The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-12980 advisory.

    [2.28-251.0.3.25]
    - Forward port of Oracle patches       Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       Oracle history:
      June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.3.22
      - Forward port of Oracle patches         Reviewed-by: David Faust <david.faust@oracle.com>       April-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.3.16
      - Forward port of Oracle patches         Reviewed-by: Elena Zannoni <elena.zannoni@oracle.com>       March-26-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.3.14
      - OraBug: 36625686 Add MTE support on string functions         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.14
      - Forward port of Oracle patches         Reviewed-by: David Faust <david.faust@oracle.com>       February-19-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.13
      - Forward port of Oracle patches         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       January-28-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.11
      - Forward port of Oracle patches         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       September-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.5
      - Forward port of Oracle patches over 2.28-251.5         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.28-251.0.2.4
      - Forward port of Oracle patches over 2.28-251.4         Reviewed-by: David Faust <david.faust@oracle.com>       May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.2
      - Forward port of Oracle patches over 2.28-251.2         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       May-23-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.1
      - Forward port of Oracle patches over 2.28-251.1         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       May-22-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2
      - Forward port of Oracle patches for ol8-u10         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.1
      - Forward port of Oracle patches for ol8-u10-beta         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-5-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-236.0.1.12
      - Forward port of Oracle patches.
        Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       November-14-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-236.0.1.7
      - Forward port of Oracle patches.
        Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-236.0.1.6
      - Forward port of Oracle patches.
        Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-21-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-225.0.3
      - OraBug 35317410 Glibc tunable to disable huge pages on pthread_create stacks
      - Created tunable glibc.pthread.stack_hugetlb to control when hugepages         can be used for stack allocation.
      - In case THP are enabled and glibc.pthread.stack_hugetlb is set to         0, glibc will madvise the kernel not to use allow hugepages for stack         allocations.
        Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-11-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-225.0.2
      - OraBug: 35268809 Fixed initialization of VDSO for tcache_key_initialize         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-225.0.1
      - Merge of Oracle patches for ol8u8 beta         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.28-211.0.1
      - Merge of Oracle patches for ol8u7 beta         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       August-8-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.28-189.5.0.2
      - Enable VDSO on x86_64, aarch64, i386, arm, and mips statically linked programs.
      - These changes enable reading the realtime clock without a kernel syscall.
        OraBug: 30478315         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       May-2-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.28-199.0.1
      - Merge of patches from c8s 199 with ol8u6 beta         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
      - Update siginfo constants from linux kernel (OraBug: 33734528)
      - Remove limit on MALLOC_MMAP_THRESHOLD tunable (Orabug: 29630826)
      - Provide glibc.pthread.mutex_spin_count tunable for pthread adaptive
      - spin mutex (Orabug: 27982358)         Reviewed-by: Qing Zhao <qing.zhao@oracle.com>
      - add Ampere emag  to tunable cpu list (Patrick McGehearty)
      - add optimized memset for emag
      - add an ASIMD variant of strlen for falkor         Orabug: 2700101.
      - Modify glibc-ora28849085.patch so it works with RHCK kernels. (Orabug: 28849085)
      - Make _IO_funlockfile match __funlockfile and _IO_flockfile match __flockfile         Both should test           if (stream->_flags & _IO_USER_LOCK) == 0)
            _IO_lock_lock (*stream->_lock);
        OraBug: 28481550.
        Reviewed-by: Qing Zhao <qing.zhao@oracle.com>

    [2.28-251.25]
    - CVE-2025-8058: Double free in regcomp (RHEL-105326)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some     previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed     malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how     the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.
    (CVE-2025-8058)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2025:0138 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-0395:
    When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough     space for the assertion failure message string and size information, which may lead to a buffer overflow     if the message string size aligns to page size.

    CVE-2025-4802:
    Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38     allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries     that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as     getaddrinfo).

    CVE-2025-8058:
    The regcomp function in the GNU C library version from 2.4 to 2.41 is     subject to a double free if some previous allocation fails. It can be     accomplished either by a malloc failure or by using an interposed malloc     that injects random malloc failures. The double free can allow buffer     manipulation depending of how the regex is constructed. This issue     affects all architectures and ABIs supported by the GNU C library.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02964-1 advisory.

    - CVE-2025-8058: Fixed double-free after allocation failure in regcomp. (bsc#1246965)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the glibc package has been released.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:12980 advisory.

    * glibc: Double free in glibc (CVE-2025-8058)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of glibc installed on the remote host is prior to 2.26-64. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3040 advisory.

    The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some     previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed     malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how     the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.
    (CVE-2025-8058)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
244055	Oracle Linux 8 : glibc (ELSA-2025-12980)	Nessus	Oracle Linux Local Security Checks	2025/8/6	2025/8/6	medium
249696	Linux Distros Unpatched Vulnerability : CVE-2025-8058	Nessus	Misc.	2025/8/15	2025/9/25	medium
252263	Alibaba Cloud Linux 3 : 0138: glibc (ALINUX3-SA-2025:0138)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/8/19	2025/8/19	medium
255215	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : glibc (SUSE-SU-2025:02964-1)	Nessus	SuSE Local Security Checks	2025/8/26	2025/8/26	medium
260439	Photon OS 5.0: Glibc PHSA-2025-5.0-0609	Nessus	PhotonOS Local Security Checks	2025/9/2	2025/9/2	medium
261715	RockyLinux 8 : glibc (RLSA-2025:12980)	Nessus	Rocky Linux Local Security Checks	2025/9/8	2025/9/8	medium
271762	Amazon Linux 2 : glibc, --advisory ALAS2-2025-3040 (ALAS-2025-3040)	Nessus	Amazon Linux Local Security Checks	2025/10/28	2025/10/28	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium