The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-8222:02 advisory.

    * squashfs-tools: unvalidated filepaths allow writing outside of destination (CVE-2021-40153)
      * squashfs-tools: possible Directory Traversal via symbolic link (CVE-2021-41072)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the squashfs-tools-4.4-10.git1.el9 build changelog.

  - unvalidated filepaths allow writing outside of destination rhbz#2000638 (CVE-2021-40153)

  - additional write outside destination directory exploit fix rhbz#2007304 (CVE-2021-41072)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-3139 advisory.

    [4.3-21]
    - CVE-2021-41072 squashfs-tools: additional write outside destination directory exploit fix       CVE-2021-40153 squashfs-tools: unvalidated filepaths allow writing outside of destination       Resolves: rhbz#2007303 rhbz#2000637

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:3139 advisory.

    * squashfs-tools: unvalidated filepaths allow writing outside of destination (CVE-2021-40153)

    * squashfs-tools: possible Directory Traversal via symbolic link (CVE-2021-41072)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to AHV-10.0. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.0 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and     1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files     outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.
    When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the     command-line interface), that means that an application which otherwise doesn't have access to the real     user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the     scenes, this directory is actually a bind mount and the data is stored in the per-application directory as     `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory     to still work as intended without general home directory access. However, the application does have write     access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source     directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the     application is started, the bind mount will follow the symlink and mount whatever it points to into the     sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the     patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by     two instances of a malicious app running in parallel. Closing the race condition requires updating or     patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the     patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with     `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar     option, then the version of bubblewrap that needs to be patched is a system copy that is distributed     separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux     distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with     `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is     included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`.
    This configuration is the default when building from source code. For the 1.14.x stable branch, these     changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has     been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10.
    The bundled version of bubblewrap in this release is a Meson wrap subproject, which has been updated to     0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS     distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or     update to newer versions if their stability policy allows it. As a workaround, avoid using applications     using the `persistent` (`--persist`) permission. (CVE-2024-42472)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.10. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.10 advisory.

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

  - Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache     Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers     correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect     infinite timeout which allowed connections to remain open which should have been closed. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1     through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be     affected: 8.5.0 though 8.5.100. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90,     which fixes the issue. (CVE-2024-34750)

  - A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in     NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as     libndp was not correctly validating the route length information. (CVE-2024-5564)

  - Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of     service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of     Service (ReDoS) in package_index.py. (CVE-2022-40897)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.102001 advisory.

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login     process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. (CVE-2024-22365)

  - An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7,     3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks     during cleanup of permissions-related errors. This means users which can run privileged programs are     potentially able to modify permissions of files referenced by symlinks in some circumstances.
    (CVE-2023-6597)

  - An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and     3.8.18 and prior. The zipfile module is vulnerable to quoted-overlap zip-bombs which exploit the zip     format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile     module reject zip archives which overlap entries in the archive. (CVE-2024-0450)

  - The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through     9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1     through 9.18.21-S1. (CVE-2023-4408)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the squashfs package has been released.

According to the versions of the squashfs-tools package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is     then used by unsquashfs to create the new file during the unsquash. The filename is not validated for     traversal outside of the destination directory, and thus allows writing to locations outside of the     destination. (CVE-2021-40153)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0147 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2021-40153:
    squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is     then used by unsquashfs to create the new file during the unsquash. The filename is not validated for     traversal outside of the destination directory, and thus allows writing to locations outside of the     destination.

    CVE-2021-41072:
    squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has squashfs-tools packages installed that are affected by multiple vulnerabilities:

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is     then used by unsquashfs to create the new file during the unsquash. The filename is not validated for     traversal outside of the destination directory, and thus allows writing to locations outside of the     destination. (CVE-2021-40153)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2024:3139 advisory.

  - squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is     then used by unsquashfs to create the new file during the unsquash. The filename is not validated for     traversal outside of the destination directory, and thus allows writing to locations outside of the     destination. (CVE-2021-40153)

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:2396 advisory.

    * squashfs-tools: unvalidated filepaths allow writing outside of destination (CVE-2021-40153)

    * squashfs-tools: possible Directory Traversal via symbolic link (CVE-2021-41072)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.101026 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (CVE-2022-48624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
292177	MiracleLinux 8 : squashfs-tools-4.3-21.el8 (AXSA:2024-8222:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
191304	CentOS 9 : squashfs-tools-4.4-10.git1.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	high
197997	Oracle Linux 8 : squashfs-tools (ELSA-2024-3139)	Nessus	Oracle Linux Local Security Checks	2024/5/28	2024/9/21	high
200587	Rocky Linux 8 : squashfs-tools (RLSA-2024:3139)	Nessus	Rocky Linux Local Security Checks	2024/6/14	2024/6/14	high
310786	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.0)	Nessus	Misc.	2026/4/29	2026/4/30	medium
208234	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10)	Nessus	Misc.	2024/10/7	2025/9/1	high
208276	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.102001)	Nessus	Misc.	2024/10/8	2025/10/6	medium
203736	Photon OS 3.0: Squashfs PHSA-2022-3.0-0375	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
155474	EulerOS Virtualization 2.9.0 : squashfs-tools (EulerOS-SA-2021-2774)	Nessus	Huawei Local Security Checks	2021/11/17	2023/11/23	high
156505	EulerOS Virtualization 3.0.2.6 : squashfs-tools (EulerOS-SA-2021-2904)	Nessus	Huawei Local Security Checks	2022/1/6	2023/11/21	high
239603	TencentOS Server 3: squashfs-tools (TSSA-2024:0147)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
242708	NewStart CGSL MAIN 7.02 : squashfs-tools Multiple Vulnerabilities (NS-SA-2025-0192)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	high
197666	CentOS 8 : squashfs-tools (CESA-2024:3139)	Nessus	CentOS Local Security Checks	2024/5/22	2024/5/22	high
235561	RockyLinux 9 : squashfs-tools (RLSA-2024:2396)	Nessus	Rocky Linux Local Security Checks	2025/5/7	2025/5/7	high
206824	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.101026)	Nessus	Misc.	2024/9/9	2025/10/6	medium

检测

插件搜索

high

high

high

high

medium

high

medium

high

high

high

high

high

high

high

medium