The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3092 advisory.

    - CVE-2017-16997: Correctly handle DT_RPATH (#1540480).
    - CVE-2018-11237: AVX-512 mempcpy for KNL buffer overflow (#1579809)
    - CVE-2018-11236: Path length overflow in realpath (#1579742)
    - CVE-2018-6485: Integer overflow in posix_memalign in memalign (#1548002)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of 'ruby', 'glibc' packages of Photon OS has been released.

According to the version of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - elf/dl-load.c in the GNU C Library (aka glibc or libc6)     2.19 through 2.26 mishandles RPATH and RUNPATH     containing $ORIGIN for a privileged (setuid or     AT_SECURE) program, which allows local users to gain     privileges via a Trojan horse library in the current     working directory, related to the fillin_rpath and     decompose_rpath functions. This is associated with     misinterpretion of an empty RPATH/RUNPATH token as the     './' directory. NOTE: this configuration of     RPATH/RUNPATH for a privileged program is apparently     very uncommon most likely, no such program is shipped     with any common Linux distribution.i1/4^CVE-2017-16997i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following issues :

  - A privilege escalation bug in the realpath() function     has been fixed. [CVE-2018-1000001, bsc#1074293]

  - A memory leak and a buffer overflow in the dynamic ELF     loader has been fixed. [CVE-2017-1000408,     CVE-2017-1000409, bsc#1071319]

  - An issue in the code handling RPATHs was fixed that     could have been exploited by an attacker to execute code     loaded from arbitrary libraries. [CVE-2017-16997,     bsc#1073231]

  - A potential crash caused by a use-after-free bug in     pthread_create() has been fixed. [bsc#1053188]

  - A bug that prevented users to build shared objects which     use the optimized libmvec.so API has been fixed.
    [bsc#1070905]

  - A memory leak in the glob() function has been fixed.
    [CVE-2017-15670, CVE-2017-15671, CVE-2017-15804,     bsc#1064569, bsc#1064580, bsc#1064583]

  - A bug that would lose the syscall error code value in     case of crashes has been fixed. [bsc#1063675]

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3534-1 advisory.

    It was discovered that the GNU C library did not properly handle all of the possible return values from     the kernel getcwd(2) syscall. A local attacker could potentially exploit this to execute arbitrary code in     setuid programs and gain administrative privileges. (CVE-2018-1000001)

    A memory leak was discovered in the _dl_init_paths() function in the GNU C library dynamic loader. A local     attacker could potentially exploit this with a specially crafted value in the LD_HWCAP_MASK environment     variable, in combination with CVE-2017-1000409 and another vulnerability on a system with hardlink     protections disabled, in order to gain administrative privileges. (CVE-2017-1000408)

    A heap-based buffer overflow was discovered in the _dl_init_paths() function in the GNU C library dynamic     loader. A local attacker could potentially exploit this with a specially crafted value in the     LD_LIBRARY_PATH environment variable, in combination with CVE-2017-1000408 and another vulnerability on a     system with hardlink protections disabled, in order to gain administrative privileges. (CVE-2017-1000409)

    An off-by-one error leading to a heap-based buffer overflow was discovered in the GNU C library glob()     implementation. An attacker could potentially exploit this to cause a denial of service or execute     arbitrary code via a maliciously crafted pattern. (CVE-2017-15670)

    A heap-based buffer overflow was discovered during unescaping of user names with the ~ operator in the GNU     C library glob() implementation. An attacker could potentially exploit this to cause a denial of service     or execute arbitrary code via a maliciously crafted pattern. (CVE-2017-15804)

    It was discovered that the GNU C library dynamic loader mishandles RPATH and RUNPATH containing $ORIGIN     for privileged (setuid or AT_SECURE) programs. A local attacker could potentially exploit this by     providing a specially crafted library in the current working directory in order to gain administrative     privileges. (CVE-2017-16997)

    It was discovered that the GNU C library malloc() implementation could return a memory block that is too     small if an attempt is made to allocate an object whose size is close to SIZE_MAX, resulting in a heap-     based overflow. An attacker could potentially exploit this to cause a denial of service or execute     arbitrary code. This issue only affected Ubuntu 17.10. (CVE-2017-17426)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of {'ruby', 'glibc'} packages of Photon OS has been released.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3092 advisory.

  - glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary     libraries (CVE-2017-16997)

  - glibc: Integer overflow in posix_memalign in memalign functions (CVE-2018-6485)

  - glibc: Integer overflow in stdlib/canonicalize.c on 32-bit architectures leading to stack-based buffer     overflow (CVE-2018-11236)

  - glibc: Buffer overflow in __mempcpy_avx512_no_vzeroupper (CVE-2018-11237)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - elf/dl-load.c in the GNU C Library (aka glibc or libc6)     2.19 through 2.26 mishandles RPATH and RUNPATH     containing $ORIGIN for a privileged (setuid or     AT_SECURE) program, which allows local users to gain     privileges via a Trojan horse library in the current     working directory, related to the fillin_rpath and     decompose_rpath functions. This is associated with     misinterpretion of an empty RPATH/RUNPATH token as the     './' directory. NOTE: this configuration of     RPATH/RUNPATH for a privileged program is apparently     very uncommon most likely, no such program is shipped     with any common Linux distribution(CVE-2017-16997)

  - Stack-based buffer overflow in the clntudp_call     function in sunrpc/clnt_udp.c in the GNU C Library (aka     glibc or libc6) allows remote servers to cause a denial     of service (crash) or possibly unspecified other impact     via a flood of crafted ICMP and UDP     packets.(CVE-2016-4429)

  - Integer overflow in the strxfrm function in the GNU C     Library (aka glibc or libc6) before 2.21 allows     context-dependent attackers to cause a denial of     service (crash) or possibly execute arbitrary code via     a long string, which triggers a stack-based buffer     overflow.(CVE-2015-8982)

  - A buffer overflow has been discovered in the GNU C     Library (aka glibc or libc6) in the
    __mempcpy_avx512_no_vzeroupper function when particular     conditions are met. An attacker could use this     vulnerability to cause a denial of service or     potentially execute code.(CVE-2018-11237)

  - The posix_spawn_file_actions_addopen function in glibc     before 2.20 does not copy its path argument in     accordance with the POSIX specification, which allows     context-dependent attackers to trigger use-after-free     vulnerabilities.(CVE-2014-4043)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3623:01 advisory.

    * glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary     libraries (CVE-2017-16997)
      * glibc: Integer overflow in posix_memalign in memalign functions (CVE-2018-6485)
      * glibc: Integer overflow in stdlib/canonicalize.c on 32-bit architectures leading to stack-based buffer     overflow (CVE-2018-11236)
      * glibc: Buffer overflow in __mempcpy_avx512_no_vzeroupper (CVE-2018-11237)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has glibc packages installed that are affected by multiple vulnerabilities:

  - The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to     cause a denial of service (out-of-bounds read and crash) via 64 bytes of input. (CVE-2016-6261)

  - The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent     attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.
    (CVE-2016-6263)

  - A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the     LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this     issue if patched for CVE-2017-1000366. (CVE-2017-1000408)

  - A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the     LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this     issue if patched for CVE-2017-1000366. (CVE-2017-1000409)

  - Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote     attackers to cause a denial of service or possibly have unspecified other impact. (CVE-2017-14062)

  - The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based     buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~     operator followed by a long string. (CVE-2017-15670)

  - The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer     overflow during unescaping of user names with the ~ operator. (CVE-2017-15804)

  - elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH     containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain     privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and     decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the     ./ directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very     uncommon; most likely, no such program is shipped with any common Linux distribution. (CVE-2017-16997)

  - The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too     small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to     a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code     path that lacks an integer overflow check. (CVE-2017-17426)

  - An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S     in the GNU C Library (aka glibc or libc6) 2.21 through 2.27 does not correctly perform the overlapping     memory check if the source memory range spans the middle of the address space, resulting in corrupt data     being produced by the copy operation. This may disclose information to context-dependent attackers, or     result in a denial of service, or, possibly, code execution. (CVE-2017-18269)

  - In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to     write before the destination buffer leading to a buffer underflow and potential code execution.
    (CVE-2018-1000001)

  - stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very     long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit     architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.
    (CVE-2018-11236)

  - An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27     and earlier may write data beyond the target buffer, leading to a buffer overflow in
    __mempcpy_avx512_no_vzeroupper. (CVE-2018-11237)

  - In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via     getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the     if_nametoindex() function. (CVE-2018-19591)

  - In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-     based buffer over-read via an attempted case-insensitive regular-expression match. (CVE-2019-9169)

  - The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range     reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when     passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to     sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. (CVE-2020-10029)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A buffer overflow has been discovered in the GNU C Library (aka glibc or libc6) in the __mempcpy_avx512_no_vzeroupper function when particular conditions are met. An attacker could use this vulnerability to cause a denial of service or potentially execute code.(CVE-2018-11237)

elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and decompose_rpath functions.
This is associated with misinterpretion of an empty RPATH/RUNPATH token as the './' directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very uncommon; most likely, no such program is shipped with any common Linux distribution.(CVE-2017-16997)

stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.(CVE-2018-11236)

An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.(CVE-2018-6485)

This update for glibc fixes the following issues :

  - A privilege escalation bug in the realpath() function     has been fixed. [CVE-2018-1000001, bsc#1074293]

  - A memory leak and a buffer overflow in the dynamic ELF     loader has been fixed. [CVE-2017-1000408,     CVE-2017-1000409, bsc#1071319]

  - An issue in the code handling RPATHs was fixed that     could have been exploited by an attacker to execute code     loaded from arbitrary libraries. [CVE-2017-16997,     bsc#1073231]

  - A potential crash caused by a use-after-free bug in     pthread_create() has been fixed. [bsc#1053188]

  - A bug that prevented users to build shared objects which     use the optimized libmvec.so API has been fixed.
    [bsc#1070905]

  - A memory leak in the glob() function has been fixed.
    [CVE-2017-15670, CVE-2017-15671, CVE-2017-15804,     bsc#1064569, bsc#1064580, bsc#1064583]

  - A bug that would lose the syscall error code value in     case of crashes has been fixed. [bsc#1063675]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update addresses two security vulnerabilities :

  - CVE-2017-16997: Check for empty tokens before dynamic     string token expansion in the dynamic linker, so that     pre-existing privileged programs with `$ORIGIN`     rpaths/runpaths do not cause the dynamic linker to     search the current directory, potentially leading to     privilege escalation. (RHBZ#1526866).

  - CVE-2018-1000001: `getcwd` would sometimes return a     non-absolute path, confusing the `realpath` function,     leading to privilege escalation in conjunction with user     namespaces. (RHBZ#1533837) 

In addition, this update changes the thread stack size accounting to provide additional stack space compared to previous glibc versions.
For some applications (`nptd` in particular), the `PTHREAD_STACK_MIN` stack size was too small on x86-64 machines with AVX-512 support (RHBZ#1527887).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update addresses two security vulnerabilities :

  - CVE-2017-15670, CVE-2017-15671, CVE-2017-15804: Various     vulnerabilities could lead to memory corruption in the     `glob` and `glob64` function. (RHBZ#1505298,     RHBZ##1504807)

  - CVE-2017-16997: Check for empty tokens before dynamic     string token expansion in the dynamic linker, so that     pre-existing privileged programs with `$ORIGIN`     rpaths/runpaths do not cause the dynamic linker to     search the current directory, potentially leading to     privilege escalation. (RHBZ#1526866).

