Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - zip 是适用于 Rust 的 zip 库，支持读取和写入简单的 ZIP 文件。通过 9.0.4，ZipArchive 将中央目录文件标头文件名视为权威文件名，而 ZipStreamReader 使用本地文件标头文件名进行解压缩，而不协调 src/read/stream.rs 中的重复元数据。因此，对于检查中央目录的组件来说，特制的存档看似无害，但会导致流式提取器写入由攻击者所选的不同路径和内容，从而可能覆盖下游服务所使用的文件。此问题已在 9.0.5 版本中修复。(CVE-2026-115905)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - zip 是一個適用於 Rust 的 zip 函式庫，支援讀取和寫入簡單的 ZIP 檔案。通過 9.0.4，ZipArchive 將中央目錄文件標頭文件名視為權威文件名，而 ZipStreamReader 使用本機文件標頭文件名進行提取，而無需協調 src/read/stream.rs 中的重複元數據。因此，對於檢查中央目錄的元件來說，特製的封存可能看起來是良性的，但會導致串流擷取程式寫入攻擊者選取的不同路徑和內容，進而可能覆寫下游服務所使用的檔案。9.0.5 版已修正此問題。(CVE-2026-115905)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - zip は、単純な ZIP ファイルの読み書きをサポートする Rust 用の zip ライブラリです。9.0.4を通じて、ZipArchiveはセントラルディレクトリファイルヘッダーのファイル名を権威のあるものとして扱いますが、ZipStreamReaderはsrc/read/stream.rsの重複するメタデータを調整せずにローカルファイルヘッダーのファイル名を使用して抽出します。したがって、細工されたアーカイブは、中央ディレクトリを検査するコンポーネントに対しては無害に見える可能性がありますが、ストリーミング抽出器に別の攻撃者が選択したパスとコンテンツに書き込ませ、ダウンストリームサービスによって使用されているファイルを上書きする可能性があります。この問題はバージョン 9.0.5 で修正されています。(CVE-2026-115905)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote Fedora 46 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-a7c892ffe9 advisory.

    Update `ruff` to [0.17.4](https://github.com/astral-sh/ruff/blob/0.17.4/CHANGELOG.md) and `ty` to     [0.0.99](https://github.com/astral-sh/ty/blob/0.0.99/CHANGELOG.md). Update `pyo3-introspection` to version     0.30.1. Update `maturin` to [1.16.0](https://github.com/PyO3/maturin/blob/v1.16.0/Changelog.md). Update     `python-jiter` to 0.19.0 and `python-pysequoia` to 0.1.36.

    Update the `zip` crate to version 9, fixing     [RUSTSEC-2026-0367](https://rustsec.org/advisories/RUSTSEC-2026-0367.html),     [RUSTSEC-2026-0368](https://rustsec.org/advisories/RUSTSEC-2026-0368.html), and     [RUSTSEC-2026-0369](https://rustsec.org/advisories/RUSTSEC-2026-0369.html). Rebuild various applications     with the updated `zip` crate.

    Update the `serde_json` crate to version 1.0.154: support `preserve_order` in `no_std` builds and report     invalid UTF-8 at the first bad byte.

    Update various other Rust crates, including updating `lzma-rust2` to     [0.25.0](https://github.com/hasenbanck/lzma-rust2/blob/v0.25.0/CHANGELOG.md), `clearscreen` to 5.0.0,     `python-pkginfo` to 0.7.0, and `mailparse` to 0.18.0.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4,     ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts     using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A     crafted archive can therefore appear benign to a component that inspects the central directory but cause a     streaming extractor to write a different attacker-selected path and content, potentially overwriting files     used by a downstream service. This issue is fixed in version 9.0.5. (CVE-2026-115905)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24658-1 advisory.

    This update for rust-keylime fixes the following issue:

    - CVE-2026-115905: zip: security control bypass via parser differential between central directory and     local headers       (bsc#1287921)
    - CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification     (bsc#1287921)
    - CVE-2026-115907: zip: denial of service via unbounded memory allocation in legacy decoders (bsc#1287921)
    - CVE-2026-115908: zip: path traversal via lexical symlink validation during extraction (bsc#1287921)
    - CVE-2026-115909: zip: denial of service via uncontrolled memory allocation on symlink targets     (bsc#1287921)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22249-1 advisory.

    This update for rust-keylime fixes the following issue:

    - CVE-2026-115905: zip: security control bypass via parser differential between central directory and     local headers       (bsc#1287921)
    - CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification     (bsc#1287921)
    - CVE-2026-115907: zip: denial of service via unbounded memory allocation in legacy decoders (bsc#1287921)
    - CVE-2026-115908: zip: path traversal via lexical symlink validation during extraction (bsc#1287921)
    - CVE-2026-115909: zip: denial of service via uncontrolled memory allocation on symlink targets     (bsc#1287921)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
372220	Linux Distros 未修补的漏洞：CVE-2026-115905	Nessus	Misc.	2026/10/27	2026/11/4	critical
372220	Linux Distros 未修補弱點：CVE-2026-115905	Nessus	Misc.	2026/10/27	2026/11/4	critical
372220	Linux Distros のパッチ未適用の脆弱性: CVE-2026-115905	Nessus	Misc.	2026/10/27	2026/11/4	critical
377705	Fedora 46 : maturin / python-jiter / python-pysequoia / ruff / rust-afterburn / etc (2026-a7c892ffe9)	Nessus	Fedora Local Security Checks	2026/11/9	2026/11/9	critical
372220	Linux Distros Unpatched Vulnerability : CVE-2026-115905	Nessus	Misc.	2026/10/27	2026/11/4	critical
379469	SUSE SLES16 Security Update : rust-keylime (SUSE-SU-2026:24658-1)	Nessus	SuSE Local Security Checks	2026/11/12	2026/11/12	critical
379533	openSUSE 16 Security Update : rust-keylime (openSUSE-SU-2026:22249-1)	Nessus	SuSE Local Security Checks	2026/11/12	2026/11/12	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical