Security Fix(es) :

  - glibc: Incorrect handling of RPATH in elf/dl-load.c can     be used to execute code loaded from arbitrary libraries     (CVE-2017-16997)

  - glibc: Integer overflow in posix_memalign in memalign     functions (CVE-2018-6485)

  - glibc: Integer overflow in stdlib/canonicalize.c on     32-bit architectures leading to stack-based buffer     overflow (CVE-2018-11236)

  - glibc: Buffer overflow in __mempcpy_avx512_no_vzeroupper     (CVE-2018-11237)

An update for glibc is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es) :

* glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary libraries (CVE-2017-16997)

* glibc: Integer overflow in posix_memalign in memalign functions (CVE-2018-6485)

* glibc: Integer overflow in stdlib/canonicalize.c on 32-bit architectures leading to stack-based buffer overflow (CVE-2018-11236)

* glibc: Buffer overflow in __mempcpy_avx512_no_vzeroupper (CVE-2018-11237)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3092 advisory.

    - CVE-2017-16997: Correctly handle DT_RPATH (#1540480).
    - CVE-2018-11237: AVX-512 mempcpy for KNL buffer overflow (#1579809)
    - CVE-2018-11236: Path length overflow in realpath (#1579742)
    - CVE-2018-6485: Integer overflow in posix_memalign in memalign (#1548002)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - elf/dl-load.c in the GNU C Library (aka glibc or libc6)     2.19 through 2.26 mishandles RPATH and RUNPATH     containing $ORIGIN for a privileged (setuid or     AT_SECURE) program, which allows local users to gain     privileges via a Trojan horse library in the current     working directory, related to the fillin_rpath and     decompose_rpath functions. This is associated with     misinterpretion of an empty RPATH/RUNPATH token as the     './' directory. NOTE: this configuration of     RPATH/RUNPATH for a privileged program is apparently     very uncommon most likely, no such program is shipped     with any common Linux distribution.i1/4^CVE-2017-16997i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following issues :

  - A privilege escalation bug in the realpath() function     has been fixed. [CVE-2018-1000001, bsc#1074293]

  - A memory leak and a buffer overflow in the dynamic ELF     loader has been fixed. [CVE-2017-1000408,     CVE-2017-1000409, bsc#1071319]

  - An issue in the code handling RPATHs was fixed that     could have been exploited by an attacker to execute code     loaded from arbitrary libraries. [CVE-2017-16997,     bsc#1073231]

  - A potential crash caused by a use-after-free bug in     pthread_create() has been fixed. [bsc#1053188]

  - A bug that prevented users to build shared objects which     use the optimized libmvec.so API has been fixed.
    [bsc#1070905]

  - A memory leak in the glob() function has been fixed.
    [CVE-2017-15670, CVE-2017-15671, CVE-2017-15804,     bsc#1064569, bsc#1064580, bsc#1064583]

  - A bug that would lose the syscall error code value in     case of crashes has been fixed. [bsc#1063675]

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3534-1 advisory.

    It was discovered that the GNU C library did not properly handle all of the possible return values from     the kernel getcwd(2) syscall. A local attacker could potentially exploit this to execute arbitrary code in     setuid programs and gain administrative privileges. (CVE-2018-1000001)

    A memory leak was discovered in the _dl_init_paths() function in the GNU C library dynamic loader. A local     attacker could potentially exploit this with a specially crafted value in the LD_HWCAP_MASK environment     variable, in combination with CVE-2017-1000409 and another vulnerability on a system with hardlink     protections disabled, in order to gain administrative privileges. (CVE-2017-1000408)

    A heap-based buffer overflow was discovered in the _dl_init_paths() function in the GNU C library dynamic     loader. A local attacker could potentially exploit this with a specially crafted value in the     LD_LIBRARY_PATH environment variable, in combination with CVE-2017-1000408 and another vulnerability on a     system with hardlink protections disabled, in order to gain administrative privileges. (CVE-2017-1000409)

    An off-by-one error leading to a heap-based buffer overflow was discovered in the GNU C library glob()     implementation. An attacker could potentially exploit this to cause a denial of service or execute     arbitrary code via a maliciously crafted pattern. (CVE-2017-15670)

    A heap-based buffer overflow was discovered during unescaping of user names with the ~ operator in the GNU     C library glob() implementation. An attacker could potentially exploit this to cause a denial of service     or execute arbitrary code via a maliciously crafted pattern. (CVE-2017-15804)

    It was discovered that the GNU C library dynamic loader mishandles RPATH and RUNPATH containing $ORIGIN     for privileged (setuid or AT_SECURE) programs. A local attacker could potentially exploit this by     providing a specially crafted library in the current working directory in order to gain administrative     privileges. (CVE-2017-16997)

    It was discovered that the GNU C library malloc() implementation could return a memory block that is too     small if an attempt is made to allocate an object whose size is close to SIZE_MAX, resulting in a heap-     based overflow. An attacker could potentially exploit this to cause a denial of service or execute     arbitrary code. This issue only affected Ubuntu 17.10. (CVE-2017-17426)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201804-02 (glibc: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in glibc. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker could possibly execute arbitrary code, escalate privileges,       cause a Denial of Service condition, or have other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

An update of the glibc package has been released.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has glibc packages installed that are affected by multiple vulnerabilities:

  - An integer overflow in the implementation of the     posix_memalign in memalign functions in the GNU C     Library (aka glibc or libc6) 2.26 and earlier could     cause these functions to return a pointer to a heap area     that is too small, potentially leading to heap     corruption. (CVE-2018-6485)

