The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500006 advisory.

    - resolv: Check hostname for validity (CVE-2026-4438)
    - resolv: Count records correctly (CVE-2026-4437)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1259:07 advisory.

    * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)
      * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)
      * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19061 advisory.

    - resolv: Check hostname for validity (CVE-2026-4438)
    - resolv: Count records correctly (CVE-2026-4437)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:19061 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)

    * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:20597 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)

    * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)

    * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has     overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or     earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in     unintentional disclosure of neighboring data in the heap, or a program crash._x000D_
    _x000D_     A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes     ungetwc() to operate on the regular character buffer (fp-_IO_read_ptr) instead of the actual wide-     stream read pointer (fp-_wide_data-_IO_read_ptr). The program crash may happen in cases where fp-
    _IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special     situation where the input character encoding is such that there are overlaps between single byte     representations and multibyte representations in that encoding, resulting in spurious matches. The     spurious match case is not possible in the standard Unicode character sets.(CVE-2026-5928)

    Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version     2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in     a one byte heap buffer overflow.(CVE-2026-5450)

    The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure     when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an     application._x000D_
    _x000D_
    _x000D_
    _x000D_     This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from     systems that do not need them.(CVE-2026-4046)

    Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS     backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the     configured DNS server, result in a violation of the DNS specification that causes the application to treat     a non-answer section of the DNS response as a valid answer.(CVE-2026-4437)

    Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS     backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being     returned to the caller in violation of the DNS specification.(CVE-2026-4438)

Tenable has extracted the preceding description block directly from the EulerOS glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
327344	Oracle Linux 10 : glibc (ELSA-2026-500006)	Nessus	Oracle Linux Local Security Checks	2026/7/16	2026/7/17	medium
326754	MiracleLinux 9 : glibc-2.34-270.el9_8 (AXSA:2026-1259:07)	Nessus	Miracle Linux Local Security Checks	2026/7/14	2026/7/17	medium
327068	Oracle Linux 10 : glibc (ELSA-2026-19061)	Nessus	Oracle Linux Local Security Checks	2026/7/15	2026/7/17	medium
315399	RHEL 10 : glibc (RHSA-2026:19061)	Nessus	Red Hat Local Security Checks	2026/5/19	2026/7/17	medium
316898	RHEL 9 : glibc (RHSA-2026:20597)	Nessus	Red Hat Local Security Checks	2026/5/27	2026/7/17	medium
323171	EulerOS 2.0 SP15 : glibc (EulerOS-SA-2026-2442)	Nessus	Huawei Local Security Checks	2026/6/27	2026/7/17	critical
323210	EulerOS 2.0 SP15 : glibc (EulerOS-SA-2026-2483)	Nessus	Huawei Local Security Checks	2026/6/27	2026/7/17	critical

检测

插件搜索

medium

medium

medium

medium

medium

critical

critical