The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19061 advisory.

    * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)

    * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-20597 advisory.

    [2.34-270.0.1]
    - Forward-port Oracle patches for ol9-u8       Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       Oracle history:
      May-20-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-266.0.1
      - Forward-port Oracle patches for ol9-u8         Reviewed-by: David Faust <david.faust@oracle.com>       March-25-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-262.0.1
      - Forward-port Oracle patches for ol9-u8         Reviewed-by: David Faust <david.faust@oracle.com>       March-6-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-256.0.1
      - Forward-port Oracle patches for ol9-u8         Reviewed-by: David Faust <david.faust@oracle.com>       February-3-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-245.0.1
      - Forward-port Oracle patches for ol9-u8         Reviewed-by: David Faust <david.faust@oracle.com>       November-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1.1
      - Forward-port Oracle patches for ol9-u7         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       September-24-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-231.0.1
      - Forward-port Oracle patches for ol9-u7         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       September-8-2025 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-228.0.1
      - Forward-port Oracle patches for ol9-u7         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-217.0.1
      - Forward-port Oralce patches for ol9-u7         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.23
      - Forward-port Oracle patches for ol9-u6         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       June-30-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.20
      - Forward-port Oracle patches for ol9-u6         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19
      - Forward-port Oracle patches for ol9-u6         Reviewed-by: David Faust <david.faust@oracle.com>       May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14
      - Forward-port Oracle patches for ol9-u6         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1
      - Forward-port Oracle patches for ol9-u6         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1
      - Forward-port Oracle patches for ol9-u6 DP         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1
      - Forward-port Oracle patches for ol9-u5         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4
      - Forward-port Oracle patches for ol9-u4         Reviewed by: David Faust <david.faust@oracle.com>       August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3
      - Forward-port Oracle patches for ol9-u4         Reviewed by: David Faust <david.faust@oracle.com>       May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2
      - Forward-port Oracle patches for ol9-u4         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1
      - Forward-port Oracle patches for ol9-u4         Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>       March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1
      - Forward-port Oracle patches for ol9-u4-beta         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12
      - Forward-port Oracle patches for ol9         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7
      - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7
      - Forward-port Oracle patches for ol9         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1
      - Forward-port Oracle patches for ol9         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2
      - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks
      - Created tunable glibc.pthread.stack_hugetlb to control when hugepages         can be used for stack allocation.
      - In case THP are enabled and glibc.pthread.stack_hugetlb is set to         0, glibc will madvise the kernel not to use allow hugepages for stack         allocations.
        Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1
      - Merge Oracle patches for ol9-u2 beta         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1
      - Merge Oracle patches for ol9-u1 beta         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1
      - Merge Oracle patches with ol9 beta
      - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

    [2.34-270]
    - Fix incorrect setting of CXX variable in spec file (RHEL-148252)

    [2.34-269]
    - Fix __nss_get_default_domain logic to restore netgroup user enumeration       (RHEL-168096)

    [2.34-268]
    - resolv: Correctly count records and check hostname validity (RHEL-168851,       RHEL-168852)

    [2.34-267]
    - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules       (RHEL-162901)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.6 advisory.

  - NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator     that enables denial of service and possible remote code execution as a result of deep copying a data     structure and erroneously overwriting a destination pointer. An adversary can exploit the vulnerability by     controlling a malicious signed zone and querying a vulnerable Unbound. When DS sub-queries need to suspend     validation due to NSEC3 computational budget exhaustion (introduced in Unbound 1.19.1), Unbound deep-     copies response messages to preserve them across memory region teardown. A struct-assignment bug     overwrites the destination's pointer with the source's pointer. After the sub-query region is freed, the     resumed validator dereferences this dangling pointer, triggering a crash or potentially enabling arbitrary     code execution. Unbound 1.25.1 contains a patch with a fix to preserve the correct pointer when deep     copying the data structure. (CVE-2026-33278)

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in     the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The     identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended     to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in     the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable     characters (which would need escaping), the calculation of the length of the escaped string could     overflow, leading to a potential write off the end of the newly allocated string. (CVE-2025-13601)

  - Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in     Vim's tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation     can lead to overwriting sensitive files or placing executable code in privileged locations, depending on     the permissions of the process editing the archive. The victim must edit such a file using Vim which will     reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying     operating system. Version 9.1.1552 contains a patch for the vulnerability. (CVE-2025-53905)

  - Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in     Vim's zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation     can lead to overwriting sensitive files or placing executable code in privileged locations, depending on     the permissions of the process editing the archive. The victim must edit such a file using Vim which will     reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying     operating system. Version 9.1.1551 contains a patch for the vulnerability. (CVE-2025-53906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500006 advisory.

    - resolv: Check hostname for validity (CVE-2026-4438)
    - resolv: Count records correctly (CVE-2026-4437)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
317963	RockyLinux 10 : glibc (RLSA-2026:19061)	Nessus	Rocky Linux Local Security Checks	2026/5/29	2026/7/17	medium
322986	Oracle Linux 9 : glibc (ELSA-2026-20597)	Nessus	Oracle Linux Local Security Checks	2026/6/26	2026/7/17	medium
328839	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.6)	Nessus	Misc.	2026/7/21	2026/8/5	critical
327344	Oracle Linux 10 : glibc (ELSA-2026-500006)	Nessus	Oracle Linux Local Security Checks	2026/7/16	2026/7/17	medium

检测

插件搜索

medium

medium

critical

medium