This update for libcares2 fixes the following issues :

  - Add patch to fix single byte out of buffer write     (CVE-2016-5180, bsc#1007728)

This update was imported from the SUSE:SLE-12:Update update project.

This update for nodejs4 fixes the following issues: Security issues fixed :

  - CVE-2016-5180: c-ares: Fix for single-byte buffer     overwrite (bsc#1007728). Bug fixes :

  - bsc#1009011: npm4 should provide versioned nodejs-npm     and npm allowing nodejs-packaging to continue to     function properly in Leap 42.2

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs fixes the following issues :

  - New upstream LTS version 4.6.1

  - c-ares :

  + CVE-2016-5180: fix for single-byte buffer overwrite

  - Fix nodejs-libpath.patch so ppc doesn't fail to build

Security fix for CVE-2016-5180

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-28 (c-ares: Heap-based buffer overflow)

    A hostname with an escaped trailing dot (such as &ldquo;hello\\.&rdquo;) would       have its size calculated incorrectly leading to a single byte written       beyond the end of a buffer on the heap.
  Impact :

    A remote attacker, able to provide a specially crafted hostname to an       application using c-ares, could potentially cause a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

According to the versions of the c-ares package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in c-ares. A hostname with an     escaped trailing dot (such as 'hello\\.') would have     its size calculated incorrectly, leading to a single     byte written beyond the end of a buffer on the heap. An     attacker able to provide such a hostname to an     application using c-ares, could potentially cause that     application to crash.(CVE-2016-5180)

  - The c-ares function `ares_parse_naptr_reply()`, which     is used for parsing NAPTR responses, could be triggered     to read memory outside of the given input buffer if the     passed in DNS response packet was crafted in a     particular way.(CVE-2017-1000381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the c-ares packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in c-ares. A hostname with an     escaped trailing dot (such as 'hello\.') would have its     size calculated incorrectly, leading to a single byte     written beyond the end of a buffer on the heap. An     attacker able to provide such a hostname to an     application using c-ares, could potentially cause that     application to crash.(CVE-2016-5180)

  - The c-ares function `ares_parse_naptr_reply()`, which     is used for parsing NAPTR responses, could be triggered     to read memory outside of the given input buffer if the     passed in DNS response packet was crafted in a     particular way.(CVE-2017-1000381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0002 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    The following packages have been upgraded to a newer upstream version: rh-nodejs4-nodejs (4.6.2), rh-     nodejs4-http-parser (2.7.0). (BZ#1388097)

    Security Fix(es):

    * It was found that Node.js' tls.checkServerIdentity() function did not properly validate server     certificates containing wildcards. A malicious TLS server could use this flaw to get a specially crafted     certificate accepted by a Node.js TLS client. (CVE-2016-7099)

    * It was found that the V8 Zone class was vulnerable to integer overflow when allocating new memory     (Zone::New() and Zone::NewExpand()). An attacker with the ability to manipulate a large zone could crash     the application or, potentially, execute arbitrary code with the application privileges. (CVE-2016-1669)

    * A vulnerability was found in c-ares, a DNS resolver library bundled with Node.js. A hostname with an     escaped trailing dot would have its size calculated incorrectly, leading to a single byte written beyond     the end of a buffer on the heap. An attacker able to provide such a hostname to an application using     c-ares, could potentially cause that application to crash. (CVE-2016-5180)

    * It was found that the reason argument in ServerResponse#writeHead() was not properly validated. A remote     attacker could possibly use this flaw to conduct an HTTP response splitting attack via a specially-crafted     HTTP request. (CVE-2016-5325)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote     attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a     hostname with an escaped trailing dot. (CVE-2016-5180)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for libcares2 fixes the following issues :

  - ares_create_query() single byte out of buffer write     (CVE-2016-5180, boo#1007728)

This update for libcares2 fixes the following issues :

  - Add patch to fix single byte out of buffer write     (CVE-2016-5180, bsc#1007728)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10896:01 advisory.

    * CVE-2016-5180: fix heap-based buffer overflow in the ares_create_query     causing DoS     CVE(s):
    CVE-2016-5180     Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote     attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a     hostname with an escaped trailing dot.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Gzob Qq discovered that the query-building functions in c-ares, an asynchronous DNS request library would not correctly process crafted query names, resulting in a heap buffer overflow and potentially leading to arbitrary code execution.

Gzob Qq discovered that the query-building functions in c-ares, an asynchronous DNS request library would not correctly process crafted query names, resulting in a heap buffer overflow and potentially leading to arbitrary code execution.

For Debian 7 'Wheezy', these problems have been fixed in version 1.9.1-3+deb7u1.

We recommend that you upgrade your c-ares packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3143-1 advisory.

    Gzob Qq discovered that c-ares incorrectly handled certain hostnames. A remote attacker could use this     issue to cause applications using c-ares to crash, resulting in a denial of service, or possibly execute     arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
96379	openSUSE Security Update : libcares2 (openSUSE-2017-58)	Nessus	SuSE Local Security Checks	2017/1/10	2026/1/6	critical
119986	SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2016:2898-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	critical
94664	openSUSE Security Update : nodejs (openSUSE-2016-1277)	Nessus	SuSE Local Security Checks	2016/11/10	2026/1/19	critical
94805	Fedora 25 : mingw-c-ares (2016-4f34f26649)	Nessus	Fedora Local Security Checks	2016/11/15	2026/1/19	critical
96422	GLSA-201701-28 : c-ares: Heap-based buffer overflow	Nessus	Gentoo Local Security Checks	2017/1/12	2026/1/6	critical
128953	EulerOS Virtualization for ARM 64 3.0.2.0 : c-ares (EulerOS-SA-2019-1950)	Nessus	Huawei Local Security Checks	2019/9/17	2024/4/25	critical
129210	EulerOS 2.0 SP3 : c-ares (EulerOS-SA-2019-2017)	Nessus	Huawei Local Security Checks	2019/9/24	2024/4/23	critical
210197	RHEL 6 / 7 : rh-nodejs4-nodejs and rh-nodejs4-http-parser (RHSA-2017:0002)	Nessus	Red Hat Local Security Checks	2024/11/4	2024/11/5	critical
219557	Linux Distros Unpatched Vulnerability : CVE-2016-5180	Nessus	Misc.	2025/3/4	2025/9/29	critical
93920	Fedora 23 : mingw-c-ares (2016-66d9389548)	Nessus	Fedora Local Security Checks	2016/10/10	2026/1/22	critical
95463	openSUSE Security Update : libcares2 (openSUSE-2016-1373)	Nessus	SuSE Local Security Checks	2016/12/2	2026/1/15	critical
96255	SUSE SLED12 / SLES12 Security Update : libcares2 (SUSE-SU-2016:3286-1)	Nessus	SuSE Local Security Checks	2017/1/3	2026/1/6	critical
283193	MiracleLinux 7 : c-ares-1.10.0-3.1.0.1.el7.AXS7 (AXSA:2025-10896:01)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/13	critical
93836	Debian DSA-3682-1 : c-ares - security update	Nessus	Debian Local Security Checks	2016/10/4	2026/1/22	critical
93900	Debian DLA-648-1 : c-ares security update	Nessus	Debian Local Security Checks	2016/10/7	2026/1/22	critical
95428	Ubuntu 14.04 LTS / 16.04 LTS : c-ares vulnerability (USN-3143-1)	Nessus	Ubuntu Local Security Checks	2016/12/1	2024/8/27	critical
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	2023/6/30	2023/7/6	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical