Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - MIME：：Field：:P aramVal 版本 5.521 之前的 Perl 允許一個無效的 Content-Type 參數隱藏其後面的參數，包括 multipart 邊界。參數剖析會在無法讀取其名稱的第一個參數處停止，例如 x：y=1 或包含 8 位元位元組的名稱，並刪除其後面的每個參數。當邊界位於其中時，MIME：:P arser 會將多部分主體保留為單一未解碼的部分，而不會將剖析標記為模棱兩可。跳過無效參數的郵件讀取器仍會找到界限。遠端寄件者可以從依賴 ambiguous_content（） 的過濾器中隱藏附件，而收件者的郵件用戶端會顯示附件。（CVE-2026-116264）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Perl 之前 5.521 的 MIME：：Field：:P aramVal 版本允许使用一个无效的 Content-Type 参数隐藏其之后的参数，包括 multipart 边界。参数解析在名称无法读取的第一个参数处停止（例如 x：y=1 或包含 8 位字节的名称），并丢弃其之后的每个参数。当边界位于这些部分之间时，MIME：:P arser 将多部分正文保留为单个未解码部分，而不将解析标记为有歧义。跳过无效参数的邮件阅读器仍能找到边界。远程发件人可隐藏附件，使依赖于 ambiguous_content（） 的筛选器在收件人的邮件客户端显示附件。（CVE-2026-116264）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Perl 用の 5.521 より前の MIME::Field::P aramVal バージョンでは、1 つの無効な Content-Type パラメーターが、マルチパート境界を含めて、その後のパラメーターを非表示にすることができます。パラメーター解析は、x:y=1 や 8 ビットバイトを含む名前など、読み込めない名前を持つ最初のパラメーターで停止し、その後のすべてのパラメーターをドロップします。境界がそれらの中間にある場合、MIME::P arserは、解析をあいまいなものとしてマークせずに、マルチパート本体を単一の解読されていない部分として保持します。無効なパラメーターをスキップするメールリーダーは、依然として境界を検出します。リモートの送信者は、受信者のメールクライアントが添付ファイルを表示している間、ambiguous_content() に依存するフィルターから添付ファイルを隠すことができます。(CVE-2026-116264)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

リモートホストにインストールされている FreeBSD のバージョンは、テスト済みバージョンより前です。したがって、2b2d5d3e-d2c8-11f1-97dc-40b034429ecf のアドバイザリに記載されている複数の脆弱性の影響を受けます。

    MIME-tools プロジェクトによる報告:
    多数のセキュリティ問題が対処されました(次の 10 の CVE を参照)CPANSec セキュリティグループにより、問題が私の注意を喚起され、パッチが提供されました。

Tenable は、前述の記述ブロックを FreeBSD セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2b2d5d3e-d2c8-11f1-97dc-40b034429ecf advisory.

    MIME-tools project reports:
    Many security issues were addressed (see the following ten CVEs)               Issues were brought to my attention, and patches supplied, by the               CPANSec security group.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22226-1 advisory.

    Changes in perl-MIME-tools:

    - updated to 5.522.0 (5.522)
      * 5.522
            * VERSION 5.522 RELEASED
            * Many security issues were addressed (see the following ten CVEs)               Issues were brought to my attention, and patches supplied, by the               CPANSec security group.
            * parse_params: flag a parameter list that could not be parsed               Detect additional ambiguous parse situations when parameter               names contain illegal characters.  Fixes:
              CVE-2026-116264 invalid parameter hides boundary/filename. bsc#1288723
            * parse_params: check the boundary after RFC 2231 reassembly               Another ambiguous-parse case was missed (trailing space after               boundary was not detected for RFC-2231-encoded boundaries.)  Fixes:
              CVE-2026-116265 RFC 2231 boundary skips ambiguity checks. bsc#1288722
            * parse_params: Stricter checking for encoded boundaries; earlier               versions would miss some cases.  Fixes:
              CVE-2026-116266 boundary changed by decoding not flagged. bsc#1288721
            * Cap the indentation levels in the Results: structure.  Otherwise,               specially-crafted messages could consume large amounts of memory.
              Fixes: CVE-2026-116267 indent stored per message per level bsc#1288720
            * parse_params: stop a comment match at the next parenthesis.
              Otherwise, specially-crafted messages could cause the regex               back-tracker to consume large amounts of CPU time.  Note that               MIME::Parser does not correctly parse ((nested comments)) and               has never done so.  Fixes:
              CVE-2026-116268 unclosed ( comments backtrack CPU exhaustion. bsc#1288719
            * parse_params: re-encode filename* values without charset tricks               Specially-crafted messages could trick recommended_filename()               into returning an empty string instead of a plausible filename.
              Fixes: CVE-2026-116269 RFC 2231 language tag empties filename. bsc#1288718
            * decode_mimewords: do not copy the input into each error.  Otherwise,               specially-crafted messages could consume large amounts of memory.
              Fixes: CVE-2026-116270 each bad =? copies the input into $@. bsc#1288717
            * FileUnder: do not reuse an existing generated directory.  Otherwise,               attackers might be able to use symbolic links to get files created               in unexpected locations.  Fixes:
              CVE-2026-116271 FileUnder reuses a pre-created directory. bsc#1288716
            * parse_params: flag comments other readers do not skip               Specially-crafted messages could create ambiguous messages without               setting the ambiguous_parse flag.  Fixes:
              CVE-2026-116272  comment hides a duplicate boundary. bsc#1288715
            * Call whine() rather than error() if max_parts or max_depth is               exceeded during a parse.  This lets us return undef rather than               throwing an exception if ignore_errors() is set to 0.
            * Change to defaults: max_parts is now set to 1000 and max_depth               to 64 rather than being unlimited.  This should not affect most               real-world uses of MIME::tools, but you may need to increase               these values or set them to -1 (unlimited) if you run into trouble.
                  ***** NOTE INCOMPATIBILITY *****               Fixes: CVE-2026-116273 max_parts and max_depth unlimited. bsc#1288714
            * Do not signal an ambiguous parse if we have filename= or               name=
            * Update author names in META.yml
            * Add git repo to META.yml
      * 5.520
            * VERSION 5.520 RELEASED
            * MIME::Parser used O(N^2) CPU time and memory parsing a MIME               message nested N levels deep.  A smallish specially-crafted               message could DOS the computer by making it consume enormous               amounts of memory and CPU time.  The parser was modified to use               O(N) time and memory in this case.  Additionally, a new               MIME::Parser::max_depth() function was added to limit the nesting               depth before declaring a parse failure.  Problem was reported to               me by Zhaoyang Li and Xiang Li from AOSP Lab at Nankai University.
            * MIME::Parser would ignore multiple blank lines in a message               preamble when parsing it; this could break DKIM.  Problem pointed               out and fix suggested by Tim Henderson.
            * If a MIME boundary includes trailing whitespace, we mark the               parse as ambiguous.  Problem noted and patch submitted by               Christian Herdtweck
      * 5.519
            * VERSION 5.519 RELEASED
            * Some (buggy) software creates base64-encoded parts as a               concatenation of multiple base64-encoded streams, and some client               software decodes each stream separately and concatenates the               results.  Duplicate this behavior in MIME::tools to prevent it               from being used as a mechanism to sneak dangerous content past a               security scanner.  Patch courtesy of Giorgio Premi               <giosh94mhz@gmail.com>.