  - elf/dl-load.c in the GNU C Library (aka glibc or libc6)     2.19 through 2.26 mishandles RPATH and RUNPATH     containing $ORIGIN for a privileged (setuid or     AT_SECURE) program, which allows local users to gain     privileges via a Trojan horse library in the current     working directory, related to the fillin_rpath and     decompose_rpath functions. This is associated with     misinterpretion of an empty RPATH/RUNPATH token as the     ./ directory. NOTE: this configuration of     RPATH/RUNPATH for a privileged program is apparently     very uncommon; most likely, no such program is shipped     with any common Linux distribution. (CVE-2017-16997)

  - A buffer overflow has been discovered in the GNU C     Library (aka glibc or libc6) in the
    __mempcpy_avx512_no_vzeroupper function when particular     conditions are met. An attacker could use this     vulnerability to cause a denial of service or     potentially execute code. (CVE-2018-11237)

  - stdlib/canonicalize.c in the GNU C Library (aka glibc or     libc6) 2.27 and earlier, when processing very long     pathname arguments to the realpath function, could     encounter an integer overflow on 32-bit architectures,     leading to a stack-based buffer overflow and,     potentially, arbitrary code execution. (CVE-2018-11236)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - stdlib/canonicalize.c in the GNU C Library (aka glibc     or libc6) 2.27 and earlier, when processing very long     pathname arguments to the realpath function, could     encounter an integer overflow on 32-bit architectures,     leading to a stack-based buffer overflow and,     potentially, arbitrary code execution.(CVE-2018-11236)

  - An AVX-512-optimized implementation of the mempcpy     function in the GNU C Library (aka glibc or libc6) 2.27     and earlier may write data beyond the target buffer,     leading to a buffer overflow in
    __mempcpy_avx512_no_vzeroupper.(CVE-2018-11237)

  - elf/dl-load.c in the GNU C Library (aka glibc or libc6)     2.19 through 2.26 mishandles RPATH and RUNPATH     containing $ORIGIN for a privileged (setuid or     AT_SECURE) program, which allows local users to gain     privileges via a Trojan horse library in the current     working directory, related to the fillin_rpath and     decompose_rpath functions. This is associated with     misinterpretion of an empty RPATH/RUNPATH token as the     './' directory. NOTE: this configuration of     RPATH/RUNPATH for a privileged program is apparently     very uncommon most likely, no such program is shipped     with any common Linux distribution.(CVE-2017-16997)

  - A heap-based buffer overflow was found in glibc's
    __nss_hostname_digits_dots() function, which is used by     the gethostbyname() and gethostbyname2() glibc function     calls. A remote attacker able to make an application     call either of these functions could use this flaw to     execute arbitrary code with the permissions of the user     running the application.(CVE-2015-0235)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has glibc packages installed that are affected by multiple vulnerabilities:

  - The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It     may use the notification thread attributes object (passed through its struct sigevent parameter) after it     has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified     other impact. (CVE-2021-33574)

  - elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH     containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain     privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and     decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the     ./ directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very     uncommon; most likely, no such program is shipped with any common Linux distribution. (CVE-2017-16997)

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to     cause a denial of service (out-of-bounds read and crash) via 64 bytes of input. (CVE-2016-6261)

  - The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent     attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.
    (CVE-2016-6263)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH     containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain     privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and     decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the     ./ directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very     uncommon; most likely, no such program is shipped with any common Linux distribution. (CVE-2017-16997)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
119182	Scientific Linux Security Update : glibc on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	2018/11/27	2024/7/18	critical
118992	CentOS 7 : glibc (CESA-2018:3092)	Nessus	CentOS Local Security Checks	2018/11/16	2022/5/27	critical
180807	Oracle Linux 7 : glibc (ELSA-2018-3092)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	critical
124749	EulerOS Virtualization 2.5.4 : glibc (EulerOS-SA-2019-1371)	Nessus	Huawei Local Security Checks	2019/5/10	2024/5/24	high
123725	EulerOS Virtualization 2.5.3 : glibc (EulerOS-SA-2019-1257)	Nessus	Huawei Local Security Checks	2019/4/4	2024/6/5	high
106059	openSUSE Security Update : glibc (openSUSE-2018-30)	Nessus	SuSE Local Security Checks	2018/1/16	2025/11/3	critical
106134	Ubuntu 14.04 LTS / 16.04 LTS : GNU C Library vulnerabilities (USN-3534-1)	Nessus	Ubuntu Local Security Checks	2018/1/18	2025/9/3	critical
108822	GLSA-201804-02 : glibc: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2018/4/4	2024/11/21	critical
121798	Photon OS 1.0: Glibc PHSA-2018-1.0-0098-(a)	Nessus	PhotonOS Local Security Checks	2019/2/7	2024/6/21	high
121907	Photon OS 2.0: Glibc PHSA-2018-2.0-0011-(a)	Nessus	PhotonOS Local Security Checks	2019/2/7	2024/6/21	high
127214	NewStart CGSL CORE 5.04 / MAIN 5.04 : glibc Multiple Vulnerabilities (NS-SA-2019-0040)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2022/5/19	critical
124889	EulerOS Virtualization for ARM 64 3.0.1.0 : glibc (EulerOS-SA-2019-1386)	Nessus	Huawei Local Security Checks	2019/5/14	2022/5/20	critical
301225	NewStart CGSL MAIN 6.06 (SP) : glibc Multiple Vulnerabilities (NS-SA-2026-0027)	Nessus	NewStart CGSL Local Security Checks	2026/3/6	2026/3/9	critical
221057	Linux Distros Unpatched Vulnerability : CVE-2017-16997	Nessus	Misc.	2025/3/4	2026/8/10	high

检测

插件搜索

critical

critical

critical

high

high

critical

critical

critical

high

high

critical

critical

critical

high