The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2021:0049 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-3520:
    There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be     able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing     an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some     potential impact to confidentiality and integrity as well.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the mysql package has been released.

An update of the lz4 package has been released.

According to the versions of the lz4 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be     able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing     an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some     potential impact to confidentiality and integrity as well. (CVE-2021-3520)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the lz4 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be     able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing     an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some     potential impact to confidentiality and integrity as well. (CVE-2021-3520)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the lz4 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be     able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing     an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some     potential impact to confidentiality and integrity as well. (CVE-2021-3520)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has lz4 packages installed that are affected by a vulnerability:

  - There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be     able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing     an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some     potential impact to confidentiality and integrity as well. (CVE-2021-3520)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for lz4 fixes the following issues :

CVE-2021-3520: Fixed memory corruption due to an integer overflow bug caused by memmove argument (bsc#1185438).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
236754	Alibaba Cloud Linux 3 : 0049: lz4 (ALINUX3-SA-2021:0049)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
332690	Photon OS 5.0: Mysql PHSA-2023-5.0-91-0056	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/5	critical
150926	Photon OS 2.0: Lz4 PHSA-2021-2.0-0357	Nessus	PhotonOS Local Security Checks	2021/6/21	2024/7/23	critical
153603	EulerOS 2.0 SP8 : lz4 (EulerOS-SA-2021-2474)	Nessus	Huawei Local Security Checks	2021/9/24	2021/9/24	critical
153696	EulerOS 2.0 SP9 : lz4 (EulerOS-SA-2021-2559)	Nessus	Huawei Local Security Checks	2021/9/27	2021/9/27	critical
155522	EulerOS Virtualization 2.9.0 : lz4 (EulerOS-SA-2021-2783)	Nessus	Huawei Local Security Checks	2021/11/17	2022/4/18	critical
156502	EulerOS Virtualization 3.0.2.6 : lz4 (EulerOS-SA-2021-2892)	Nessus	Huawei Local Security Checks	2022/1/6	2022/1/6	critical
204472	Photon OS 4.0: Mysql PHSA-2023-4.0-0435	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	critical
160840	NewStart CGSL MAIN 6.02 : lz4 Vulnerability (NS-SA-2022-0051)	Nessus	NewStart CGSL Local Security Checks	2022/5/10	2022/5/10	critical
149806	SUSE SLED15 / SLES15 Security Update : lz4 (SUSE-SU-2021:1647-1)	Nessus	SuSE Local Security Checks	2021/5/20	2022/1/26	critical
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	2024/5/2	2024/7/29	critical
194926	Universal Forwarder 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0809)	Nessus	CGI abuses	2024/5/2	2024/5/30	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical