According to the versions of the c-ares package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in c-ares. A hostname with an     escaped trailing dot (such as 'hello\\.') would have     its size calculated incorrectly, leading to a single     byte written beyond the end of a buffer on the heap. An     attacker able to provide such a hostname to an     application using c-ares, could potentially cause that     application to crash.(CVE-2016-5180)

  - The c-ares function `ares_parse_naptr_reply()`, which     is used for parsing NAPTR responses, could be triggered     to read memory outside of the given input buffer if the     passed in DNS response packet was crafted in a     particular way.(CVE-2017-1000381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the c-ares packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in c-ares. A hostname with an     escaped trailing dot (such as 'hello\.') would have its     size calculated incorrectly, leading to a single byte     written beyond the end of a buffer on the heap. An     attacker able to provide such a hostname to an     application using c-ares, could potentially cause that     application to crash.(CVE-2016-5180)

  - The c-ares function `ares_parse_naptr_reply()`, which     is used for parsing NAPTR responses, could be triggered     to read memory outside of the given input buffer if the     passed in DNS response packet was crafted in a     particular way.(CVE-2017-1000381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4796-1 advisory.

    Alexander Minozhenko and James Bunton discovered that Node.js did not properly handle wildcards in name     fields of X.509 TLS certificates. An attacker could use this vulnerability to execute a machine-in-the-     middle- attack. This issue only affected Ubuntu 14.04 ESM and 16.04 ESM. (CVE-2016-7099)

    It was discovered that Node.js incorrectly handled certain NAPTR responses. A remote attacker could     possibly use this issue to cause applications using Node.js to crash, resulting in a denial of service.
    This issue only affected Ubuntu 16.04 ESM. (CVE-2017-1000381)

    Nikita Skovoroda discovered that Node.js mishandled certain input, leading to an out of bounds write. An     attacker could use this vulnerability to cause a denial of service (crash) or possibly execute arbitrary     code. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-12115)

    Arkadiy Tetelman discovered that Node.js improperly handled certain malformed HTTP requests. An attacker     could use this vulnerability to inject unexpected HTTP requests. This issue only affected Ubuntu 18.04     ESM. (CVE-2018-12116)

    Jan Maybach discovered that Node.js did not time out if incomplete HTTP/HTTPS headers were received. An     attacker could use this vulnerability to cause a denial of service by keeping HTTP/HTTPS connections alive     for a long period of time. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-12122)

    Martin Bajanik discovered that the url.parse() method would return incorrect results if it received     specially crafted input. An attacker could use this vulnerability to spoof the hostname and bypass     hostname-specific security controls. This issue only affected Ubuntu 18.04 ESM. (CVE-2018-12123)

    It was discovered that Node.js is vulnerable to a DNS rebinding attack which could be exploited to perform     remote code execution. An attack is possible from malicious websites open in a web browser with network     access to the system running the Node.js process. This issue only affected Ubuntu 18.04 ESM.
    (CVE-2018-7160)

    It was discovered that the Buffer.fill() and Buffer.alloc() methods improperly handled certain inputs. An     attacker could use this vulnerability to cause a denial of service. This issue only affected Ubuntu 18.04     ESM. (CVE-2018-7167)

    Marco Pracucci discovered that Node.js mishandled HTTP and HTTPS connections. An attacker could use this     vulnerability to cause a denial of service. This issue only affected Ubuntu 18.04 ESM. (CVE-2019-5737)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libcares2 fixes the following issues :

  - CVE-2017-1000381: A NAPTR parser out of bounds access     was fixed that could lead to crashes. (bsc#1044946)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New version, security fix for CVE-2017-1000381.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the c package has been released.

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.10.8 / 16.1.6.1 / 17.1.3 / 17.5.1.2. It is, therefore, affected by a vulnerability as referenced in the K000149130 advisory.

