The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-7163 advisory.

    - CVE fix for: CVE-2025-26594 (RHEL-80201), CVE-2025-26595 (RHEL-80186),                    CVE-2025-26596 (RHEL-80188), CVE-2025-26597 (RHEL-80191),                    CVE-2025-26598 (RHEL-80192), CVE-2025-26599 (RHEL-80199),                    CVE-2025-26600 (RHEL-80198), CVE-2025-26601 (RHEL-80200)
    - CVE fix for CVE-2024-9632

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-7458 advisory.

    - CVE fix for: CVE-2025-49175 (RHEL-97129), CVE-2025-49176 (RHEL-97135),                    CVE-2025-49177 (RHEL-97141), CVE-2025-49178 (RHEL-97147),                    CVE-2025-49179 (RHEL-97153), CVE-2025-49180 (RHEL-97159)

    Rebuild for 10.0.z required due to issue when releasing original erratum.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10229:01 advisory.

    * xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632)
      * X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594)
      * xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601)
      * xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600)
      * xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599)
      * xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598)
      * xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597)
      * xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596)
      * Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tigervnc installed on the remote host is prior to 1.12.0 / 1.14.1. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-304-01 advisory.

    New tigervnc packages are available for Slackware 15.0 and -current to fix a security issue.

Tenable has extracted the preceding description block directly from the tigervnc security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3866-1 advisory.

    - CVE-2024-9632: Fixed heap-based buffer overflow privilege escalation in _XkbSetCompatMap (bsc#1231565).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the xorg-x11-server package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a     local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading     to denial of service or local privilege escalation in distributions where the X.org server is run with     root privileges.(CVE-2024-9632)

Tenable has extracted the preceding description block directly from the EulerOS xorg-x11-server security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the xorg-x11-server package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific     and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode).
    If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during     shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of     service.(CVE-2023-5574)

    A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a     local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading     to denial of service or local privilege escalation in distributions where the X.org server is run with     root privileges.(CVE-2024-9632)

Tenable has extracted the preceding description block directly from the EulerOS xorg-x11-server security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3940 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3940-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     October 29, 2024                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : xorg-server     Version        : 2:1.20.11-1+deb11u14     CVE ID         : CVE-2024-9632


    Jan-Niklas Sohn working with Trend Micro Zero Day Initiative found an     issue in the X server and Xwayland implementations published by X.Org.
    CVE-2024-9632 can be triggered by providing a modified bitmap to the X.Org     server. This may lead to local privilege escalation if the server is run     as root or remote code execution (e.g. x11 over ssh).



    For Debian 11 bullseye, this problem has been fixed in version     2:1.20.11-1+deb11u14.

    We recommend that you upgrade your xorg-server packages.

    For the detailed security status of xorg-server please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/xorg-server

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently as

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0319 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-9632:
    A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a     local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading     to denial of service or local privilege escalation in distributions where the X.org server is run with     root privileges.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0802 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2024-9632:
    A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a     local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading     to denial of service or local privilege escalation in distributions where the X.org server is run with     root privileges.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-9413:17 advisory.

    * xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:10090 advisory.

    * xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-7165 advisory.

    - CVE fix for: CVE-2025-26594 (RHEL-80204), CVE-2025-26595 (RHEL-80187),                    CVE-2025-26596 (RHEL-80190), CVE-2025-26597 (RHEL-80193),                    CVE-2025-26598 (RHEL-80195), CVE-2025-26599 (RHEL-80202),                    CVE-2025-26600 (RHEL-80203), CVE-2025-26601 (RHEL-80207)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2025:0076 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-9632:
    A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a     local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading     to denial of service or local privilege escalation in distributions where the X.org server is run with     root privileges.

    CVE-2025-26594:
    A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a     global variable. If a client frees the root cursor, the internal reference points to freed memory and     causes a use-after-free.

    CVE-2025-26595:
    A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-     sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to     check the bounds of the buffer and would copy the data regardless of the size.

    CVE-2025-26596:
    A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms()     differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.

    CVE-2025-26597:
    A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group,     it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is     later called with a non-zero value of groups, this will cause a buffer overflow because the key actions     are of the wrong size.

    CVE-2025-26598:
    An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for     the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match     was found. However, the code will return the last element of the list if no matching device ID is found,     which can lead to out-of-bounds memory access.

    CVE-2025-26599:
    An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function     compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow()     will return a BadAlloc error without validating the window tree marked just before, which leaves the     validated data partly initialized and the use of an uninitialized pointer later.

    CVE-2025-26600:
    A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the     events queued for that device remain while the device is freed. Replaying the events will cause a use-     after-free.

    CVE-2025-26601:
    A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change     mask are evaluated one after the other, changing the trigger values as requested, and eventually,     SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not     adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-11567:11 advisory.

    * CVE-2025-9632: fix buffer overflow in _XkbSetCompatMap()
    * CVE-2025-62229: fix use-after-free condition due improper error handling     during notification creation leading to DoS
    * CVE-2025-62230: fix use-after-free condition due freeing certain data     structures without properly detaching related resources
    * CVE-2025-62231: fix unsigned short overflow in XkbSetCompatMap() function     CVE(s):
    CVE-2025-62230     A flaw was discovered in the X.Org X servers X Keyboard (Xkb) extension when handling client resource     cleanup. The software frees certain data structures without properly detaching related resources, leading     to a use-after-free condition. This can cause memory corruption or a crash when affected clients     disconnect.
    CVE-2025-62231     A flaw was identified in the X.Org X servers X Keyboard (Xkb) extension where improper bounds checking in     the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially     crafted input data, the value calculation may overflow, leading to memory corruption or a crash.
    CVE-2024-9632     A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a     local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading     to denial of service or local privilege escalation in distributions where the X.org server is run with     root privileges.
    CVE-2025-62229     A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications.
    Improper error handling during notification creation can leave dangling pointers that lead to a use-after-     free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute     arbitrary code or cause a denial of service.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
237050	Oracle Linux 9 : xorg-x11-server (ELSA-2025-7163)	Nessus	Oracle Linux Local Security Checks	2025/5/22	2025/9/11	high
241453	Oracle Linux 10 : xorg-x11-server-Xwayland (ELSA-2025-7458)	Nessus	Oracle Linux Local Security Checks	2025/7/7	2025/7/7	high
282821	MiracleLinux 9 : xorg-x11-server-1.20.11-28.el9_6 (AXSA:2025-10229:01)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/13	high
209919	Slackware Linux 15.0 / current tigervnc Vulnerability (SSA:2024-304-01)	Nessus	Slackware Local Security Checks	2024/10/30	2024/10/30	high
210108	SUSE SLES15 Security Update : xorg-x11-server (SUSE-SU-2024:3866-1)	Nessus	SuSE Local Security Checks	2024/11/2	2026/1/21	high
215994	EulerOS 2.0 SP11 : xorg-x11-server (EulerOS-SA-2025-1149)	Nessus	Huawei Local Security Checks	2025/2/10	2026/1/21	high
216037	EulerOS 2.0 SP12 : xorg-x11-server (EulerOS-SA-2025-1200)	Nessus	Huawei Local Security Checks	2025/2/10	2026/1/21	high
214034	EulerOS 2.0 SP10 : xorg-x11-server (EulerOS-SA-2025-1034)	Nessus	Huawei Local Security Checks	2025/1/13	2026/1/21	high
209887	Debian dla-3940 : xdmx - security update	Nessus	Debian Local Security Checks	2024/10/29	2024/10/31	high
276226	TencentOS Server 4: tigervnc (TSSA-2025:0319)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	high
239925	TencentOS Server 3: xorg-x11-server and xorg-x11-server-Xwayland (TSSA-2024:0802)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
292957	MiracleLinux 9 : tigervnc-1.14.1-1.el9_5 (AXSA:2024-9413:17)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
232894	RockyLinux 9 : tigervnc (RLSA-2024:10090)	Nessus	Rocky Linux Local Security Checks	2025/3/19	2025/3/19	high
237034	Oracle Linux 9 : xorg-x11-server-Xwayland (ELSA-2025-7165)	Nessus	Oracle Linux Local Security Checks	2025/5/22	2025/9/11	high
237274	Alibaba Cloud Linux 3 : 0076: xorg-x11-server-Xwayland (ALINUX3-SA-2025:0076)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/27	2025/5/27	high
283448	MiracleLinux 7 : xorg-x11-server-1.20.4-99.0.8.el7.AXS7 (AXSA:2025-11567:11)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/13	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high