The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory.

  - Vulnerability in the Oracle Database - Machine Learning for Python (Python) component of Oracle Database     Server. The supported version that is affected is 21c. Easily exploitable vulnerability allows low     privileged attacker having Database User privilege with network access via Oracle Net to compromise Oracle     Database - Machine Learning for Python (Python). Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Database -     Machine Learning for Python (Python). (CVE-2021-3737)

  - Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged     attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database     RDBMS Security. Successful attacks require human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification     access to critical data or all Oracle Database RDBMS Security accessible data as well as unauthorized read     access to a subset of Oracle Database RDBMS Security accessible data. (CVE-2023-21829)

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are     19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure     privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Java VM. (CVE-2022-39429)

  - Vulnerability in the Oracle Database Data Redaction component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged     attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database     Data Redaction. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Oracle Database Data Redaction accessible data. (CVE-2023-21827)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

Note that Nessus relies on the presence of the package as reported by the vendor.

Fixed CVE-2020-10543, CVE-2020-10878 and CVE-2020-12723

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1678 advisory.

    Perl is a high-level programming language that is commonly used for system administration utilities and     web programming.

    Security Fix(es):

    * perl: heap-based buffer overflow in regular expression compiler leads to DoS (CVE-2020-10543)

    * perl: corruption of intermediate language state of compiled regular expression due to integer overflow     leads to DoS (CVE-2020-10878)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4602-1 advisory.

    ManhND discovered that Perl incorrectly handled certain regular expressions. In environments where     untrusted regular expressions are evaluated, a remote attacker could possibly use this issue to cause Perl     to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2020-10543)

    Hugo van der Sanden and Slaven Rezic discovered that Perl incorrectly handled certain regular expressions.
    In environments where untrusted regular expressions are evaluated, a remote attacker could possibly use     this issue to cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2020-10878)

    Sergey Aleynikov discovered that Perl incorrectly handled certain regular expressions. In environments     where untrusted regular expressions are evaluated, a remote attacker could possibly use this issue to     cause Perl to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2020-12723)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Heap-based buffer overflow in the pack function in Perl     before 5.26.2 allows context-dependent attackers to     execute arbitrary code via a large item     count.(CVE-2018-6913)

  - regcomp.c in Perl before 5.30.3 allows a buffer     overflow via a crafted regular expression because of     recursive S_study_chunk calls.(CVE-2020-12723)

  - Perl before 5.30.3 on 32-bit platforms allows a     heap-based buffer overflow because nested regular     expression quantifiers have an integer     overflow.(CVE-2020-10543)

  - Perl before 5.30.3 has an integer overflow related to     mishandling of a 'PL_regkind[OP(n)] == NOTHING'     situation. A crafted regular expression could lead to     malformed bytecode with a possibility of instruction     injection.(CVE-2020-10878)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10543 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10543 Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. Perl before 5.30.3 has an integer overflow related to mishandling of a 'PL_regkind[OP(n)] == NOTHING' situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

The version of perl installed on the remote host is prior to 5.16.3-299. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1610 advisory.

    Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular     expression quantifiers have an integer overflow. (CVE-2020-10543)

    Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

    regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of     recursive S_study_chunk calls. (CVE-2020-12723)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9238 advisory.

    - Backport patch for CVE-2020-10543    [Orabug: 32855589]
    - Backport patch for CVE-2020-10878    [Orabug: 32855589]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Perl might allow context-dependent attackers to bypass     the taint protection mechanism in a child process via     duplicate environment variables in envp.(CVE-2016-2381)

  - Perl before 5.30.3 on 32-bit platforms allows a     heap-based buffer overflow because nested regular     expression quantifiers have an integer     overflow.(CVE-2020-10543)

  - Perl before 5.30.3 has an integer overflow related to     mishandling of a 'PL_regkind[OP(n)] == NOTHING'     situation. A crafted regular expression could lead to     malformed bytecode with a possibility of instruction     injection.(CVE-2020-10878)

  - regcomp.c in Perl before 5.30.3 allows a buffer     overflow via a crafted regular expression because of     recursive S_study_chunk calls.(CVE-2020-12723)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202006-03 (Perl: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Perl. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

An update of the perl package has been released.

The remote NewStart CGSL host, running version MAIN 6.02, has perl packages installed that are affected by multiple vulnerabilities:

  - Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular     expression quantifiers have an integer overflow. (CVE-2020-10543)

  - Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1678 advisory.

  - Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular     expression quantifiers have an integer overflow. (CVE-2020-10543)

  - Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
170191	Oracle Database Server for Unix (Jan 2023 CPU)	Nessus	Databases	2023/1/20	2023/10/24	high
223007	Linux Distros Unpatched Vulnerability : CVE-2020-10878	Nessus	Misc.	2025/3/4	2025/10/28	high
137437	Fedora 31 : 4:perl (2020-fd73c08076)	Nessus	Fedora Local Security Checks	2020/6/17	2026/4/30	high
149678	RHEL 8 : perl (RHSA-2021:1678)	Nessus	Red Hat Local Security Checks	2021/5/19	2026/4/30	high
141913	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Perl vulnerabilities (USN-4602-1)	Nessus	Ubuntu Local Security Checks	2020/10/27	2024/8/27	high
142313	EulerOS 2.0 SP2 : perl (EulerOS-SA-2020-2380)	Nessus	Huawei Local Security Checks	2020/11/3	2022/12/5	critical
144314	AIX 7.1 TL 5 : perl (IJ26985)	Nessus	AIX Local Security Checks	2020/12/16	2024/2/6	high
146623	Amazon Linux 2 : perl (ALAS-2021-1610)	Nessus	Amazon Linux Local Security Checks	2021/2/19	2024/12/11	high
149822	Oracle Linux 6 : perl (ELSA-2021-9238)	Nessus	Oracle Linux Local Security Checks	2021/5/21	2024/10/22	high
151395	EulerOS Virtualization 3.0.2.2 : perl (EulerOS-SA-2021-2157)	Nessus	Huawei Local Security Checks	2021/7/6	2023/12/11	high
137157	Fedora 32 : 4:perl (2020-4021bf2ae8)	Nessus	Fedora Local Security Checks	2020/6/5	2026/4/30	high
137383	GLSA-202006-03 : Perl: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/6/12	2026/4/30	high
137719	Photon OS 2.0: Perl PHSA-2020-2.0-0254	Nessus	PhotonOS Local Security Checks	2020/6/22	2026/4/30	high
154556	NewStart CGSL MAIN 6.02 : perl Multiple Vulnerabilities (NS-SA-2021-0134)	Nessus	NewStart CGSL Local Security Checks	2021/10/27	2026/4/30	high
184937	Rocky Linux 8 : perl (RLSA-2021:1678)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2026/4/30	high

检测

插件搜索

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high