According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign,     aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could     consequently result in a heap corruption.

    Note that the attacker must have control over both, the size as well as the alignment arguments of the     memalign function to be able to exploit this.  The size parameter must be close enough to PTRDIFF_MAX so     as to overflow size_t along with the large alignment argument.  This limits the malicious inputs for the     alignment for memalign to the range [162+ 1, 163] and exactly 163 for posix_memalign and     aligned_alloc.

    Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size,     block size, struct sizes) and is not attacker controlled, because of which this may not be easily     exploitable in practice.  An application bug could potentially result in the input alignment being too     large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent     libraries, but that is again an uncommon usage pattern given typical sources of alignments.(CVE-2026-0861)

    Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to     version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on     subsequent calls to wordfree may abort the process.(CVE-2025-15281)

    The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some     previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed     malloc  that injects random malloc failures. The double free can allow buffer manipulation depending of     how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C     library.(CVE-2025-8058)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the glibc package has been released.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007101 advisory.

    The regcomp function in the GNU C library version from 2.4 to 2.41 is     subject to a double free if some previous allocation fails. It can be     accomplished either by a malloc failure or by using an interposed malloc      that injects random malloc failures. The double free can allow buffer     manipulation depending of how the regex is constructed. This issue     affects all architectures and ABIs supported by the GNU C library.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.10.1.10. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.10.1.10 advisory.

  - There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could     exceed the number of columns available. This could lead to a memory corruption issue. We recommend     upgrading to version 3.50.2 or above. (CVE-2025-6965)

  - Perl threads have a working directory race condition where file operations may target unintended paths. If     a directory handle is open at thread creation, the process-wide current working directory is temporarily     changed in order to clone that handle for the new thread, which is visible from any third (or more) thread     already running. This may lead to unintended operations such as loading code or accessing files from     unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit     11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6 (CVE-2025-40909)

  - The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some     previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed     malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how     the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.
    (CVE-2025-8058)

  - Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc     credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4     to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with     `trust_env=False` on one's Requests Session. (CVE-2024-47081)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:13240 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: Double free in glibc (CVE-2025-8058)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20594 advisory.

    - CVE-2025-8058: Double free in regcomp (RHEL-105326)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20595 advisory.

    [2.34-168.0.1.23]
    - Forward-port Oracle patches for ol9-u6       Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       Oracle history:
      June-30-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.20
      - Forward-port Oracle patches for ol9-u6         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19
      - Forward-port Oracle patches for ol9-u6         Reviewed-by: David Faust <david.faust@oracle.com>       May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14
      - Forward-port Oracle patches for ol9-u6         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1
      - Forward-port Oracle patches for ol9-u6         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1
      - Forward-port Oracle patches for ol9-u6 DP         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1
      - Forward-port Oracle patches for ol9-u5         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4
      - Forward-port Oracle patches for ol9-u4         Reviewed by: David Faust <david.faust@oracle.com>       August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3
      - Forward-port Oracle patches for ol9-u4         Reviewed by: David Faust <david.faust@oracle.com>       May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2
      - Forward-port Oracle patches for ol9-u4         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1
      - Forward-port Oracle patches for ol9-u4         Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>       March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1
      - Forward-port Oracle patches for ol9-u4-beta         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12
      - Forward-port Oracle patches for ol9         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7
      - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7
      - Forward-port Oracle patches for ol9         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1
      - Forward-port Oracle patches for ol9         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2
      - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks
      - Created tunable glibc.pthread.stack_hugetlb to control when hugepages         can be used for stack allocation.
      - In case THP are enabled and glibc.pthread.stack_hugetlb is set to         0, glibc will madvise the kernel not to use allow hugepages for stack         allocations.
        Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1
      - Merge Oracle patches for ol9-u2 beta         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1
      - Merge Oracle patches for ol9-u1 beta         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1
      - Merge Oracle patches with ol9 beta
      - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

    [2.34-168.23]
    - Fix namespace pollution in inet_ntop with fortification (RHEL-106230)

    [2.34-168.22]
    - CVE-2025-8058: Double free in regcomp (RHEL-105328)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:13240 advisory.

    * glibc: Double free in glibc (CVE-2025-8058)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-28054 advisory.

