There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0,
    applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled
    ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in
    src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and
    Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an
    archive-processing service. This issue is fixed in version 9.0.0. (CVE-2026-115907)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - zip 是一個適用於 Rust 的 zip 函式庫，支援讀取和寫入簡單的 ZIP 檔案。從 5.1.0 until 9.0.0，使用 legacy-zip 功能建置的應用程式可以在驗證壓縮資料流之前，保留攻擊者控制 ZIP64 的未壓縮大小的輸出容量。src/legacy/shrink.rs 中的 ShrinkDecoder 路徑可能會在 ZipArchive：：extract 期間因容量溢位而發生錯誤，而 Reduce 和 Implode 解碼器包含相同的無限預先配置模式。未處理的錯誤可能會終止保存處理服務。9.0.0 版已修正此問題。(CVE-2026-115907)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - zip 是适用于 Rust 的 zip 库，支持读取和写入简单的 ZIP 文件。From 5.1.0 until 9.0.0，使用 legacy-zip 功能构建的应用程序可在验证压缩流之前，保留攻击者控制 ZIP64 的未压缩大小的输出容量。在 ZipArchive：：extract 期间，src/legacy/shrink.rs 中的 ShrinkDecoder 路径可能会因容量溢出而出错，并且 Reduce 和 Implode 解码器包含相同的不受限制的预分配模式。未处理的错误可终止存档处理服务。此问题已在 9.0.0 版本中修复。(CVE-2026-115907)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

リモートの Fedora 46 ホストには、FEDORA-2026-7adfb2bcdd のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    nodejs-pnpm12-12.17.0-1.fc46 の自動更新。

    ##### **変更ログ**

    ```
    * 2026 年 10 月 31 日(土)Andreas Schneider <asn@redhat.com> - 12.17.0-1
    - バージョン 12.17.0 への更新
    - CVE-2026-115907を修正します
    - 解決：rhbz#2562799
    - CVE-2026-115908を修正します
    - 解決：rhbz#2562854
    * 2026 年 10 月 30 日(金)Andreas Schneider 氏 <asn@redhat.com> - 12.16.1-1
    - バージョン 12.6.0 への更新
    - CVE-2026-115907を修正します
    - 解決：rhbz#2562799
    - CVE-2026-115908を修正します
    - 解決：rhbz#2562854

    ```

Tenable は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - zip は、単純な ZIP ファイルの読み書きをサポートする Rust 用の zip ライブラリです。5.1.0から9.0.0まで、legacy-zip機能で構築されたアプリケーションは、圧縮ストリームを検証する前に、攻撃者が制御するZIP64非圧縮サイズから出力容量を予約する可能性があります。src/legacy/shrink.rs の ShrinkDecoder パスは、ZipArchive::extract 中に容量オーバーフローでパニックする可能性があり、Reduce デコーダーと Implode デコーダーには、同じ無制限の事前割り当てパターンが含まれています。処理されないパニックにより、アーカイブ処理サービスが終了する可能性があります。この問題はバージョン 9.0.0 で修正されています。(CVE-2026-115907)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24658-1 advisory.

    This update for rust-keylime fixes the following issue:

    - CVE-2026-115905: zip: security control bypass via parser differential between central directory and     local headers       (bsc#1287921)
    - CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification     (bsc#1287921)
    - CVE-2026-115907: zip: denial of service via unbounded memory allocation in legacy decoders (bsc#1287921)
    - CVE-2026-115908: zip: path traversal via lexical symlink validation during extraction (bsc#1287921)
    - CVE-2026-115909: zip: denial of service via uncontrolled memory allocation on symlink targets     (bsc#1287921)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22249-1 advisory.

    This update for rust-keylime fixes the following issue:

    - CVE-2026-115905: zip: security control bypass via parser differential between central directory and     local headers       (bsc#1287921)
    - CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification     (bsc#1287921)
    - CVE-2026-115907: zip: denial of service via unbounded memory allocation in legacy decoders (bsc#1287921)
    - CVE-2026-115908: zip: path traversal via lexical symlink validation during extraction (bsc#1287921)
    - CVE-2026-115909: zip: denial of service via uncontrolled memory allocation on symlink targets     (bsc#1287921)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - zip is a zip library for Rust that supports reading and writing simple ZIP files. From 5.1.0 until 9.0.0,     applications built with the legacy-zip feature can reserve output capacity from an attacker-controlled     ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in     src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and     Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an     archive-processing service. This issue is fixed in version 9.0.0. (CVE-2026-115907)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7d4fcfe6c8 advisory.

    Update to version 12.17.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7adfb2bcdd advisory.

    Automatic update for nodejs-pnpm12-12.17.0-1.fc46.

    ##### **Changelog**

    ```
    * Sat Oct 31 2026 Andreas Schneider <asn@redhat.com> - 12.17.0-1
    - Update to version 12.17.0
    - Fixes CVE-2026-115907
    - resolves: rhbz#2562799
    - Fixes CVE-2026-115908
    - resolves: rhbz#2562854
    * Fri Oct 30 2026 Andreas Schneider <asn@redhat.com> - 12.16.1-1
    - Update to version 12.6.0
    - Fixes CVE-2026-115907
    - resolves: rhbz#2562799
    - Fixes CVE-2026-115908
    - resolves: rhbz#2562854

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
478184	Chainguard: verus: security update to 0.2026.10.18-r1	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	2026/11/2	2026/11/2	high
478184	Chainguard: verus: security update to 0.2026.10.18-r1	Tenable Cloud Security	Chainguard Local Security Checks	2026/11/2	2026/11/2	high
372217	Linux Distros 未修補弱點：CVE-2026-115907	Nessus	Misc.	2026/10/27	2026/11/12	high
372217	Linux Distros 未修补的漏洞：CVE-2026-115907	Nessus	Misc.	2026/10/27	2026/11/12	high
374472	Fedora 46:nodejs-pnpm12(2026-7adfb2bcdd)	Nessus	Fedora Local Security Checks	2026/10/31	2026/10/31	high
372217	Linux Distros のパッチ未適用の脆弱性: CVE-2026-115907	Nessus	Misc.	2026/10/27	2026/11/12	high
379469	SUSE SLES16 Security Update : rust-keylime (SUSE-SU-2026:24658-1)	Nessus	SuSE Local Security Checks	2026/11/12	2026/11/12	critical
379533	openSUSE 16 Security Update : rust-keylime (openSUSE-SU-2026:22249-1)	Nessus	SuSE Local Security Checks	2026/11/12	2026/11/12	critical
372217	Linux Distros Unpatched Vulnerability : CVE-2026-115907	Nessus	Misc.	2026/10/27	2026/11/12	high
378080	Fedora 45 : nodejs-pnpm12 (2026-7d4fcfe6c8)	Nessus	Fedora Local Security Checks	2026/11/10	2026/11/10	high
374472	Fedora 46 : nodejs-pnpm12 (2026-7adfb2bcdd)	Nessus	Fedora Local Security Checks	2026/10/31	2026/10/31	high

検出

プラグインの検索

high

high

high

high

high

high

critical

critical

high

high

high