The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0547 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-5648:
    A vulnerability was found in Radare2 5.9.9. It has been classified as problematic. Affected is the     function r_cons_pal_init in the library /libr/cons/pal.c of the component radiff2. The manipulation of the     argument -T leads to memory corruption. An attack has to be approached locally. The complexity of an     attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the     public and may be used. The real existence of this vulnerability is still doubted at the moment. The name     of the patch is 5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to apply a patch to fix this     issue. The documentation explains that the parameter -T is experimental and crashy. Further analysis has     shown the race is not a real problem unless you use asan. A new warning has been added.

    CVE-2025-5647:
    A vulnerability was found in Radare2 5.9.9 and classified as problematic. This issue affects the function     r_cons_context_break_pop in the library /libr/cons/cons.c of the component radiff2. The manipulation of     the argument -T leads to memory corruption. The attack needs to be approached locally. The complexity of     an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the     public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch     is named 5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to apply a patch to fix this issue.
    The documentation explains that the parameter -T is experimental and crashy. Further analysis has shown     the race is not a real problem unless you use asan. A new warning has been added.

    CVE-2025-5646:
    A vulnerability has been found in Radare2 5.9.9 and classified as problematic. This vulnerability affects     the function r_cons_rainbow_free in the library /libr/cons/pal.c of the component radiff2. The     manipulation of the argument -T leads to memory corruption. It is possible to launch the attack on the     local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The     exploit has been disclosed to the public and may be used. The real existence of this vulnerability is     still doubted at the moment. The patch is identified as 5705d99cc1f23f36f9a84aab26d1724010b97798. It is     recommended to apply a patch to fix this issue. The documentation explains that the parameter -T is     experimental and crashy. Further analysis has shown the race is not a real problem unless you use     asan. A new warning has been added.

    CVE-2025-5645:
    A vulnerability, which was classified as problematic, was found in Radare2 5.9.9. This affects the     function r_cons_pal_init in the library /libr/cons/pal.c of the component radiff2. The manipulation of the     argument -T leads to memory corruption. Attacking locally is a requirement. The complexity of an attack is     rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and     may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of     the patch is 5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to apply a patch to fix this     issue. The documentation explains that the parameter -T is experimental and crashy. Further analysis has     shown the race is not a real problem unless you use asan. A new warning has been added.

    CVE-2025-5644:
    A vulnerability, which was classified as problematic, has been found in Radare2 5.9.9. Affected by this     issue is the function r_cons_flush in the library /libr/cons/cons.c of the component radiff2. The     manipulation of the argument -T leads to use after free. Local access is required to approach this attack.
    The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has     been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at     the moment. The name of the patch is 5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to apply     a patch to fix this issue. The documentation explains that the parameter -T is experimental and crashy.
    Further analysis has shown the race is not a real problem unless you use asan. A new warning has been     added.

    CVE-2025-5643:
    A vulnerability classified as problematic was found in Radare2 5.9.9. Affected by this vulnerability is     the function cons_stack_load in the library /libr/cons/cons.c of the component radiff2. The manipulation     of the argument -T leads to memory corruption. An attack has to be approached locally. The complexity of     an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the     public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch     is named 5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to apply a patch to fix this issue.
    The documentation explains that the parameter -T is experimental and crashy. Further analysis has shown     the race is not a real problem unless you use asan. A new warning has been added.

    CVE-2025-5642:
    A vulnerability classified as problematic has been found in Radare2 5.9.9. Affected is the function     r_cons_pal_init in the library /libr/cons/pal.c of the component radiff2. The manipulation leads to memory     corruption. The attack needs to be approached locally. The complexity of an attack is rather high. The     exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The     real existence of this vulnerability is still doubted at the moment. The patch is identified as     5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to apply a patch to fix this issue. The     documentation explains that the parameter -T is experimental and crashy. Further analysis has shown the     race is not a real problem unless you use asan. A new warning has been added.

    CVE-2025-5641:
    A vulnerability was found in Radare2 5.9.9. It has been rated as problematic. This issue affects the     function r_cons_is_breaked in the library /libr/cons/cons.c of the component radiff2. The manipulation of     the argument -T leads to memory corruption. It is possible to launch the attack on the local host. The     complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been     disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the     moment. The identifier of the patch is 5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to     apply a patch to fix this issue. The documentation explains that the parameter -T is experimental and     crashy. Further analysis has shown the race is not a real problem unless you use asan. An additional     warning regarding threading support has been added.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was found in Radare2 5.9.9 and classified as problematic. This issue affects the function     r_cons_context_break_pop in the library /libr/cons/cons.c of the component radiff2. The manipulation of     the argument -T leads to memory corruption. The attack needs to be approached locally. The complexity of     an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the     public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch     is named 5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to apply a patch to fix this issue.
    The documentation explains that the parameter -T is experimental and crashy. Further analysis has shown     the race is not a real problem unless you use asan. A new warning has been added. (CVE-2025-5647)

Note that Nessus relies on the presence of the package as reported by the vendor.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Radare2 5.9.9 に脆弱性が見つかり、問題があるものに分類されました。この問題は、コンポーネント radiff2 のライブラリ /libr/cons/cons.c の r_cons_context_break_pop 関数に影響を与えます。引数 -T の操作により、メモリ破損が発生します。攻撃にはローカルで対処する必要があります。攻撃の複雑性はかなり高いものです。この脆弱性の悪用は困難であることが知られています。このエクスプロイトは一般に公開されており、使用される可能性があります。この脆弱性が本当に存在するかは、現時点ではまだ疑われています。パッチの名前は、5705d99cc1f23f36f9a84aab26d1724010b97798 です。この問題を修正するパッチを適用することが推奨されます。
    ドキュメントでは、パラメーター -T は実験的でクラッシュ的であると説明されています。詳細な分析により、asan を使用しない限り、競合は本当の問題ではないことが示されています。新しい警告が追加されました。CVE-2025-5647

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 在 Radare2 5.9.9 中發現一個弱點且分類為有問題。此問題會影響元件 radiff2 之程式庫 /libr/cons/cons.c 中的 r_cons_context_break_pop 函式。操控引數 -T 導致記憶體損毀。必須於本機發動攻擊。此攻擊的複雜度很高。已知此惡意利用很困難。攻擊程式已向公眾披露且可能會遭到利用。目前仍不確定此弱點是否真實存在。該修補程式名為 5705d99cc1f23f36f9a84aab26d1724010b97798。建議套用修補程式以修復此問題。
    文件說明參數 -T 為實驗性質且會當機。進一步分析顯示除非您使用 asan否則爭用並非真正的問題。已新增一個警告。 (CVE-2025-5647)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 Radare2 5.9.9 中发现一个漏洞该漏洞被归类为有问题的漏洞。此问题影响组件 radif2 的库 /libr/cons/cons.c 中的 r_cons_context_break_pop 函数。对参数 -T 的操纵会导致内存损坏。需要在本地处理攻击。攻击的复杂度相当高。已知很难实现此漏洞利用。该漏洞已被公开并可被使用。目前对该漏洞的真实存在性仍存疑。该修补程序名为 5705d99cc1f23f36f9a84aab26d1724010b97798。建议应用补丁修复此问题。
    文档说明参数 -T 处于试验阶段并且会崩溃。进一步分析显示争用不是真正的问题除非使用 asan。添加了新的警告。 (CVE-2025-5647)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
275939	TencentOS Server 4: radare2 (TSSA-2025:0547)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	low
259562	Linux Distros Unpatched Vulnerability : CVE-2025-5647	Nessus	Misc.	2025/8/30	2025/10/14	low
259562	Linux Distros のパッチ未適用の脆弱性: CVE-2025-5647	Nessus	Misc.	2025/8/30	2025/10/14	low
259562	Linux Distros 未修補的弱點：CVE-2025-5647	Nessus	Misc.	2025/8/30	2025/10/14	low
259562	Linux Distros 未修补的漏洞：CVE-2025-5647	Nessus	Misc.	2025/8/30	2025/10/14	low

检测

插件搜索

low

low

low

low

low