The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2014-445:02 advisory.

    LZO is a portable lossless data compression library written in ANSI C.
    It offers pretty fast compression and very fast decompression.
    Decompression requires no memory. In addition there are slower     compression levels achieving a quite competitive compression ratio     while still decompressing at this very high speed.
    Security issues fixed with this release:
    CVE-2014-4607
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10973:08 advisory.

    * CVE-2014-4607: minilzo: Update to minilzo-2.08 to fix integer overflow     CVE(s):
    CVE-2014-4607     Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit     platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit     platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run.
    (CVE-2014-4607)

Note that Nessus relies on the presence of the package as reported by the vendor.

Avoid possible denial of service or code execution via integer overflow by using (patched) system minilzo (instead of vulnerable bundled copy).

See also: http://www.kde.org/info/security/advisory-20140803-1.txt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix CVE-2014-4607 by upgrading to minilzo 2.08

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An integer overflow flaw was found in the way the lzo library decompressed certain archives compressed with the LZO algorithm. An attacker could create a specially crafted LZO-compressed input that, when decompressed by an application using the lzo library, would cause that application to crash or, potentially, execute arbitrary code.
(CVE-2014-4607)

Security fix for CVE-2014-4607

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix integer overflow in lzo1x_decompress_safe() allowing denial of service or code execution.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated liblzo packages fix security vulnerability :

An integer overflow in liblzo before 2.07 allows attackers to cause a denial of service or possibly code execution in applications performing LZO decompression on a compressed payload from the attacker (CVE-2014-4607).

An integer overflow flaw was found in the way the lzo library decompressed certain archives compressed with the LZO algorithm. An attacker could create a specially crafted LZO-compressed input that, when decompressed by an application using the lzo library, would cause that application to crash or, potentially, execute arbitrary code.
(CVE-2014-4607 - reserved)

The remote NewStart CGSL host, running version MAIN 6.06, has grub2 packages installed that are affected by multiple vulnerabilities:

  - Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass     authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace     characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get     function in lib/crypto.c, which trigger an Off-by-two or Out of bounds overwrite memory error.
    (CVE-2015-8370)

  - Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit     platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run.
    (CVE-2014-4607)

  - A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under     resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and     leaving the system unbootable on subsequent reboots. (CVE-2019-14865)

  - A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper     the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to     load an untrusted or modified kernel, an attacker would first need to establish access to the system such     as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a     networked system with root access. With this access, an attacker could then craft a string to cause a     buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The     highest threat from this vulnerability is to data confidentiality and integrity as well as system     availability. (CVE-2020-10713)

  - In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on     the requested allocation size. This leads the function to return invalid memory allocations which can be     further used to cause possible integrity, confidentiality and availability impacts during the boot     process. (CVE-2020-14308)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New upstream

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An integer overflow flaw was found in the way the lzo     library decompressed certain archives compressed with     the LZO algorithm. An attacker could create a specially     crafted LZO-compressed input that, when decompressed by     an application using the lzo library, would cause that     application to crash or, potentially, execute arbitrary     code.(CVE-2014-4607)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
289899	MiracleLinux 4 : lzo-2.03-3.1.AXS4.1 (AXSA:2014-445:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
283458	MiracleLinux 7 : grub2-2.02-0.87.14.0.5.el7.AXS7 (AXSA:2025-10973:08)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/13	high
218349	Linux Distros Unpatched Vulnerability : CVE-2014-4607	Nessus	Misc.	2025/3/4	2025/9/3	high
77225	Fedora 19 : krfb-4.11.5-3.fc19 (2014-9151)	Nessus	Fedora Local Security Checks	2014/8/16	2021/1/11	medium
77443	Fedora 20 : distcc-3.2rc1-8.fc20 (2014-9591)	Nessus	Fedora Local Security Checks	2014/8/30	2021/1/11	medium
78316	Amazon Linux AMI : lzo (ALAS-2014-373)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2020/2/18	high
81529	Fedora 20 : dump-0.4-0.24.b44.fc20 (2015-1007)	Nessus	Fedora Local Security Checks	2015/2/26	2021/1/11	medium
82183	Debian DLA-35-1 : lzo2 security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	high
82403	Mandriva Linux Security Advisory : liblzo (MDVSA-2015:150)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	high
88569	F5 Networks BIG-IP : LZO vulnerability (K95698826)	Nessus	F5 Networks Local Security Checks	2016/2/4	2021/3/10	high
266249	NewStart CGSL MAIN 6.06 : grub2 Multiple Vulnerabilities (NS-SA-2025-0221)	Nessus	NewStart CGSL Local Security Checks	2025/9/30	2025/10/1	high
76353	Fedora 20 : lzo-2.08-1.fc20 (2014-7926)	Nessus	Fedora Local Security Checks	2014/7/3	2021/1/11	medium
126862	EulerOS 2.0 SP2 : grub2 (EulerOS-SA-2019-1735)	Nessus	Huawei Local Security Checks	2019/7/22	2024/5/9	high

检测

插件搜索

high

high

high

medium

medium

high

medium

high

high

high

high

medium

high