According to the version of the lcms2 package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - Little CMS (aka Little Color Management System) 2.9 has     an integer overflow in the AllocateDataSet function in     cmscgats.c, leading to a heap-based buffer overflow in     the SetData function via a crafted file in the second     argument to cmsIT8LoadFromFile.(CVE-2018-16435)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202105-18 (LittleCMS: User-assisted execution of arbitrary code)

    It was discovered that LittleCMS (aka Little Color Management System)       had an integer overflow in the AllocateDataSet function in cmscgats.c.
  Impact :

    A remote attacker could entice a user or automated system to open a       specially crafted file containing malicious color data, possibly       resulting in execution of arbitrary code with the privileges of the       process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for lcms2 fixes the following security issues :

CVE-2016-10165: The Type_MLU_Read function allowed remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggered an out-of-bounds heap read (bsc#1021364).

CVE-2018-16435: A integer overflow was fixed in the AllocateDataSet function in cmscgats.c, that could lead to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile. (bsc#1108813)

Ensure that LUT stages match channel count (bsc#1026649).

sanitize input and output channels on MPE profiles (bsc#1026650).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_8_0-openjdk to version 8u191 fixes the following issues :

Security issues fixed :

CVE-2018-3136: Manifest better support (bsc#1112142)

CVE-2018-3139: Better HTTP Redirection (bsc#1112143)

CVE-2018-3149: Enhance JNDI lookups (bsc#1112144)

CVE-2018-3169: Improve field accesses (bsc#1112146)

CVE-2018-3180: Improve TLS connections stability (bsc#1112147)

CVE-2018-3214: Better RIFF reading support (bsc#1112152)

CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35 (bsc#1112153)

CVE-2018-3183: Improve script engine support (bsc#1112148)

CVE-2018-16435: heap-based buffer overflow in SetData function in cmsIT8LoadFromFile

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for lcms2 fixes the following issues :

  - CVE-2018-16435: Heap-based buffer overflow via a crafted     file in the second argument to cmsIT8LoadFromFile     (bsc#1108813)

This update was imported from the SUSE:SLE-15:Update update project.

According to the version of the lcms2 package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Little CMS (aka Little Color Management System) 2.9 has     an integer overflow in the AllocateDataSet function in     cmscgats.c, leading to a heap-based buffer overflow in     the SetData function via a crafted file in the second     argument to cmsIT8LoadFromFile.(CVE-2018-16435)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Little CMS (aka Little Color Management System) 2.9 has an integer overflow in the AllocateDataSet     function in cmscgats.c, leading to a heap-based buffer overflow in the SetData function via a crafted file     in the second argument to cmsIT8LoadFromFile. (CVE-2018-16435)

Note that Nessus relies on the presence of the package as reported by the vendor.

Security fix for CVE-2018-16435

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_0-openjdk to version 7u201 fixes the following issues :

Security issues fixed :

  - CVE-2018-3136: Manifest better support (bsc#1112142)

  - CVE-2018-3139: Better HTTP Redirection (bsc#1112143)

  - CVE-2018-3149: Enhance JNDI lookups (bsc#1112144)

  - CVE-2018-3169: Improve field accesses (bsc#1112146)

  - CVE-2018-3180: Improve TLS connections stability     (bsc#1112147)

  - CVE-2018-3214: Better RIFF reading support (bsc#1112152)

  - CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35     (bsc#1112153)

  - CVE-2018-16435: heap-based buffer overflow in SetData     function in cmsIT8LoadFromFile

  - CVE-2018-2938: Support Derby connections (bsc#1101644)

  - CVE-2018-2940: Better stack walking (bsc#1101645)

  - CVE-2018-2952: Exception to Pattern Syntax (bsc#1101651)

  - CVE-2018-2973: Improve LDAP support (bsc#1101656)

  - CVE-2018-3639 cpu speculative store bypass mitigation

This update was imported from the SUSE:SLE-12:Update update project.

This update for java-1_8_0-openjdk to version 8u191 fixes the following issues :

Security issues fixed :

  - CVE-2018-3136: Manifest better support (bsc#1112142)

  - CVE-2018-3139: Better HTTP Redirection (bsc#1112143)

  - CVE-2018-3149: Enhance JNDI lookups (bsc#1112144)

  - CVE-2018-3169: Improve field accesses (bsc#1112146)

  - CVE-2018-3180: Improve TLS connections stability     (bsc#1112147)

  - CVE-2018-3214: Better RIFF reading support (bsc#1112152)

  - CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35     (bsc#1112153)

  - CVE-2018-3183: Improve script engine support     (bsc#1112148)

  - CVE-2018-16435: heap-based buffer overflow in SetData     function in cmsIT8LoadFromFile

This update was imported from the SUSE:SLE-15:Update update project.