    - updated to 5.518.0 (5.518)
      * 5.518
            * VERSION 5.518 RELEASED
            * Add tests for encoded boundary=XXX parameters and set               the ambiguous-parse flag if any are found.  Patch courtesy               of Dominik Csapak <d.csapak@proxmox.com>               MIME::tools chooses to decode encoded boundary parameters.
              MUA behaviors differ; Claws-Mail decodes them while Thunderbird               does not.
            * Don't ignore invalid whitespace after boundary=XXX parameter.
              Patch courtesy of Dominik Csapak <d.csapak@proxmox.com>
            * Ignore comments between tokens.  A header parameter can be               written foo(comment)=bar and it's the same as foo=bar.
              Patch courtesy of Dominik Csapak <d.csapak@proxmox.com>

    - updated to 5.517.0 (5.517)
      * 5.517
            * VERSION 5.517 RELEASED
            * Add a missing test message file that was causing tests to fail.
      * 5.516
            * VERSION 5.516 RELEASED
            * Handle MIME parameters of the form param= better (ie,               a parameter with no value at all.)  It's treated the               same as param= rather than aborting the parse.
            * Diagnose additional types of malformed MIME as ambiguous.
              Specifically, an empty boundary parameters like boundary= or               boundary= is treated as ambiguous.  Thanks to Stoiko Ivanov               <s.ivanov@proxmox.com> for pointing out this missing case.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0e79d6ad13 advisory.

    This is a cumulative bug-fix update, including multiple security fixes.

    Note that there is a change to some defaults: `max_parts` is now set to 1000 and `max_depth` to 64 rather     than being unlimited; this should not affect most real-world uses of `MIME::tools`, but you may need to     increase these values or set them to -1 (unlimited) if you run into trouble.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a415b3bf48 advisory.

    This is a cumulative bug-fix update, including multiple security fixes.

    Note that there is a change to some defaults: `max_parts` is now set to 1000 and `max_depth` to 64 rather     than being unlimited; this should not affect most real-world uses of `MIME::tools`, but you may need to     increase these values or set them to -1 (unlimited) if you run into trouble.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the     parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter     whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops every parameter     after it. When the boundary is among them, MIME::Parser keeps the multipart body as a single undecoded     part without marking the parse as ambiguous. Mail readers that skip the invalid parameter still find the     boundary. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while     the recipient's mail client shows it. (CVE-2026-116264)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-51fdfb7476 advisory.

    This is a cumulative bug-fix update, including multiple security fixes.

    Note that there is a change to some defaults: `max_parts` is now set to 1000 and `max_depth` to 64 rather     than being unlimited; this should not affect most real-world uses of `MIME::tools`, but you may need to     increase these values or set them to -1 (unlimited) if you run into trouble.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
372700	Linux Distros 未修補弱點：CVE-2026-116264	Nessus	Misc.	2026/10/28	2026/11/6	medium
372700	Linux Distros 未修补的漏洞：CVE-2026-116264	Nessus	Misc.	2026/10/28	2026/11/6	medium
372700	Linux Distros のパッチ未適用の脆弱性: CVE-2026-116264	Nessus	Misc.	2026/10/28	2026/11/6	medium
373481	FreeBSD:p5-MIME-Tools -- 複数の脆弱性(2b2d5d3e-d2c8-11f1-97dc-40b034429ecf)	Nessus	FreeBSD Local Security Checks	2026/10/29	2026/11/6	high
373481	FreeBSD : p5-MIME-Tools -- multiple vulnerabilities (2b2d5d3e-d2c8-11f1-97dc-40b034429ecf)	Nessus	FreeBSD Local Security Checks	2026/10/29	2026/11/6	high
376246	openSUSE 16 Security Update : perl-MIME-tools (openSUSE-SU-2026:22226-1)	Nessus	SuSE Local Security Checks	2026/11/5	2026/11/5	high
376833	Fedora 44 : perl-MIME-tools (2026-0e79d6ad13)	Nessus	Fedora Local Security Checks	2026/11/6	2026/11/6	high
376854	Fedora 43 : perl-MIME-tools (2026-a415b3bf48)	Nessus	Fedora Local Security Checks	2026/11/6	2026/11/6	high
372700	Linux Distros Unpatched Vulnerability : CVE-2026-116264	Nessus	Misc.	2026/10/28	2026/11/6	medium
376845	Fedora 45 : perl-MIME-tools (2026-51fdfb7476)	Nessus	Fedora Local Security Checks	2026/11/6	2026/11/6	high

検出

プラグインの検索

medium

medium

medium

high

high

high

high

high

medium

high