  - CVE-2018-1000001: `getcwd` would sometimes return a     non-absolute path, confusing the `realpath` function,     leading to privilege escalation in conjunction with user     namespaces. (RHBZ#1533837) 

In addition, this update replaces the dynamic linker trampoline on x86-64 with a version which uses the `XSAVE` instruction if it is available. This improves compatibility with future hardware and compilers which do not follow the x86-64 ABI. This update also adjusts the thread stack size accounting to provide additional stack space compared to previous glibc versions (to avoid introducing RHBZ#1527887).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.06, has glibc packages installed that are affected by multiple vulnerabilities:

  - The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It     may use the notification thread attributes object (passed through its struct sigevent parameter) after it     has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified     other impact. (CVE-2021-33574)

  - elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH     containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain     privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and     decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the     ./ directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very     uncommon; most likely, no such program is shipped with any common Linux distribution. (CVE-2017-16997)

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to     cause a denial of service (out-of-bounds read and crash) via 64 bytes of input. (CVE-2016-6261)

  - The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent     attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.
    (CVE-2016-6263)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
180807	Oracle Linux 7 : glibc (ELSA-2018-3092)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	critical
111910	Photon OS 1.0: Glibc / Ruby PHSA-2018-1.0-0098-(a) (deprecated)	Nessus	PhotonOS Local Security Checks	2018/8/17	2019/4/5	high
123725	EulerOS Virtualization 2.5.3 : glibc (EulerOS-SA-2019-1257)	Nessus	Huawei Local Security Checks	2019/4/4	2024/6/5	high
124749	EulerOS Virtualization 2.5.4 : glibc (EulerOS-SA-2019-1371)	Nessus	Huawei Local Security Checks	2019/5/10	2024/5/24	high
106059	openSUSE Security Update : glibc (openSUSE-2018-30)	Nessus	SuSE Local Security Checks	2018/1/16	2025/11/3	critical
106134	Ubuntu 14.04 LTS / 16.04 LTS : GNU C Library vulnerabilities (USN-3534-1)	Nessus	Ubuntu Local Security Checks	2018/1/18	2025/9/3	critical
111281	Photon OS 2.0 : ruby / glibc (PhotonOS-PHSA-2018-2.0-0011-(a)) (deprecated)	Nessus	PhotonOS Local Security Checks	2018/7/24	2019/4/5	high
118527	RHEL 7 : glibc (RHSA-2018:3092)	Nessus	Red Hat Local Security Checks	2018/10/31	2024/4/27	critical
126294	EulerOS 2.0 SP5 : glibc (EulerOS-SA-2019-1667)	Nessus	Huawei Local Security Checks	2019/6/27	2025/11/20	high
288990	MiracleLinux 7 : glibc-2.17-260.el7 (AXSA:2019-3623:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
147282	NewStart CGSL MAIN 6.02 : glibc Multiple Vulnerabilities (NS-SA-2021-0053)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2022/5/10	critical
119468	Amazon Linux AMI : glibc (ALAS-2018-1109)	Nessus	Amazon Linux Local Security Checks	2018/12/7	2024/7/17	critical
106044	SUSE SLED12 / SLES12 Security Update : glibc (SUSE-SU-2018:0074-1)	Nessus	SuSE Local Security Checks	2018/1/15	2025/11/3	critical
106279	Fedora 27 : glibc (2018-7714b514e2)	Nessus	Fedora Local Security Checks	2018/1/24	2025/10/31	high
106281	Fedora 26 : glibc (2018-8e27ad96ed)	Nessus	Fedora Local Security Checks	2018/1/24	2025/10/31	critical
266254	NewStart CGSL MAIN 6.06 : glibc Multiple Vulnerabilities (NS-SA-2025-0229)	Nessus	NewStart CGSL Local Security Checks	2025/9/30	2025/9/30	critical

检测

插件搜索

critical

high

high

high

critical

critical

high

critical

high

critical

critical

critical

critical

high

critical

critical