The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5425-1 advisory.

    Yunho Kim discovered that PCRE incorrectly handled memory when

    handling certain regular expressions. An attacker could possibly use this issue to cause applications     using PCRE to expose sensitive information. This issue only affects Ubuntu 18.04 LTS,

    Ubuntu 20.04 LTS, Ubuntu 21.10 and Ubuntu 22.04 LTS. (CVE-2019-20838)

    It was discovered that PCRE incorrectly handled memory when

    handling certain regular expressions. An attacker could possibly use this issue to cause applications     using PCRE to have unexpected

    behavior. This issue only affects Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04     LTS. (CVE-2020-14155)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4373 advisory.

  - libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R     has more than one fixed quantifier, a related issue to CVE-2019-20454. (CVE-2019-20838)

  - libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
    (CVE-2020-14155)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1441-1 advisory.

  - libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R     has more than one fixed quantifier, a related issue to CVE-2019-20454. (CVE-2019-20838)

  - libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
    (CVE-2020-14155)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3529-1 advisory.

  - libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R     has more than one fixed quantifier, a related issue to CVE-2019-20454. (CVE-2019-20838)

  - libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
    (CVE-2020-14155)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4614 advisory.

    This release adds the new Apache HTTP Server 2.4.37 Service Pack 10 packages that are part of the JBoss     Core Services offering.

    This release serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Service     Pack 9 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most     significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * httpd: Single zero byte stack overflow in mod_auth_digest (CVE-2020-35452)
    * httpd: mod_session NULL pointer dereference in parser (CVE-2021-26690)
    * httpd: Heap overflow in mod_session (CVE-2021-26691)
    * httpd: mod_proxy_wstunnel tunneling of non Upgraded connection (CVE-2019-17567)
    * httpd: MergeSlashes regression (CVE-2021-30641)
    * httpd: mod_proxy NULL pointer dereference (CVE-2020-13950)
    * jbcs-httpd24-openssl: openssl: NULL pointer dereference in X509_issuer_and_serial_hash()     (CVE-2021-23841)
    * openssl: Read buffer overruns processing ASN.1 strings (CVE-2021-3712)
    * openssl: integer overflow in CipherUpdate (CVE-2021-23840)
    * pcre: buffer over-read in JIT when UTF is disabled (CVE-2019-20838)
    * pcre: integer overflow in libpcre (CVE-2020-14155)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R     has more than one fixed quantifier, a related issue to CVE-2019-20454. (CVE-2019-20838)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2716:01 advisory.

    * pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed     quantifier greater than 1 (CVE-2019-20838)
      * pcre: Integer overflow when parsing callout numeric arguments     (CVE-2020-14155)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4373 advisory.

    - Fix CVE-2019-20838 (a subject buffer overread in JIT when UTF is disabled       and \X or \R has a greater than 1 fixed quantifier) (bug #1852252)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4373 advisory.

    PCRE is a Perl-compatible regular expression library.

    Security Fix(es):

    * pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1     (CVE-2019-20838)

    * pcre: Integer overflow when parsing callout numeric arguments (CVE-2020-14155)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 11.0.x prior to 11.0.1. It is, therefore, affected by multiple vulnerabilities, including the following:

  - An out-of-bounds write issue that can lead to unexpected application termination or arbitrary code     execution when opening a maliciously crafted PDF file. (CVE-2020-9876)

  - An out-of-bounds write caused by insufficient input validation that can lead to arbitrary code execution     when processing a maliciously crafted image. (CVE-2020-9883)

  - A remote attacker may be able to unexpectedly alter the Mail application date due to insufficient checks.
    (CVE-2020-9941)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.6 Security Update 2021-001 Mojave, 10.15.x prior to 10.15.7 Security Update 2021-001 Catalina, or 11.x prior to 11.2. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A logic issue existed resulting in memory corruption. This was addressed with improved state management.
    An application may be able to execute arbitrary code with kernel privileges. (CVE-2020-27904)

  - A logic issue existed that allowed applications to execute arbitrary code with kernel privileges.
    (CVE-2021-1750)

  - An out-of-bounds-write caused by improper input validation allowed maliciously crafted USD files to     unexpectedly terminate an application or cause arbitrary code execution. (CVE-2021-1762)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3652-1 advisory.

