarfile() function due to improper     validation of user-supplied input when decompressing     TAR files. A remote attacker can exploit this to cause     a stack-based buffer overflow, resulting in a denial of     service or the execution of arbitrary code.
    (CVE-2016-2554)

  - An uninitialized pointer flaw exists in the     phar_make_dirstream() function within file     ext/phar/dirstream.c due to improper handling of     ././@LongLink files. An unauthenticated, remote attacker     can exploit this, via a specially crafted TAR file, to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-4343)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2015-8395 PCRE before 8.38 mishandles certain references, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8392.

CVE-2015-8394 PCRE before 8.38 mishandles the (?() and (?(R) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVE-2015-8392 PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8395.

CVE-2015-8391 The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVE-2015-8390 PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVE-2015-8389 PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVE-2015-8388 PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVE-2015-8387 PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVE-2015-8386 PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVE-2015-8385 PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVE-2015-8384 PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8392 and CVE-2015-8395.

CVE-2015-8383 PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVE-2015-8382 The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT )))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.

CVE-2015-8381 The compile_regex function in pcre_compile.c in PCRE before 8.38 and pcre2_compile.c in PCRE2 before 10.2x mishandles the /(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/ and /(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf )|s(?'R')))/ patterns, and related patterns with certain group references, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVE-2015-8380 The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVE-2015-2328 PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVE-2015-2327 PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVE-2015-3217 PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.

This update for pcre to version 8.39 (bsc#972127) fixes several issues.

If you use pcre extensively please be aware that this is an update to a new version. Please make sure that your software works with the updated version.

This version fixes a number of vulnerabilities that affect pcre and applications using the libary when accepting untrusted input as regular expressions or as part thereof. Remote attackers could have caused the application to crash, disclose information or potentially execute arbitrary code. These security issues were fixed :

  - CVE-2014-8964: Heap-based buffer overflow in PCRE     allowed remote attackers to cause a denial of service     (crash) or have other unspecified impact via a crafted     regular expression, related to an assertion that allows     zero repeats (bsc#906574).

  - CVE-2015-2325: Heap buffer overflow in compile_branch()     (bsc#924960).

  - CVE-2015-3210: Heap buffer overflow in pcre_compile2() /     compile_regex() (bsc#933288)

  - CVE-2015-3217: PCRE Library Call Stack Overflow     Vulnerability in match() (bsc#933878).

  - CVE-2015-5073: Library Heap Overflow Vulnerability in     find_fixedlength() (bsc#936227).

  - bsc#942865: heap overflow in compile_regex()

  - CVE-2015-8380: The pcre_exec function in pcre_exec.c     mishandled a // pattern with a \01 string, which allowed     remote attackers to cause a denial of service     (heap-based buffer overflow) or possibly have     unspecified other impact via a crafted regular     expression, as demonstrated by a JavaScript RegExp     object encountered by Konqueror (bsc#957566).

  - CVE-2015-2327: PCRE mishandled certain patterns with     internal recursive back references, which allowed remote     attackers to cause a denial of service (segmentation     fault) or possibly have unspecified other impact via a     crafted regular expression, as demonstrated by a     JavaScript RegExp object encountered by Konqueror     (bsc#957567).

  - bsc#957598: Various security issues 

  - CVE-2015-8381: Heap Overflow in compile_regex()     (bsc#957598).

  - CVE-2015-8382: Regular Expression Uninitialized Pointer     Information Disclosure Vulnerability     (ZDI-CAN-2547)(bsc#957598).

  - CVE-2015-8383: Buffer overflow caused by repeated     conditional group(bsc#957598).

  - CVE-2015-8384: Buffer overflow caused by recursive back     reference by name within certain group(bsc#957598).

  - CVE-2015-8385: Buffer overflow caused by forward     reference by name to certain group(bsc#957598).

  - CVE-2015-8386: Buffer overflow caused by lookbehind     assertion(bsc#957598).

  - CVE-2015-8387: Integer overflow in subroutine     calls(bsc#957598).

  - CVE-2015-8388: Buffer overflow caused by certain     patterns with an unmatched closing     parenthesis(bsc#957598).

  - CVE-2015-8389: Infinite recursion in JIT compiler when     processing certain patterns(bsc#957598).

  - CVE-2015-8390: Reading from uninitialized memory when     processing certain patterns(bsc#957598).

  - CVE-2015-8391: Some pathological patterns causes     pcre_compile() to run for a very long time(bsc#957598).

  - CVE-2015-8392: Buffer overflow caused by certain     patterns with duplicated named groups(bsc#957598).

  - CVE-2015-8393: Information leak when running pcgrep -q     on crafted binary(bsc#957598).

  - CVE-2015-8394: Integer overflow caused by missing check     for certain conditions(bsc#957598).

  - CVE-2015-8395: Buffer overflow caused by certain     references(bsc#957598).

  - CVE-2015-2328: PCRE mishandled the /((?(R)a|(?1)))+/     pattern and related patterns with certain recursion,     which allowed remote attackers to cause a denial of     service (segmentation fault) or possibly have     unspecified other impact via a crafted regular     expression (bsc#957600).

  - CVE-2016-1283: The pcre_compile2 function in     pcre_compile.c in PCRE mishandled certain patterns with     named subgroups, which allowed remote attackers to cause     a denial of service (heap-based buffer overflow) or     possibly have unspecified other impact via a crafted     regular expression (bsc#960837).

  - CVE-2016-3191: The compile_branch function in     pcre_compile.c in pcre2_compile.c mishandled patterns     containing an (*ACCEPT) substring in conjunction with     nested parentheses, which allowed remote attackers to     execute arbitrary code or cause a denial of service     (stack-based buffer overflow) via a crafted regular     expression (bsc#971741).

These non-security issues were fixed :

  - JIT compiler improvements

  - performance improvements

  - The Unicode data tables have been updated to Unicode     7.0.0.

This update was imported from the SUSE:SLE-12:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
93343	Tenable SecurityCenter < 5.3.0の複数の脆弱性（TNS-2016-04）	Nessus	Misc.	2016/9/6	2020/10/9	medium
193833	RHEL 6 / 7 : rh-mariadb100-mariadb (RHSA-2016:1132)	Nessus	Red Hat Local Security Checks	2024/4/24	2025/4/15	critical
289083	MiracleLinux 4 : rh-mariadb100-mariadb-10.0.25-4.AXS4 (AXSA:2016-462:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
89641	Fedora 22 : mingw-pcre-8.38-1.fc22 (2016-f59a8ff5d0)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	critical
95534	SUSE SLED12 / SLES12 Security Update : pcre (SUSE-SU-2016:2971-1)	Nessus	SuSE Local Security Checks	2016/12/5	2026/1/15	critical
95915	SUSE SLED12 / SLES12 Security Update : pcre (SUSE-SU-2016:3161-1)	Nessus	SuSE Local Security Checks	2016/12/16	2026/1/8	critical
88694	PHP 5.6.x < 5.6.18 Multiple Vulnerabilities	Nessus	CGI abuses	2016/2/11	2025/5/26	critical
89647	Fedora 23 : mingw-pcre-8.38-1.fc23 (2016-fd1199dbe2)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	critical
91983	GLSA-201607-02 : libpcre: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2016/7/11	2021/1/11	critical
93343	Tenable SecurityCenter < 5.3.0 Multiple Vulnerabilities (TNS-2016-04)	Nessus	Misc.	2016/9/6	2020/10/9	medium
89447	Fedora 22 : pcre-8.38-1.fc22 (2015-eb896290d3)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	high
90306	Ubuntu 14.04 LTS : PCRE vulnerabilities (USN-2943-1)	Nessus	Ubuntu Local Security Checks	2016/4/1	2024/8/27	critical
88671	FreeBSD : php -- multiple vulnerabilities (85eb4e46-cf16-11e5-840f-485d605f4717)	Nessus	FreeBSD Local Security Checks	2016/2/10	2021/1/4	critical
88693	PHP 5.5.x < 5.5.32 Multiple Vulnerabilities	Nessus	CGI abuses	2016/2/11	2025/5/26	critical
88695	PHP 7.0.x < 7.0.3 Multiple Vulnerabilities	Nessus	CGI abuses	2016/2/11	2026/1/22	critical
92667	F5 Networks BIG-IP : Multiple PCRE vulnerabilities (K20225390)	Nessus	F5 Networks Local Security Checks	2016/8/2	2026/1/29	critical
95754	openSUSE Security Update : pcre (openSUSE-2016-1448)	Nessus	SuSE Local Security Checks	2016/12/13	2026/1/14	critical

检测

插件搜索

medium

critical

critical

critical

critical

critical

critical

critical

critical

medium

high

critical

critical

critical

critical

critical

critical