The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50221 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * rubygem-katello: missing repository authorization in content_uploads exposes cross-product content     existence (CVE-2026-12515)
    * openvox-server: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332)
    * rubygem-faraday: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
    * rubygem-faraday_middleware: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
    * rubygem-faraday-cookie_jar: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
    * rubygem-faraday-em_http: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
    * rubygem-faraday-em_synchrony: Faraday: Denial of Service via crafted nested query strings     (CVE-2026-54297)
    * rubygem-faraday-excon: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
    * rubygem-faraday-httpclient: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
    * rubygem-faraday-multipart: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
    * rubygem-faraday-net_http: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
    * rubygem-faraday-net_http_persistent: Faraday: Denial of Service via crafted nested query strings     (CVE-2026-54297)
    * rubygem-faraday-patron: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
    * rubygem-faraday-rack: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
    * rubygem-faraday-retry: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297)
    * rubygem-nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling     (CVE-2026-57236)
    * python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059)
    * python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files     (CVE-2026-54060)
    * python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)
    * python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-     glyph images into a combined bitmap with Image.new(1, (xsize, ysize)) without calling     Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or     saving. This issue is fixed in version 12.3.0. (CVE-2026-54060)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8999-1 advisory.

    It was discovered that Pillow incorrectly handled map stride values when loading certain McIdas AREA     images. An attacker could possibly use this issue to obtain sensitive information or cause a denial of     service. (CVE-2026-54058)

    It was discovered that Pillow did not properly check for decompression bombs when processing font files.
    An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a     denial of service. (CVE-2026-54059, CVE-2026-54060, CVE-2026-55379)

    It was discovered that Pillow did not properly check for decompression bombs when loading GD image files.
    An attacker could possibly use this issue to cause Pillow to consume excessive memory, resulting in a     denial of service. (CVE-2026-55380)

    It was discovered that Pillow incorrectly validated filter sizes in the rank filter implementation. An     attacker could possibly use this issue to cause Pillow to crash or execute arbitrary code.
    (CVE-2026-59197)

    It was discovered that Pillow incorrectly handled image coordinate calculations. An attacker could     possibly use this issue to cause Pillow to crash. (CVE-2026-59199)

    It was discovered that Pillow did not properly limit the size of decompressed PDF stream data. An attacker     could possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of     service. (CVE-2026-59200)

    It was discovered that Pillow incorrectly parsed EPS files containing a negative byte count in the     BeginBinary directive. An attacker could possibly use this issue to cause Pillow to hang, resulting in a     denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-59203)

    It was discovered that Pillow incorrectly accumulated JPEG2000 tile component widths. An attacker could     possibly use this issue to cause Pillow to consume excessive memory, resulting in a denial of service.
    (CVE-2026-59204)

    It was discovered that Pillow incorrectly validated image mode compatibility in color management     transforms. An attacker could possibly use this issue to cause Pillow to crash or execute arbitrary code.
    (CVE-2026-59205)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
331975	RHEL 9 : Satellite 6.19.3 Async Update (Important) (RHSA-2026:50221)	Nessus	Red Hat Local Security Checks	2026/8/4	2026/10/27	medium
325352	Linux Distros Unpatched Vulnerability : CVE-2026-54060	Nessus	Misc.	2026/7/7	2026/11/5	high
376498	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Pillow vulnerabilities (USN-8999-1)	Nessus	Ubuntu Local Security Checks	2026/11/5	2026/11/5	high

检测

插件搜索

medium

high

high