远程主机受到 GLSA-202312-09 中所述漏洞的影响（NASM：多个漏洞）

  - 在 Netwide Assembler (NASM) 2.14.02 中，asm/preproc.c 的 paste_tokens 中存在释放后使用漏洞。
    (CVE-2019-8343)

  - 在 nasm 2.14.03 和 2.15 中，发布 outieee.c 的 ieee_segment 函数存在分段错误问题，导致远程攻击者可以构建的汇编文件造成拒绝服务。(CVE-2020-21528)

  - 据发现，NASM v2.16 在组件 quote_for_pmake() asm/nasm.c: 856 (CVE-2022-44370)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

The remote host is affected by the vulnerability described in GLSA-202312-09 (NASM: Multiple Vulnerabilities)

  - In Netwide Assembler (NASM) 2.14.02, there is a use-after-free in paste_tokens in asm/preproc.c.
    (CVE-2019-8343)

  - A Segmentation Fault issue discovered in in ieee_segment function in outieee.c in nasm 2.14.03 and 2.15     allows remote attackers to cause a denial of service via crafted assembly file. (CVE-2020-21528)

  - NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake()     asm/nasm.c:856 (CVE-2022-44370)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端主機受到 GLSA-202312-09 中所述的弱點影響 (NASM：多個弱點)

  - 在 Netwide Assembler (NASM) 2.14.02 中，asm/preproc.c 的 paste_tokens 中存在釋放後使用情形。
    (CVE-2019-8343)

  - 据發現，nasm 2.14.03 和 2.15 版的 outieee.c 之 ieee_segment 函式中存在分割錯誤問題，允許遠端攻擊者透過特製的組件檔案造成拒絕服務。(CVE-2020-21528)

  - 據發現，NASM v2.16 的 quote_for_pmake() asm/nasm.c: 856 (CVE-2022-44370)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。、

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - nasm: use-after-free in paste_tokens in asm/preproc.c (CVE-2019-8343)

  - In Netwide Assembler (NASM) 2.14rc0, there are multiple heap use after free vulnerabilities in the tool     nasm. The related heap is allocated in the token() function and freed in the detoken() function (called by     pp_getline()) - it is used again at multiple positions later that could cause multiple damages. For     example, it causes a corrupted double-linked list in detoken(), a double free or corruption in     delete_Token(), and an out-of-bounds write in detoken(). It has a high possibility to lead to a remote     code execution attack. (CVE-2017-10686)

  - In Netwide Assembler (NASM) 2.14rc0, preproc.c allows remote attackers to cause a denial of service (heap-     based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
    (CVE-2017-11111)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - nasm: use-after-free in paste_tokens in asm/preproc.c (CVE-2019-8343)

  - In Netwide Assembler (NASM) 2.14rc0, preproc.c allows remote attackers to cause a denial of service (heap-     based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file.
    (CVE-2017-11111)

  - In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function paste_tokens() in     preproc.c, aka a NULL pointer dereference. It will lead to remote denial of service. (CVE-2017-14228)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - nasm: use-after-free in paste_tokens in asm/preproc.c (CVE-2019-8343)

  - NASM nasm-2.13.03 nasm- 2.14rc15 version 2.14rc15 and earlier contains a memory corruption (crashed) of     nasm when handling a crafted file due to function assemble_file(inname, depend_ptr) at asm/nasm.c:482.
    vulnerability in function assemble_file(inname, depend_ptr) at asm/nasm.c:482. that can result in     aborting/crash nasm program. This attack appear to be exploitable via a specially crafted asm file..
    (CVE-2018-1000667)

  - nasm version 2.14.01rc5, 2.15 contains a Buffer Overflow vulnerability in asm/stdscan.c:130 that can     result in Stack-overflow caused by triggering endless macro generation, crash the program. This attack     appear to be exploitable via a crafted nasm input file. (CVE-2018-1000886)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
187216	GLSA-202312-09: NASM：多个漏洞	Nessus	Gentoo Local Security Checks	2023/12/22	2023/12/22	high
187216	GLSA-202312-09 : NASM: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2023/12/22	2023/12/22	high
187216	GLSA-202312-09: NASM：多個弱點	Nessus	Gentoo Local Security Checks	2023/12/22	2023/12/22	high
199071	RHEL 7 : nasm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high
199078	RHEL 6 : nasm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high
199086	RHEL 8 : nasm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high

検出

プラグインの検索

high

high

high

high

high

high