According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40     are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes     in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.
    $ perl -e '$_ = '\x{FF}' x 1000000; tr/\xFF/\x{100}/;'    Segmentation fault (core dumped) It is believed     that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that     lack sufficient defenses.(CVE-2024-56406)

Tenable has extracted the preceding description block directly from the EulerOS perl security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7500 advisory.

    [4:5.40.2-512.1]
    - 5.40.2 bump (see <https://metacpan.org/release/SHAY/perl-5.40.2/view/pod/perldelta.pod>)
    - Resolves: RHEL-87186

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has perl packages installed that are affected by a vulnerability:

  - A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40     are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes     in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.
    $ perl -e '$_ = \x{FF} x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped) It is believed     that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that     lack sufficient defenses. (CVE-2024-56406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-8445f115f6 advisory.

    Fix CVE-2024-56406




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of perl installed on the remote host is prior to 5.34.3 / 5.40.2. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-104-01 advisory.

    New perl packages are available for Slackware 15.0 and -current to fix a security issue.

Tenable has extracted the preceding description block directly from the perl security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of perl installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-56406 advisory.

  - A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40     are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes     in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.
    $ perl -e '$_ = \x{FF} x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped) It is believed     that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that     lack sufficient defenses. (CVE-2024-56406)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7500 advisory.

    Perl is a high-level programming language that is commonly used for system administration utilities and     web programming.

    Security Fix(es):

    * perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-     ASCII bytes (CVE-2024-56406)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0388 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-56406:
    A heap buffer overflow vulnerability was discovered in Perl.

    Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1     through 5.41.10.

    When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can     overflow the destination pointer `d`.

     $ perl -e '$_ = \x{FF} x 1000000; tr/\xFF/\x{100}/;'      Segmentation fault (core dumped)

    It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on     platforms that lack sufficient defenses.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5902 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5902-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     April 13, 2025                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : perl     CVE ID         : CVE-2024-56406

    Nathan Mills discovered a heap-based buffer overflow vulnerability in     the implementation of the Perl programming language when transliterating     non-ASCII bytes with tr///, which may result in denial of service, or     potentially the execution of arbitrary code.

    For the stable distribution (bookworm), this problem has been fixed in     version 5.36.0-7+deb12u2.

    We recommend that you upgrade your perl packages.

    For the detailed security status of perl please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/perl

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the perl package has been released.

According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40     are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes     in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.
    $ perl -e '$_ = '\x{FF}' x 1000000; tr/\xFF/\x{100}/;'    Segmentation fault (core dumped) It is believed     that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that     lack sufficient defenses.(CVE-2024-56406)

    Perl threads have a working directory race condition where file operations may target unintended paths.If     a directory handle is open at thread creation, the process-wide current working directory is temporarily     changed in order to clonethat handle for the new thread, which is visible from any third (ormore)     thread already running.This may lead to unintended operationssuch as loading code or accessing files     from unexpected locations,which a local attacker may be able to exploit.The bug was introduced in     commit11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6(CVE-2025-40909)

    Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a     repeated fixed string on 32-bit builds.Perl_study_chunk in regcomp_study.c checked the size of the joined     substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum     count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the     subsequent copy writes past the end of the buffer.A caller that compiles an attacker-controlled regular     expression on a 32-bit perl build triggers a heap buffer overflow at compile time.(CVE-2026-8376)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization perl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
242466	EulerOS 2.0 SP12 : perl (EulerOS-SA-2025-1835)	Nessus	Huawei Local Security Checks	2025/7/21	2025/7/21	high
240858	Oracle Linux 10 : perl (ELSA-2025-7500)	Nessus	Oracle Linux Local Security Checks	2025/6/27	2025/6/27	high
240993	EulerOS 2.0 SP13 : perl (EulerOS-SA-2025-1695)	Nessus	Huawei Local Security Checks	2025/6/30	2025/6/30	high
271288	NewStart CGSL MAIN 7.02 : perl Vulnerability (NS-SA-2025-0251)	Nessus	NewStart CGSL Local Security Checks	2025/10/24	2025/10/24	high
235009	Fedora 40 : perl / perl-Devel-Cover / perl-PAR-Packer (2025-8445f115f6)	Nessus	Fedora Local Security Checks	2025/4/30	2025/4/30	high
234327	Slackware Linux 15.0 / current perl Vulnerability (SSA:2025-104-01)	Nessus	Slackware Local Security Checks	2025/4/14	2025/4/14	critical
234637	CBL Mariner 2.0 Security Update: perl (CVE-2024-56406)	Nessus	MarinerOS Local Security Checks	2025/4/20	2025/4/20	high
237809	RHEL 10 : perl (RHSA-2025:7500)	Nessus	Red Hat Local Security Checks	2025/6/5	2025/6/5	high
241005	EulerOS 2.0 SP13 : perl (EulerOS-SA-2025-1710)	Nessus	Huawei Local Security Checks	2025/6/30	2025/6/30	high
239936	TencentOS Server 4: perl (TSSA-2025:0388)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
234241	Debian dsa-5902 : libperl-dev - security update	Nessus	Debian Local Security Checks	2025/4/13	2025/4/13	critical
235141	Photon OS 5.0: Perl PHSA-2025-5.0-0514	Nessus	PhotonOS Local Security Checks	2025/5/5	2025/5/5	high
238400	EulerOS 2.0 SP11 : perl (EulerOS-SA-2025-1673)	Nessus	Huawei Local Security Checks	2025/6/12	2025/6/12	high
334109	Photon OS 5.0: Perl PHSA-2025-5.0-91-0514	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/8/10	high
348035	EulerOS Virtualization 2.11.1 : perl (EulerOS-SA-2026-3450)	Nessus	Huawei Local Security Checks	2026/9/18	2026/9/18	critical

检测

插件搜索

high

high

high

high

high

critical

high

high

high

high

critical

high

high

high

critical