The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.6. It is, therefore, affected by multiple vulnerabilities:

  - An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big     Sur 11.7, macOS Ventura 13, macOS Monterey 12.6. An app may be able to access user-sensitive data.
    (CVE-2022-42789)

  - A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, macOS     Monterey 12.6, macOS Big Sur 11.7. An app may be able to bypass Privacy preferences. (CVE-2022-32902)

  - An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Big Sur     11.7, macOS Ventura 13, macOS Monterey 12.6. An app may be able to access user-sensitive data.
    (CVE-2022-32904)

  - An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur     11.7, macOS Ventura 13, macOS Monterey 12.6. An app may be able to read sensitive location information.
    (CVE-2022-42819)

  - A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Big Sur     11.7, macOS Monterey 12.6. An app may be able to access user-sensitive data. (CVE-2022-32877)

  - LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers     to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix     is available with commit b4e79bfa. (CVE-2022-1622)

  - The issue was addressed with additional restrictions on the observability of app states. This issue is     fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, watchOS 9, macOS Monterey 12.6, tvOS 16. A     sandboxed app may be able to determine which app is currently using the camera. (CVE-2022-32913)

  - This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6, macOS     Big Sur 11.7. A user may be able to view sensitive user information. (CVE-2022-32896)

  - The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.2 and iPadOS 16.2,     macOS Ventura 13.1, tvOS 16.2. Connecting to a malicious NFS server may lead to arbitrary code execution     with kernel privileges. (CVE-2022-46701)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur     11.7, macOS Ventura 13, iOS 16, watchOS 9, macOS Monterey 12.6, tvOS 16. An app may be able to execute     arbitrary code with kernel privileges. (CVE-2022-32914)

  - The issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7, macOS     Ventura 13, watchOS 9, macOS Monterey 12.6, tvOS 16. An app may be able to execute arbitrary code with     kernel privileges. (CVE-2022-32866)

  - The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6, iOS     15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app may be able to execute arbitrary code with kernel     privileges. (CVE-2022-32911)

  - The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.1, macOS Big Sur     11.7, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Monterey 12.6. An app may be able to     execute arbitrary code with kernel privileges. (CVE-2022-32924)

  - The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6, iOS     15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app may be able to disclose kernel memory.
    (CVE-2022-32864)

  - The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7     and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An application may be able to execute arbitrary code with     kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
    (CVE-2022-32917)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.6, iOS     15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An app may be able to read sensitive location     information. (CVE-2022-32883)

  - A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS     Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. A user may be able to elevate     privileges. (CVE-2022-32908)

  - An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer     overflow. (CVE-2021-39537)

  - This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. A user in     a privileged network position may be able to track user activity. (CVE-2022-42818)

  - A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6,     macOS Big Sur 11.7. An app may be able to gain elevated privileges. (CVE-2022-32900)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.7, macOS     Ventura 13, iOS 16, watchOS 9, macOS Monterey 12.6, tvOS 16. An app may be able to modify protected parts     of the file system. (CVE-2022-32881)

  - An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big     Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, macOS Monterey 12.6. An app may be able to     bypass code signing checks. (CVE-2022-42793)

  - A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7,     macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, macOS Monterey 12.6. A user may be able to view     restricted content from the lock screen. (CVE-2022-42790)

  - The issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7, macOS     Ventura 13, macOS Monterey 12.6. A remote user may be able to cause kernel code execution.
    (CVE-2022-32934)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. (CVE-2022-0261, CVE-2022-0359,     CVE-2022-0361, CVE-2022-2125)

  - Heap-based Buffer Overflow in vim/vim prior to 8.2. (CVE-2022-0318)

  - Out-of-bounds Read in vim/vim prior to 8.2. (CVE-2022-0319)

  - Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
    (CVE-2022-0351)

  - Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. (CVE-2022-0368, CVE-2022-2126)

  - Heap-based Buffer Overflow in GitHub repository vim prior to 8.2. (CVE-2022-0392)

  - Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This     vulnerability is capable of crashing the software, memory modification, and possible remote execution.
    (CVE-2022-1720)

  - Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. (CVE-2022-2000)

  - Use After Free in GitHub repository vim/vim prior to 8.2. (CVE-2022-2042)

  - Buffer Over-read in GitHub repository vim/vim prior to 8.2. (CVE-2022-2124)

  - A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7,     macOS Ventura 13, iOS 16, watchOS 9, macOS Monterey 12.6. An app may be able to read sensitive location     information. (CVE-2022-32875)

  - An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big     Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, watchOS 9, macOS Monterey 12.6, tvOS 16.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2022-32888)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2947 advisory.

    Multiple security vulnerabilities have been discovered in vim, an enhanced vi editor. Buffer overflows,     out-of-bounds reads and Null pointer dereferences may lead to a denial of service (application crash) or     other unspecified impact. For Debian 9 stretch, these problems have been fixed in version     2:8.0.0197-4+deb9u5. We recommend that you upgrade your vim packages. For the detailed security status of     vim please refer to its security tracker page at: https://security-tracker.debian.org/tracker/vim Further     information about Debian LTS security advisories, how to apply these updates to your system and frequently     asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3182 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3182-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     November 08, 2022                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : vim     Version        : 2:8.1.0875-5+deb10u3     CVE ID         : CVE-2021-3927 CVE-2021-3928 CVE-2021-3974 CVE-2021-3984                      CVE-2021-4019 CVE-2021-4069 CVE-2021-4192 CVE-2021-4193                      CVE-2022-0213 CVE-2022-0261 CVE-2022-0319 CVE-2022-0351                      CVE-2022-0359 CVE-2022-0361 CVE-2022-0368 CVE-2022-0408                      CVE-2022-0413 CVE-2022-0417 CVE-2022-0443 CVE-2022-0554                      CVE-2022-0572 CVE-2022-0685 CVE-2022-0714 CVE-2022-0729                      CVE-2022-0943 CVE-2022-1154 CVE-2022-1616 CVE-2022-1720                      CVE-2022-1851 CVE-2022-1898 CVE-2022-1968 CVE-2022-2285                      CVE-2022-2304 CVE-2022-2598 CVE-2022-2946 CVE-2022-3099                      CVE-2022-3134 CVE-2022-3234 CVE-2022-3324 CVE-2022-3705

