The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3703 advisory.

  - libvorbis: heap buffer overflow in mapping0_forward function (CVE-2018-10392)

  - libvorbis: stack buffer overflow in bark_noise_hybridmp function (CVE-2018-10393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libvorbis packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - bark_noise_hybridmp in psy.c in Xiph.Org libvorbis     1.3.6 has a stack-based buffer     over-read.(CVE-2018-10393)

  - The bark_noise_hybridmp function in psy.c in Xiph.Org     libvorbis 1.3.5 allows remote attackers to cause a     denial of service (out-of-bounds access and application     crash) or possibly have unspecified other impact via a     crafted mp4 file.(CVE-2017-14160)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3703 advisory.

    The libvorbis package contains runtime libraries for use in programs that support Ogg Vorbis, a fully     open, non-proprietary, patent- and royalty-free, general-purpose compressed format for audio and music at     fixed and variable bitrates.

    Security Fix(es):

    * libvorbis: heap buffer overflow in mapping0_forward function (CVE-2018-10392)

    * libvorbis: stack buffer overflow in bark_noise_hybridmp function (CVE-2018-10393)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several issues have been found in libvorbis, a decoder library for Vorbis General Audio Compression Codec.

The fix for CVE-2017-14160 and CVE-2018-10393 improve the bound checking for very low sample rates.

CVE-2018-10392 was found because the number of channels was not validated and a remote attacker could cause a denial of service.

For Debian 8 'Jessie', these problems have been fixed in version 1.3.4-2+deb8u2.

We recommend that you upgrade your libvorbis packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New libvorbis packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.

According to the versions of the libvorbis package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - bark_noise_hybridmp in psy.c in Xiph.Org libvorbis     1.3.6 has a stack-based buffer     over-read.(CVE-2018-10393)

  - mapping0_forward in mapping0.c in Xiph.Org libvorbis     1.3.6 does not validate the number of channels, which     allows remote attackers to cause a denial of service     (heap-based buffer overflow or over-read) or possibly     have unspecified other impact via a crafted     file.(CVE-2018-10392)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.
    (CVE-2018-10393)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for libvorbis fixes the following issues :

Security issues fixed :

  - CVE-2018-10393: Fixed stack-based buffer over-read in     bark_noise_hybridm (bsc#1091072).

  - CVE-2017-14160: Fixed out-of-bounds access inside     bark_noise_hybridmp function (bsc#1059812).

This update was imported from the SUSE:SLE-12:Update update project.

According to the versions of the libvorbis package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - bark_noise_hybridmp in psy.c in Xiph.Org libvorbis     1.3.6 has a stack-based buffer     over-read.(CVE-2018-10393)

  - mapping0_forward in mapping0.c in Xiph.Org libvorbis     1.3.6 does not validate the number of channels, which     allows remote attackers to cause a denial of service     (heap-based buffer overflow or over-read) or possibly     have unspecified other impact via a crafted     file.(CVE-2018-10392)

  - The bark_noise_hybridmp function in psy.c in Xiph.Org     libvorbis 1.3.5 allows remote attackers to cause a     denial of service (out-of-bounds access and application     crash) or possibly have unspecified other impact via a     crafted mp4 file.(CVE-2017-14160)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202003-36 (libvorbis: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libvorbis. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by enticing the user to process a specially crafted       audio file, could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

According to the versions of the libvorbis package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - bark_noise_hybridmp in psy.c in Xiph.Org libvorbis     1.3.6 has a stack-based buffer     over-read.(CVE-2018-10393)

  - mapping0_forward in mapping0.c in Xiph.Org libvorbis     1.3.6 does not validate the number of channels, which     allows remote attackers to cause a denial of service     (heap-based buffer overflow or over-read) or possibly     have unspecified other impact via a crafted     file.(CVE-2018-10392)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2828 advisory.

    Several vulnerabilities were fixed in libvorbis, a popular library for the Vorbis audio codec.
    CVE-2017-14160 CVE-2018-10393 Improve bound checking for very low sample rates. CVE-2018-10392 Validate     the number of channels in vorbisenc.c For Debian 9 stretch, these problems have been fixed in version     1.3.5-4+deb9u3. We recommend that you upgrade your libvorbis packages. For the detailed security status of     libvorbis please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/libvorbis Further information about Debian LTS security advisories, how to     apply these updates to your system and frequently asked questions can be found at:
    https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2019:3703 advisory.

  - mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which     allows remote attackers to cause a denial of service (heap-based buffer overflow or over-read) or possibly     have unspecified other impact via a crafted file. (CVE-2018-10392)

  - bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read.
    (CVE-2018-10393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
145621	CentOS 8 : libvorbis (CESA-2019:3703)	Nessus	CentOS Local Security Checks	2021/1/29	2024/1/25	high
152331	EulerOS 2.0 SP9 : libvorbis (EulerOS-SA-2021-2248)	Nessus	Huawei Local Security Checks	2021/8/9	2023/12/6	high
130570	RHEL 8 : libvorbis (RHSA-2019:3703)	Nessus	Red Hat Local Security Checks	2019/11/6	2025/3/16	high
131431	Debian DLA-2013-1 : libvorbis security update	Nessus	Debian Local Security Checks	2019/12/3	2024/4/9	high
138131	Slackware 14.0 / 14.1 / 14.2 / current : libvorbis (SSA:2020-186-01)	Nessus	Slackware Local Security Checks	2020/7/6	2024/3/4	high
142578	EulerOS Virtualization 3.0.6.6 : libvorbis (EulerOS-SA-2020-2449)	Nessus	Huawei Local Security Checks	2020/11/6	2024/2/9	high
221310	Linux Distros Unpatched Vulnerability : CVE-2018-10393	Nessus	Misc.	2025/3/4	2025/9/15	high
109932	openSUSE Security Update : libvorbis (openSUSE-2018-472)	Nessus	SuSE Local Security Checks	2018/5/21	2024/10/4	high
131510	EulerOS Virtualization for ARM 64 3.0.3.0 : libvorbis (EulerOS-SA-2019-2345)	Nessus	Huawei Local Security Checks	2019/12/3	2024/4/8	high
134642	GLSA-202003-36 : libvorbis: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/3/18	2024/3/21	high
140147	EulerOS 2.0 SP5 : libvorbis (EulerOS-SA-2020-1926)	Nessus	Huawei Local Security Checks	2020/9/2	2024/2/22	high
155711	Debian DLA-2828-1 : libvorbis - LTS security update	Nessus	Debian Local Security Checks	2021/11/29	2025/1/24	high
157654	AlmaLinux 8 : libvorbis (ALSA-2019:3703)	Nessus	Alma Linux Local Security Checks	2022/2/9	2023/11/10	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high