According to the version of the lcms2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - Little CMS (aka Little Color Management System) 2.9 has     an integer overflow in the AllocateDataSet function in     cmscgats.c, leading to a heap-based buffer overflow in     the SetData function via a crafted file in the second     argument to cmsIT8LoadFromFile.(CVE-2018-16435)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3770-1 advisory.

    Ibrahim El-Sayed discovered that Little CMS incorrectly handled certain files. An attacker could possibly     use this issue to cause a denial of service. (CVE-2016-10165)

    Quang Nguyen discovered that Little CMS incorrectly handled certain files. An attacker could possibly use     this issue to execute arbitrary code. (CVE-2018-16435)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for lcms2 fixes the following issues :

CVE-2018-16435: A integer overflow was fixed in the AllocateDataSet function in cmscgats.c, that could lead to a heap-based buffer overflow in the SetData function via a crafted file in the second argument to cmsIT8LoadFromFile. (bsc#1108813)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_0-openjdk to version 7u201 fixes the following issues :

Security issues fixed :

CVE-2018-3136: Manifest better support (bsc#1112142)

CVE-2018-3139: Better HTTP Redirection (bsc#1112143)

CVE-2018-3149: Enhance JNDI lookups (bsc#1112144)

CVE-2018-3169: Improve field accesses (bsc#1112146)

CVE-2018-3180: Improve TLS connections stability (bsc#1112147)

CVE-2018-3214: Better RIFF reading support (bsc#1112152)

CVE-2018-13785: Upgrade JDK 8u to libpng 1.6.35 (bsc#1112153)

CVE-2018-16435: heap-based buffer overflow in SetData function in cmsIT8LoadFromFile

CVE-2018-2938: Support Derby connections (bsc#1101644)

CVE-2018-2940: Better stack walking (bsc#1101645)

CVE-2018-2952: Exception to Pattern Syntax (bsc#1101651)

CVE-2018-2973: Improve LDAP support (bsc#1101656)

CVE-2018-3639 cpu speculative store bypass mitigation

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
151329	EulerOS Virtualization for ARM 64 3.0.2.0 : lcms2 (EulerOS-SA-2021-2098)	Nessus	Huawei Local Security Checks	2021/7/2	2023/12/11	medium
156979	GLSA-202105-18 : LittleCMS: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	2022/1/24	2023/12/21	medium
118500	SUSE SLED12 / SLES12 Security Update : lcms2 (SUSE-SU-2018:3545-1)	Nessus	SuSE Local Security Checks	2018/10/30	2024/7/26	high
121092	SUSE SLED15 / SLES15 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:0058-1)	Nessus	SuSE Local Security Checks	2019/1/11	2024/6/27	critical
123364	openSUSE Security Update : lcms2 (openSUSE-2019-880)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/10	medium
142091	EulerOS 2.0 SP5 : lcms2 (EulerOS-SA-2020-2286)	Nessus	Huawei Local Security Checks	2020/10/30	2024/2/13	medium
222377	Linux Distros Unpatched Vulnerability : CVE-2018-16435	Nessus	Misc.	2025/3/4	2026/9/2	medium
118489	openSUSE Security Update : lcms2 (openSUSE-2018-1327)	Nessus	SuSE Local Security Checks	2018/10/29	2024/7/26	medium
120272	Fedora 28 : lcms2 (2018-1cb4c4a6d8)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/9	medium
121151	openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2019-42) (Spectre)	Nessus	SuSE Local Security Checks	2019/1/14	2026/1/9	critical
121152	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2019-43)	Nessus	SuSE Local Security Checks	2019/1/14	2024/6/27	critical
147528	EulerOS Virtualization 3.0.6.6 : lcms2 (EulerOS-SA-2021-1488)	Nessus	Huawei Local Security Checks	2021/3/10	2024/1/11	medium
117631	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Little CMS vulnerabilities (USN-3770-1)	Nessus	Ubuntu Local Security Checks	2018/9/21	2024/8/27	high
120148	SUSE SLED15 / SLES15 Security Update : lcms2 (SUSE-SU-2018:3498-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/10	medium
121059	SUSE SLED12 / SLES12 Security Update : java-1_7_0-openjdk (SUSE-SU-2019:0049-1) (Spectre)	Nessus	SuSE Local Security Checks	2019/1/10	2026/1/9	critical
121091	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:0057-1)	Nessus	SuSE Local Security Checks	2019/1/11	2024/6/27	critical

检测

插件搜索

medium

medium

high

critical

medium

medium

medium

medium

medium

critical

critical

medium

high

medium

critical

critical