遠端 Redhat Enterprise Linux 10 主機上安裝的套件受到 RHSA-2025:15020 公告中提及的一個弱點影響。

    Udisks 專案會提供精靈、工具和程式庫來存取及操控磁碟、儲存裝置與技術。

    安全性修正：

    * udisksUDisks 程序中的超出邊界讀取 (CVE-2025-8067)

    如需安全性問題的詳細資料，包括影響、CVSS 分數、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Oracle Linux 8 主機上安裝的套件受到 ELSA-2025-15017 公告中提及的一個弱點影響。

    [2.9.0-16.1]
    - udiskslinuxmanager為 fd_index 新增邊界下限檢查 (CVE-2025-8067) (RHEL-109408)

Tenable 已直接從 Oracle Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

因此，它會受到 ALAS2023-2025-1178 公告中提及的一個弱點影響。

    在 Udisks 程序中發現一個瑕疵其允許無權限的使用者使用 D-BUS 系統建立迴圈裝置。這可透過迴圈裝置處置程式來達成該處置程式可處理透過 D-BUS 介面傳送的要求。作為此處理的兩個參數它會接收檔案描述符號清單和指定迴圈裝置應備份至何處之檔案的索引。該函式本身會驗證索引值以確保其不大於允許的最大值。但是它無法驗證下限進而允許索引參數為負值。在這些情況下攻擊者可取得有權限使用者擁有的檔案之存取權造成 UDisks 程序損毀或執行本機權限提升。 (CVE-2025-8067)

Tenable 已直接從所測試產品的安全公告擷取前置描述區塊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端主機上安裝的 udisks2 版本比 2.7.3-9舊。因此，它會受到 ALAS2-2025-2992 公告中提及的一個弱點影響。

    在 Udisks 程序中發現一個瑕疵其允許無權限的使用者使用 D-BUS 系統建立迴圈裝置。這可透過迴圈裝置處置程式來達成該處置程式可處理透過 D-BUS 介面傳送的要求。作為此處理的兩個參數它會接收檔案描述符號清單和指定迴圈裝置應備份至何處之檔案的索引。該函式本身會驗證索引值以確保其不大於允許的最大值。但是它無法驗證下限進而允許索引參數為負值。在這些情況下攻擊者可取得有權限使用者擁有的檔案之存取權造成 UDisks 程序損毀或執行本機權限提升。 (CVE-2025-8067)

Tenable 已直接從所測試產品的安全公告擷取前置描述區塊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 9 主機上安裝的多個套件受到 RHSA-2025:16090 公告中提及的一個弱點影響。

    Udisks 專案會提供精靈、工具和程式庫來存取及操控磁碟、儲存裝置與技術。

    安全性修正：

    * udisks：UDisks 程序中的超出邊界讀取弱點 (CVE-2025-8067)

    如需安全性問題的詳細資料，包括影響、CVSS 分數、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-5989 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5989-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     August 28, 2025                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : udisks2     CVE ID         : CVE-2025-8067

    Michael Imfeld discovered an out-of-bounds read vulnerability in     udisks2, a D-Bus service to access and manipulate storage devices, which     may result in denial of service (daemon process crash), or in mapping an     internal file descriptor from the daemon process onto a loop device,     resulting in local privilege escalation.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 2.9.4-4+deb12u2.

    For the stable distribution (trixie), this problem has been fixed in     version 2.10.1-12.1+deb13u1.

    We recommend that you upgrade your udisks2 packages.

    For the detailed security status of udisks2 please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/udisks2

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 host has packages installed that are affected by a vulnerability as referenced in the USN-7723-1 advisory.

    Michael Imfeld discovered that UDisks did not check the validity of input data correctly when handling     files for loop devices. An attacker could possibly use this issue to cause a denial of service or execute     arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:03016-1 advisory.

    - CVE-2025-8067: Fixed missing bounds check can lead to out-of-bounds read in udisks daemon (bsc#1248502)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of udisks2 installed on the remote host is prior to 2.10.2 / 2.9.4. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-242-01 advisory.

    New udisks2 packages are available for Slackware 15.0 and -current to fix a security issue.

Tenable has extracted the preceding description block directly from the udisks2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-c866472f43 advisory.

    CVE-2025-8067 Out-Of-Bounds Read in UDisks Daemon

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:15020 advisory.

    The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage     devices, and technologies.

    Security Fix(es):

    * udisks: Out-of-bounds read in UDisks Daemon (CVE-2025-8067)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-15017 advisory.

    [2.9.0-16.1]
    - udiskslinuxmanager: Add lower bounds check to fd_index (CVE-2025-8067) (RHEL-109408)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-489ce6ee97 advisory.

    CVE-2025-8067 Out-Of-Bounds Read in UDisks Daemon

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1178 advisory.

    A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the     D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS     interface. As two of the parameters of this handle, it receives the file descriptor list and index     specifying the file where the loop device should be backed. The function itself validates the index value     to ensure it isn't bigger than the maximum value allowed. However, it fails to validate the lower bound,     allowing the index parameter to be a negative value. Under these circumstances, an attacker can cause the     UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by     privileged users. (CVE-2025-8067)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of udisks2 installed on the remote host is prior to 2.7.3-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2992 advisory.

    A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the     D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS     interface. As two of the parameters of this handle, it receives the file descriptor list and index     specifying the file where the loop device should be backed. The function itself validates the index value     to ensure it isn't bigger than the maximum value allowed. However, it fails to validate the lower bound,     allowing the index parameter to be a negative value. Under these circumstances, an attacker can cause the     UDisks daemon to crash or perform a local privilege escalation by gaining access to files owned by     privileged users. (CVE-2025-8067)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:16090 advisory.

    The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage     devices, and technologies.

    Security Fix(es):

    * udisks: Out-of-bounds read in UDisks Daemon (CVE-2025-8067)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
260456	RHEL 10udisks2 (RHSA-2025:15020)	Nessus	Red Hat Local Security Checks	2025/9/2	2025/9/2	high
260475	Oracle Linux 8udisks2 (ELSA-2025-15017)	Nessus	Oracle Linux Local Security Checks	2025/9/2	2025/9/2	high
264835	Amazon Linux 2023libudisks2、libudisks2-devel、udisks2 (ALAS2023-2025-1178)	Nessus	Amazon Linux Local Security Checks	2025/9/15	2025/10/30	high
265083	Amazon Linux 2udisks2 --advisory ALAS2-2025-2992 (ALAS-2025-2992)	Nessus	Amazon Linux Local Security Checks	2025/9/16	2025/10/30	high
265345	RHEL 9：udisks2 (RHSA-2025:16090)	Nessus	Red Hat Local Security Checks	2025/9/17	2025/9/17	high
258093	Debian dsa-5989 : gir1.2-udisks-2.0 - security update	Nessus	Debian Local Security Checks	2025/8/28	2025/8/28	high
258124	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 : UDisks vulnerability (USN-7723-1)	Nessus	Ubuntu Local Security Checks	2025/8/29	2025/8/29	high
258145	SUSE SLES15 Security Update : udisks2 (SUSE-SU-2025:03016-1)	Nessus	SuSE Local Security Checks	2025/8/30	2025/8/30	high
259933	Slackware Linux 15.0 / current udisks2 Vulnerability (SSA:2025-242-01)	Nessus	Slackware Local Security Checks	2025/8/31	2025/8/31	high
259944	Fedora 42 : udisks2 (2025-c866472f43)	Nessus	Fedora Local Security Checks	2025/8/31	2025/8/31	high
260456	RHEL 10 : udisks2 (RHSA-2025:15020)	Nessus	Red Hat Local Security Checks	2025/9/2	2025/9/2	high
260475	Oracle Linux 8 : udisks2 (ELSA-2025-15017)	Nessus	Oracle Linux Local Security Checks	2025/9/2	2025/9/2	high
264691	Fedora 43 : udisks2 (2025-489ce6ee97)	Nessus	Fedora Local Security Checks	2025/9/13	2025/9/13	high
264835	Amazon Linux 2023 : libudisks2, libudisks2-devel, udisks2 (ALAS2023-2025-1178)	Nessus	Amazon Linux Local Security Checks	2025/9/15	2025/10/30	high
265083	Amazon Linux 2 : udisks2, --advisory ALAS2-2025-2992 (ALAS-2025-2992)	Nessus	Amazon Linux Local Security Checks	2025/9/16	2025/10/30	high
265345	RHEL 9 : udisks2 (RHSA-2025:16090)	Nessus	Red Hat Local Security Checks	2025/9/17	2025/9/17	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high