According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original     software developer, NLnet Labs) falls within the expected functionality and security controls of the     application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs     has no further information about the claim, and suggests that affected Red Hat customers refer to     available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A heap-buffer-overflow flaw was     found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption.
    This issue could allow an attacker with local access to provide specially crafted input, potentially     causing the application to crash or allowing arbitrary code execution. This could result in a denial of     service or unauthorized actions on the system.(CVE-2024-43168)

    NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with     very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very     large RRsets can cause Unbound to spend a considerable time applying name compression to downstream     replies. This can lead to degraded performance and eventually denial of service in well orchestrated     attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially     crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will     try to apply name compression which was an unbounded operation that could lock the CPU until the whole     packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression     calculations it is willing to do per packet. Packets that need more compression will result in semi-     compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long.
    This change should not affect normal DNS traffic.(CVE-2024-8508)

    The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource     consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later     sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the 'DNSBomb'     issue.(CVE-2024-33655)

Tenable has extracted the preceding description block directly from the EulerOS unbound security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes an old NULL pointer dereference bug in png_set_text_2() discovered and patched by Patrick Keshishian (CVE-2016-10087). The potential 'NULL dereference' bug has existed in libpng since version 0.71 of June 26, 1995. To be vulnerable, an application has to load a text chunk into the png structure, then delete all text, then add another text chunk to the same png structure, which seems to be an unlikely sequence, but it has happened.

The update also fixes some documentation typos and an instance of undefined behavior.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-74 (libpng: Remote execution of arbitrary code)

    A NULL pointer dereference was discovered in libpng in the       png_push_save_buffer function.  In order to be vulnerable, an application       has to load a text chunk into the PNG structure, then delete all text,       then add another text chunk to the same PNG structure, which seems to be       an unlikely sequence, but it is possible.
  Impact :

    A remote attacker, by enticing a user to process a specially crafted PNG       file, could execute arbitrary code with the privileges of the process.
  Workaround :

    There is no known workaround at this time.

This update for libpng16 fixes the following issues: Security issues fixed :

  - CVE-2016-10087: NULL pointer dereference in     png_set_text_2() (bsc#1017646)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to upstream release **1.5.28**.

  - Fixes **CVE-2016-10087**.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3712-1 advisory.

    Patrick Keshishian discovered that libpng incorrectly handled certain PNG files. An attacker could     possibly use this to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04     LTS. (CVE-2016-10087)

    Thuan Pham discovered that libpng incorrectly handled certain PNG files. An attacker could possibly use     this to cause a denial of service. This issue only affected Ubuntu 17.10 and Ubuntu 18.04 LTS.
    (CVE-2018-13785)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libpng12 fixes the following issues :

Security issues fixed :

  - CVE-2015-8540: read underflow in libpng (bsc#958791)

  - CVE-2016-10087: NULL pointer dereference in     png_set_text_2() (bsc#1017646)

This update was imported from the SUSE:SLE-12:Update update project.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
212639	EulerOS 2.0 SP11 : unbound (EulerOS-SA-2024-2973)	Nessus	Huawei Local Security Checks	2024/12/12	2024/12/12	critical
96350	Fedora 24 : libpng10 (2016-1a7e14d084)	Nessus	Fedora Local Security Checks	2017/1/10	2021/1/11	high
96860	GLSA-201701-74 : libpng: Remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	2017/1/30	2021/1/11	high
99085	SUSE SLED12 / SLES12 Security Update : libpng16 (SUSE-SU-2017:0853-1)	Nessus	SuSE Local Security Checks	2017/3/30	2021/1/6	high
99319	Fedora 24 : libpng15 (2017-66fd940572)	Nessus	Fedora Local Security Checks	2017/4/13	2021/1/6	high
111040	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : libpng vulnerabilities (USN-3712-1)	Nessus	Ubuntu Local Security Checks	2018/7/12	2025/9/3	high
99211	openSUSE Security Update : libpng12 (openSUSE-2017-441)	Nessus	SuSE Local Security Checks	2017/4/6	2021/1/19	high

検出

プラグインの検索

critical

high

high

high

high

high

high