The remote NewStart CGSL host, running version MAIN 6.06, has docker-ce packages installed that are affected by multiple vulnerabilities:

  - runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
    (CVE-2019-5736)

  - Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0,     17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a     Denial of Service via a crafted image layer payload, aka gzip bombing. (CVE-2017-14992)

  - The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block     /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are     used) by leveraging Docker container access to write a scsi remove-single-device line to     /proc/scsi/scsi, aka SCSI MICDROP. (CVE-2017-16539)

  - libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than     ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall     arguments could bypass intended access restrictions by specifying a single matching argument.
    (CVE-2017-18367)

  - The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block     /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling     bluetooth or turning up/down keyboard brightness. (CVE-2018-10892)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03540-1 advisory.

    - Include historical changelog data from before the docker-stable fork. The       initial changelog entry did technically provide all the necessary       information, but our CVE tracking tools do not understand how the package is       forked and so it seems that this package does not include fixes for ~12 years       of updates. So, include a copy of the original package's changelog up until       the fork point. (bsc#1250596)

    - Remove git-core recommends on SLE. Most SLE systems have       installRecommends=yes by default and thus end up installing git with Docker.
      bsc#1250508

      This feature is mostly intended for developers ('docker build git://') so       most users already have the dependency installed, and the error when git is       missing is fairly straightforward (so they can easily figure out what they       need to install).

    - Backport <https://github.com/moby/moby/pull/48517>. bsc#1247362

    - Update to docker-buildx v0.25.0. Upstream changelog:
      <https://github.com/docker/buildx/releases/tag/v0.25.0>

    - Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as       Docker does not have permission to access the host zypper credentials in this       mode (and unprivileged users cannot disable the feature using       /etc/docker/suse-secrets-enable.) bsc#1240150

    - Initial docker-stable fork, forked from Docker 24.0.7-ce release       (packaged on 2024-02-14). The original changelog is included below for       historical reference.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
266258	NewStart CGSL MAIN 6.06 : docker-ce Multiple Vulnerabilities (NS-SA-2025-0217)	Nessus	NewStart CGSL Local Security Checks	2025/9/30	2025/9/30	high
270099	SUSE SLES12 Security Update : docker-stable (SUSE-SU-2025:03540-1)	Nessus	SuSE Local Security Checks	2025/10/11	2025/10/11	critical

检测

插件搜索

high

critical