The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1806:01 advisory.

    * sqlite: integer overflow in sqlite3_str_vappendf function in printf.c (CVE-2020-13434)
      * sqlite: heap-based buffer overflow in multiSelectOrderBy due to mishandling of query-flattener     optimization in select.c (CVE-2020-15358)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Rebase to version 3.32.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the sqlite package has been released.

sqlite3 update :

Various security issues could be used by an attacker to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.

- CVE-2020-11655: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.

- CVE-2020-13434: SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

- CVE-2020-13435: SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.

- CVE-2020-13630: ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

- CVE-2020-13631: SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.

- CVE-2020-13632: ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.

According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - SQLite through 3.32.0 has a segmentation fault in     sqlite3ExprCodeTarget in expr.c.(CVE-2020-13435)

  - SQLite through 3.32.0 has an integer overflow in     sqlite3_str_vappendf in printf.c.(CVE-2020-13434)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1968 advisory.

    MinGW is a free and open source software development environment to create Microsoft Windows applications.

    The following packages have been upgraded to a later upstream version: mingw-sqlite (3.26.0.0).
    (BZ#1845475)

    Security Fix(es):

    * sqlite: Division by zero in whereLoopAddBtreeIndex in sqlite3.c (CVE-2019-16168)

    * sqlite: Integer overflow in sqlite3_str_vappendf function in printf.c (CVE-2020-13434)

    * sqlite: Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c (CVE-2020-13630)

    * sqlite: Virtual table can be renamed into the name of one of its shadow tables (CVE-2020-13631)

    * sqlite: NULL pointer dereference in ext/fts3/fts3_snippet.c via a crafted matchinfo() query     (CVE-2020-13632)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2021_1968 advisory.

    * sqlite: Division by zero in whereLoopAddBtreeIndex in sqlite3.c (CVE-2019-16168)

    * sqlite: Integer overflow in sqlite3_str_vappendf function in printf.c (CVE-2020-13434)

    * sqlite: Use-after-free in fts3EvalNextRow in ext/fts3/fts3.c (CVE-2020-13630)

    * sqlite: Virtual table can be renamed into the name of one of its shadow tables (CVE-2020-13631)

    * sqlite: NULL pointer dereference in ext/fts3/fts3_snippet.c via a crafted matchinfo() query     (CVE-2020-13632)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is less than 5.19.0 and is therefore affected by multiple vulnerabilities in the following components: 
  - Apache FOP
  - Underscore
  - Handlebars
  - PHP
  - sqlite

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
293834	MiracleLinux 8 : sqlite-3.26.0-13.el8 (AXSA:2021-1806:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
137102	Fedora 32 : sqlite (2020-0477f8840e)	Nessus	Fedora Local Security Checks	2020/6/4	2024/3/8	high
137193	Photon OS 2.0: Sqlite PHSA-2020-2.0-0249	Nessus	PhotonOS Local Security Checks	2020/6/6	2024/7/23	high
137322	Photon OS 1.0: Sqlite PHSA-2020-1.0-0298	Nessus	PhotonOS Local Security Checks	2020/6/10	2024/3/7	high
137439	FreeBSD : several security issues in sqlite3 (c4ac9c79-ab37-11ea-8b5e-b42e99a1b9c3)	Nessus	FreeBSD Local Security Checks	2020/6/17	2024/3/7	high
140151	EulerOS 2.0 SP5 : sqlite (EulerOS-SA-2020-1930)	Nessus	Huawei Local Security Checks	2020/9/2	2024/2/22	medium
149666	RHEL 8 : mingw (RHSA-2021:1968)	Nessus	Red Hat Local Security Checks	2021/5/19	2024/11/7	high
358674	Rocky Linux 8 [CIQ] Security Update: mingw-binutils-debuginfo / mingw-binutils-debugsource / etc Multiple Vulnerabilities (crlsa-2021_1968)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
152986	Tenable SecurityCenter < 5.19.0 Multiple Vulnerabilities (TNS-2021-14)	Nessus	Misc.	2021/9/3	2024/5/10	critical
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	2023/6/30	2023/7/6	critical

检测

插件搜索

medium

high

high

high

high

medium

high

high

critical

critical