    Multiple security vulnerabilities have been discovered in vim, an enhanced     vi editor. Buffer overflows, out-of-bounds reads and use-after-free may lead to     a denial-of-service (application crash) or other unspecified impact.

    For Debian 10 buster, these problems have been fixed in version     2:8.1.0875-5+deb10u3.

    We recommend that you upgrade your vim packages.

    For the detailed security status of vim please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/vim

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1567 advisory.

    2024-02-14: CVE-2021-3778 was added to this advisory.

    2024-02-14: CVE-2021-3875 was added to this advisory.

    2024-02-14: CVE-2021-3872 was added to this advisory.

    A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a     specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability. (CVE-2021-3778)

    An out-of-bounds write flaw was found in vim's drawscreen.c win_redr_status() function. This flaw allows     an attacker to trick a user to open a crafted file with specific arguments in vim, triggering an out-of-     bounds write. The highest threat from this vulnerability is to confidentiality, integrity, and system     availability. (CVE-2021-3872)

    There's an out-of-bounds read flaw in Vim's ex_docmd.c. An attacker who is capable of tricking a user into     opening a specially crafted file could trigger an out-of-bounds read on a memmove operation, potentially     causing an impact to application availability. (CVE-2021-3875)

    It was found that vim was vulnerable to use-after-free flaw in the way it was treating allocated lines in     user functions. A specially crafted file could crash the vim process or possibly lead to other undefined     behaviors. (CVE-2022-0156)

    It was found that vim was vulnerable to a 1 byte heap based out of bounds read flaw in the     `compile_get_env()` function. A file could use that flaw to disclose 1 byte of vim's internal memory.
    (CVE-2022-0158)

    A flaw was found in vim.  The vulnerability occurs due to not checking the length for the NameBuff     function, which can lead to a heap buffer overflow. This flaw allows an attacker to input a specially     crafted file, leading to a crash or code execution. (CVE-2022-0213)

    A heap based out-of-bounds write flaw was found in vim's ops.c. This flaw allows an attacker to trick a     user to open a crafted file triggering an out-of-bounds write. This vulnerability is capable of crashing     software, modify memory, and possible code execution. (CVE-2022-0261)

    A flaw was found in vim.  The vulnerability occurs due to reading beyond the end of a line in the     utf_head_off function, which can lead to a heap buffer overflow. This flaw allows an attacker to input a     specially crafted file, leading to a crash or code execution. (CVE-2022-0318)

    A flaw was found in vim. The vulnerability occurs due to too many recursions, which can lead to a     segmentation fault. This flaw allows an attacker to input a specially crafted file, leading to a crash or     code execution. (CVE-2022-0351)

    A flaw was found in vim. The vulnerability occurs due to Illegal memory access with large tabstop in Ex     mode, which can lead to a heap buffer overflow. This flaw allows an attacker to input a specially crafted     file, leading to a crash or code execution. (CVE-2022-0359)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - vim is vulnerable to Out-of-bounds Read (CVE-2021-4166, CVE-2021-4193)

  - vim is vulnerable to Use After Free (CVE-2021-4192)

  - vim is vulnerable to Heap-based Buffer Overflow (CVE-2022-0213)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. (CVE-2022-0261, CVE-2022-0359,     CVE-2022-0361, CVE-2022-0572)

  - Heap-based Buffer Overflow in vim/vim prior to 8.2. (CVE-2022-0318)

  - Out-of-bounds Read in vim/vim prior to 8.2. (CVE-2022-0319)

  - Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
    (CVE-2022-0351)

  - Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. (CVE-2022-0368)

  - Heap-based Buffer Overflow in GitHub repository vim prior to 8.2. (CVE-2022-0392)

  - Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. (CVE-2022-0408, CVE-2022-0629)

  - Use After Free in GitHub repository vim/vim prior to 8.2. (CVE-2022-0413, CVE-2022-0443)

  - Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2. (CVE-2022-0417)

  - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2. (CVE-2022-0554)

  - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418. (CVE-2022-0685)

  - Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436. (CVE-2022-0714)

  - Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. (CVE-2022-0729)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
165106	macOS 12.x < 12.6 Multiple Vulnerabilities (HT213444)	Nessus	MacOS X Local Security Checks	2022/9/15	2024/6/13	critical
158978	Debian DLA-2947-1 : vim - LTS security update	Nessus	Debian Local Security Checks	2022/3/16	2025/1/24	high
167256	Debian dla-3182 : vim - security update	Nessus	Debian Local Security Checks	2022/11/10	2025/1/22	high
158195	Amazon Linux AMI : vim (ALAS-2022-1567)	Nessus	Amazon Linux Local Security Checks	2022/2/19	2024/12/11	critical
163127	EulerOS Virtualization 2.10.0 : vim (EulerOS-SA-2022-2042)	Nessus	Huawei Local Security Checks	2022/7/14	2023/10/18	critical

检测

插件搜索

critical

high

high

critical

critical