    - CVE-2025-8058: Double free in regcomp (RHEL-105326)
    - CVE-2025-4802: static setuid dlopen may search LD_LIBRARY_PATH (RHEL-92685)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0993 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2025-8058:
    The regcomp function in the GNU C library version from 2.4 to 2.41 is     subject to a double free if some previous allocation fails. It can be     accomplished either by a malloc failure or by using an interposed malloc      that injects random malloc failures. The double free can allow buffer     manipulation depending of how the regex is constructed. This issue     affects all architectures and ABIs supported by the GNU C library.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 10.0.1.4 / AHV-10.0.1.4. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.0.1.4 advisory.

  - There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could     exceed the number of columns available. This could lead to a memory corruption issue. We recommend     upgrading to version 3.50.2 or above. (CVE-2025-6965)

  - The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some     previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed     malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how     the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.
    (CVE-2025-8058)

  - A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching     resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS     support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream     name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet-     always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to     accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox     attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous     replies. (CVE-2025-5994)

  - Perl threads have a working directory race condition where file operations may target unintended paths. If     a directory handle is open at thread creation, the process-wide current working directory is temporarily     changed in order to clone that handle for the new thread, which is visible from any third (or more) thread     already running. This may lead to unintended operations such as loading code or accessing files from     unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit     11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6 (CVE-2025-40909)

  - In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-     based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema     with certain identity constraints, or a crafted XML schema must be used. (CVE-2025-32415)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.5 advisory.

  - LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize),     affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data     corruption.) NOTE: the vendor states only a few specific / uncommon usages of the API are at risk.
    (CVE-2019-17543)

  - There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could     exceed the number of columns available. This could lead to a memory corruption issue. We recommend     upgrading to version 3.50.2 or above. (CVE-2025-6965)

  - A vulnerability has been identified in the libarchive library, specifically within the     archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately     lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption,     enabling an attacker to execute arbitrary code or cause a denial-of-service condition. (CVE-2025-5914)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451,     8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle     GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java     SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. This vulnerability does not apply to Java deployments, typically in servers, that load and     run only trusted code (e.g., code installed by an administrator). (CVE-2025-30749)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451,     8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle     GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2025-30754)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
302706	EulerOS Virtualization 2.12.0 : glibc (EulerOS-SA-2026-1483)	Nessus	Huawei Local Security Checks	2026/3/17	2026/3/17	medium
302732	EulerOS Virtualization 2.12.1 : glibc (EulerOS-SA-2026-1426)	Nessus	Huawei Local Security Checks	2026/3/17	2026/3/17	medium
304843	Photon OS 4.0: Glibc PHSA-2026-4.0-0984	Nessus	PhotonOS Local Security Checks	2026/4/4	2026/4/4	medium
305971	Unity Linux 20.1070a Security Update: glibc (UTSA-2026-007101)	Nessus	Unity Linux Local Security Checks	2026/4/10	2026/4/10	medium
271420	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.1.10)	Nessus	Misc.	2025/10/24	2026/5/26	high
244043	RHEL 10 : glibc (RHSA-2025:13240)	Nessus	Red Hat Local Security Checks	2025/8/6	2025/8/6	medium
265307	Oracle Linux 8 : glibc (ELSA-2025-20594)	Nessus	Oracle Linux Local Security Checks	2025/9/17	2026/2/24	medium
265309	Oracle Linux 9 : glibc (ELSA-2025-20595)	Nessus	Oracle Linux Local Security Checks	2025/9/17	2026/2/24	medium
269890	AlmaLinux 10 : glibc (ALSA-2025:13240)	Nessus	Alma Linux Local Security Checks	2025/10/9	2025/10/9	medium
279096	Oracle Linux 8 : glibc (ELSA-2025-28054)	Nessus	Oracle Linux Local Security Checks	2025/12/18	2026/2/24	medium
284653	TencentOS Server 3: glibc (TSSA-2025:0993)	Nessus	Tencent Local Security Checks	2026/1/14	2026/2/24	medium
266317	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.0.1.4)	Nessus	Misc.	2025/9/30	2026/7/15	high
277501	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.5)	Nessus	Misc.	2025/12/4	2026/4/2	high

检测

插件搜索

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

high

high