According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when     processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in     degraded service or Denial of Service on the local system. This is related to netgroupcache.c.
    (CVE-2021-27645)

  - A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory     corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and     size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and     escalate their privileges on the system. (CVE-2021-3999)

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

SunOS 5.10_x86: nss_dns patch.
Date this patch was last updated by Sun : Jan/16/23

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-060 advisory.

    A stack based buffer-overflow vulnerability was found in the deprecated compatibility function     clnt_create() in the sunrpc's clnt_gen.c module of the GNU C Library (aka glibc) through 2.34. This     vulnerability copies its hostname argument onto the stack without validating its length, which may result     in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with     a stack protector enabled) lead to arbitrary code execution. (CVE-2022-23219)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has glibc packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory     corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and     size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and     escalate their privileges on the system. (CVE-2021-3999)

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0203 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2021-3999:
      A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory     corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and     size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and     escalate their privileges on the system.

      CVE-2022-23218:
      The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka     glibc) through 2.34 copies its path argument on the stack without validating its length, which may result     in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with     a stack protector enabled) arbitrary code execution.

      CVE-2022-23219:
      The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3103:01 advisory.

    * glibc: Off-by-one buffer overflow/underflow in getcwd() (CVE-2021-3999)
      * glibc: Stack-based buffer overflow in svcunix_create via long pathnames (CVE-2022-23218)
      * glibc: Stack-based buffer overflow in sunrpc clnt_create via a long pathname (CVE-2022-23219)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5310-1 advisory.

    Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly     handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to     hang or crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu     20.04 LTS. (CVE-2016-10228, CVE-2019-25013, CVE-2020-27618, CVE-2020-29562, CVE-2021-3326)

    Jason Royes and Samuel Dytrych discovered that the GNU C Library incorrectly handled signed comparisons on     ARMv7 targets. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a     denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and     Ubuntu 20.04 LTS. (CVE-2020-6096)

    It was discovered that the GNU C Library nscd daemon incorrectly handled certain netgroup lookups. An     attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of     service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-27645)

    It was discovered that the GNU C Library wordexp function incorrectly handled certain patterns. An     attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or     possibly obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
    (CVE-2021-35942)

    It was discovered that the GNU C Library realpath function incorrectly handled return values. An attacker     could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 21.10.
    (CVE-2021-3998)

    It was discovered that the GNU C library getcwd function incorrectly handled buffers. An attacker could     use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2021-3999)

    It was discovered that the GNU C Library sunrpc module incorrectly handled buffer lengths. An attacker     could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service.
    (CVE-2022-23218, CVE-2022-23219)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0832-1 advisory.

  - The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers     to cause a denial of service (assertion failure and application crash) via vectors related to extended     regular expression processing. (CVE-2015-8985)

  - A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory     corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and     size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and     escalate their privileges on the system. (CVE-2021-3999)

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0441-1 advisory.

  - A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory     corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and     size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and     escalate their privileges on the system. (CVE-2021-3999)

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5310-2 advisory.

    USN-5310-1 fixed several vulnerabilities in GNU. This update provides the corresponding update for Ubuntu     16.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0909-1 advisory.

  - A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory     corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and     size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and     escalate their privileges on the system. (CVE-2021-3999)

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:0896 advisory.

  - A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory     corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and     size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and     escalate their privileges on the system. (CVE-2021-3999)

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the glibc package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
160598	EulerOS Virtualization 2.9.0 : glibc (EulerOS-SA-2022-1629)	Nessus	Huawei Local Security Checks	2022/5/5	2023/10/30	critical
165975	EulerOS Virtualization 3.0.6.0 : glibc (EulerOS-SA-2022-2560)	Nessus	Huawei Local Security Checks	2022/10/10	2023/10/10	critical
172382	Solaris 10 (x86) : 148420-04	Nessus	Solaris Local Security Checks	2023/3/9	2023/10/18	critical
173168	Amazon Linux 2023 : compat-libpthread-nonshared, glibc, glibc-all-langpacks (ALAS2023-2023-060)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2024/12/11	critical
187336	NewStart CGSL MAIN 6.06 : glibc Multiple Vulnerabilities (NS-SA-2023-0076)	Nessus	NewStart CGSL Local Security Checks	2023/12/27	2023/12/27	critical
239848	TencentOS Server 3: glibc (TSSA-2022:0203)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	critical
294694	MiracleLinux 8 : glibc-2.28-164.el8.3 (AXSA:2022-3103:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
158502	Ubuntu 18.04 LTS / 20.04 LTS : GNU C Library vulnerabilities (USN-5310-1)	Nessus	Ubuntu Local Security Checks	2022/3/1	2025/9/3	critical
158909	SUSE SLES15 Security Update : glibc (SUSE-SU-2022:0832-1)	Nessus	SuSE Local Security Checks	2022/3/15	2023/7/14	critical
158126	SUSE SLES12 Security Update : glibc (SUSE-SU-2022:0441-1)	Nessus	SuSE Local Security Checks	2022/2/17	2023/7/13	critical
158680	Ubuntu 16.04 ESM : GNU C Library vulnerabilities (USN-5310-2)	Nessus	Ubuntu Local Security Checks	2022/3/7	2024/10/29	critical
159130	SUSE SLES12 Security Update : glibc (SUSE-SU-2022:0909-1)	Nessus	SuSE Local Security Checks	2022/3/22	2023/7/14	critical
184981	Rocky Linux 8 : glibc (RLSA-2022:0896)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2023/11/7	critical
203392	Photon OS 4.0: Glibc PHSA-2022-4.0-0155	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	critical
247214	Linux Distros Unpatched Vulnerability : CVE-2022-23219	Nessus	Misc.	2025/8/10	2025/8/10	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical