The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1585 advisory.

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-     based buffer over-read via an attempted case-insensitive regular-expression match. (CVE-2019-9169)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance     the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a     different vulnerability from CVE-2016-10228. (CVE-2020-27618)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2021-3326)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1780:06 advisory.

    * glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR     encoding (CVE-2019-25013)
      * glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer     over-read (CVE-2019-9169)
      * glibc: assertion failure in ISO-2022-JP-3 gconv module related to combining characters (CVE-2021-3326)
      * glibc: iconv program can hang when invoked with the -c option (CVE-2016-10228)
      * glibc: iconv when processing invalid multi-byte input sequences fails to advance the input state,     which could result in an infinite loop (CVE-2020-27618)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has glibc packages installed that are affected by multiple vulnerabilities:

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance     the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a     different vulnerability from CVE-2016-10228. (CVE-2020-27618)

  - The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when     processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in     degraded service or Denial of Service on the local system. This is related to netgroupcache.c.
    (CVE-2021-27645)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2021-3326)

  - The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It     may use the notification thread attributes object (passed through its struct sigevent parameter) after it     has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified     other impact. (CVE-2021-33574)

  - A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory     corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and     size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and     escalate their privileges on the system. (CVE-2021-3999)

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.32 and earlier, when processing invalid input     sequences in the ISO-2022-JP-3 encoding, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2021-3326)

  - A flaw was found in glibc. When processing input in the     EUC-KR encoding, an invalid input sequence could cause     glibc to read beyond the end of a buffer, resulting in     a segmentation fault. The highest threat from this     vulnerability is to system     availability.(CVE-2019-25013)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the glibc package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
157688	AlmaLinux 8 : glibc (ALSA-2021:1585)	Nessus	Alma Linux Local Security Checks	2022/2/9	2023/11/10	critical
291733	MiracleLinux 8 : glibc-2.28-151.el8 (AXSA:2021-1780:06)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	critical
167455	NewStart CGSL MAIN 6.02 : glibc Multiple Vulnerabilities (NS-SA-2022-0085)	Nessus	NewStart CGSL Local Security Checks	2022/11/14	2023/10/4	critical
148587	EulerOS Virtualization 2.9.0 : glibc (EulerOS-SA-2021-1750)	Nessus	Huawei Local Security Checks	2021/4/15	2022/5/10	high
148630	EulerOS Virtualization 2.9.1 : glibc (EulerOS-SA-2021-1713)	Nessus	Huawei Local Security Checks	2021/4/15	2022/5/10	high
148029	Photon OS 4.0: Glibc PHSA-2021-4.0-0005	Nessus	PhotonOS Local Security Checks	2021/3/24	2026/11/2	high

检测

插件搜索

critical

critical

critical

high

high

high