    The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be     triggered to read memory outside of the given input buffer if the passed in DNS response packet was     crafted in a particular way.(CVE-2017-1000381)

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

- CVE-2017-1000381: c-ares NAPTR parser out of bounds     access

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

[Security update](https://nodejs.org/en/blog/vulnerability/july-2017-security-re leases/)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs4 and nodejs6 fixes the following issues:
Security issues fixed :

  - CVE-2017-1000381: The c-ares function     ares_parse_naptr_reply() could be triggered to read     memory outside of the given input buffer if the passed     in DNS response packet was crafted in a particular way.
    (bsc#1044946)

  - CVE-2017-11499: Disable V8 snapshots. The hashseed     embedded in the snapshot is currently the same for all     runs of the binary. This opens node up to collision     attacks which could result in a Denial of Service. We     have temporarily disabled snapshots until a more robust     solution is found. (bsc#1048299) Non-security fixes :

  - GCC 7 compilation fixes for v8 backported and add     missing ICU59 headers (bsc#1041282)

  - New upstream LTS release 6.11.1     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V6.md#6 .11.1

  - New upstream LTS release 6.11.0     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V6.md#6 .11.0

  - New upstream LTS release 6.10.3     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V6.md#6 .10.3

  - New upstream LTS release 6.10.2     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V6.md#6 .10.2

  - New upstream LTS release 6.10.1     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V6.md#6 .10.1

  - New upstream LTS release 6.10.0     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V6.md#6 .10.0

  - New upstream LTS release 4.8.4     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V4.md#4 .8.4

  - New upstream LTS release 4.8.3     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V4.md#4 .8.3

  - New upstream LTS release 4.8.2     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V4.md#4 .8.2

  - New upstream LTS release 4.8.1     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V4.md#4 .8.1

  - New upstream LTS release 4.8.0     https://github.com/nodejs/node/blob/master/doc/changelog     s/CHANGELOG_V4.md#4 .8.0

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be     triggered to read memory outside of the given input buffer if the passed in DNS response packet was     crafted in a particular way. (CVE-2017-1000381)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
128953	EulerOS Virtualization for ARM 64 3.0.2.0 : c-ares (EulerOS-SA-2019-1950)	Nessus	Huawei Local Security Checks	2019/9/17	2024/4/25	critical
129210	EulerOS 2.0 SP3 : c-ares (EulerOS-SA-2019-2017)	Nessus	Huawei Local Security Checks	2019/9/24	2024/4/23	critical
183156	Ubuntu 16.04 ESM / 18.04 ESM : Node.js vulnerabilities (USN-4796-1)	Nessus	Ubuntu Local Security Checks	2023/10/16	2025/9/3	high
101290	SUSE SLED12 / SLES12 Security Update : libcares2 (SUSE-SU-2017:1792-1)	Nessus	SuSE Local Security Checks	2017/7/7	2025/12/12	high
102098	Fedora 25 : mingw-c-ares (2017-05254795cf)	Nessus	Fedora Local Security Checks	2017/8/2	2025/12/4	high
202837	Photon OS 1.0: C PHSA-2017-0038	Nessus	PhotonOS Local Security Checks	2024/7/22	2024/7/22	high
242562	F5 Networks BIG-IP : c-ares vulnerability (K000149130)	Nessus	F5 Networks Local Security Checks	2025/7/22	2025/10/16	high
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	2023/6/30	2023/7/6	critical
101096	Fedora 25 : c-ares (2017-ba1399832b)	Nessus	Fedora Local Security Checks	2017/6/29	2025/12/15	high
102001	Fedora 25 : 1:nodejs (2017-81522ac6d8)	Nessus	Fedora Local Security Checks	2017/7/27	2025/12/9	high
120002	SUSE SLES12 Security Update : nodejs4, nodejs6 (SUSE-SU-2017:2168-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	high
220312	Linux Distros Unpatched Vulnerability : CVE-2017-1000381	Nessus	Misc.	2025/3/4	2025/9/14	high

检测

插件搜索

critical

critical

high

high

high

high

high

critical

high

high

high

high