    Update pcre to version 8.45:

    - CVE-2020-14155: Fixed integer overflow via a large number after a '(?C' substring (bsc#1172974).
    - CVE-2019-20838: Fixed buffer over-read in JIT compiler (bsc#1172973).
    - CVE-2017-7244: Fixed invalid read in _pcre32_xclass() (bsc#1030807).
    - CVE-2017-7245: Fixed buffer overflow in the pcre32_copy_substring (bsc#1030805).
    - CVE-2017-7246: Fixed another buffer overflow in the pcre32_copy_substring (bsc#1030803).
    - CVE-2017-7186: Fixed denial of service caused by an invalid Unicode property lookup (bsc#1030066).
    - CVE-2017-6004: Fixed denial of service via crafted regular expression (bsc#1025709).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4373 advisory.

  - pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1     (CVE-2019-20838)

  - pcre: Integer overflow when parsing callout numeric arguments (CVE-2020-14155)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
161249	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : PCRE vulnerabilities (USN-5425-1)	Nessus	Ubuntu Local Security Checks	2022/5/17	2024/8/27	high
157545	AlmaLinux 8 : pcre (ALSA-2021:4373)	Nessus	Alma Linux Local Security Checks	2022/2/9	2023/11/13	high
154860	openSUSE 15 Security Update : pcre (openSUSE-SU-2021:1441-1)	Nessus	SuSE Local Security Checks	2021/11/3	2023/11/27	high
154664	openSUSE 15 Security Update : pcre (openSUSE-SU-2021:3529-1)	Nessus	SuSE Local Security Checks	2021/10/28	2023/11/27	high
155223	RHEL 7 / 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP10 (RHSA-2021:4614)	Nessus	Red Hat Local Security Checks	2021/11/11	2024/11/7	critical
222727	Linux Distros Unpatched Vulnerability : CVE-2019-20838	Nessus	Misc.	2025/3/4	2026/8/4	high
294350	MiracleLinux 8 : pcre-8.42-6.el8 (AXSA:2021-2716:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
155397	Oracle Linux 8 : pcre (ELSA-2021-4373)	Nessus	Oracle Linux Local Security Checks	2021/11/17	2024/10/22	high
155093	RHEL 8 : pcre (RHSA-2021:4373)	Nessus	Red Hat Local Security Checks	2021/11/11	2025/3/15	high
143115	macOS 11.0.x < 11.0.1	Nessus	MacOS X Local Security Checks	2020/11/19	2024/5/28	high
146086	macOS 10.14.x < 10.14.6 Security Update 2021-001 / 10.15.x < 10.15.7 Security Update 2021-001 / macOS 11.x < 11.2 (HT212147)	Nessus	MacOS X Local Security Checks	2021/2/3	2024/5/28	critical
155134	SUSE SLED12: libpcre1 / libpcre1-32bit / libpcre16-0 / libpcrecpp0 / etc (SUSE-SU-2021:3652-1)	Nessus	SuSE Local Security Checks	2021/11/11	2026/6/25	high
155050	CentOS 8 : pcre (CESA-2021:4373)	Nessus	CentOS Local Security Checks	2021/11/11	2023/11/24	high
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	2024/5/2	2024/7/29	critical
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	2023/6/30	2023/7/6	critical
194926	Universal Forwarder 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0809)	Nessus	CGI abuses	2024/5/2	2024/5/30	critical

检测

插件搜索

high

high

high

high

critical

high

high

high

high

high

critical

high

high

critical

critical

critical