The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3327-1 advisory.

    - CVE-2019-19246: Fixed an out of bounds access during regular       expression matching (bsc#1157805).
    - CVE-2019-19204: Fixed an out of bounds access when compiling a       crafted regular expression (bsc#1164569).
    - CVE-2019-19203: Fixed an out of bounds access when performing a       string search (bsc#1164550).
    - CVE-2019-16163: Fixed an uncontrolled recursion issue when compiling       a crafted regular expression, which could lead to denial of service (bsc#1150130).
    - CVE-2020-26159: Fixed an off-by-one buffer overflow (bsc#1177179).
    - CVE-2019-13224: Fixed a potential use-after-free when handling       multiple different encodings (bsc#1142847).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the ruby packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds memory write issue was found in the     Linux Kernel, version 3.13 through 5.4, in the way the     Linux kernel's KVM hypervisor handled the     'KVM_GET_EMULATED_CPUID' ioctl(2) request to get CPUID     features emulated by the KVM hypervisor. A user or     process able to access the '/dev/kvm' device could use     this flaw to crash the system, resulting in a denial of     service.(CVE-2019-16254)

  - An issue was discovered in Oniguruma 6.x before     6.9.4_rc2. In the function fetch_interval_quantifier     (formerly known as fetch_range_quantifier) in     regparse.c, PFETCH is called without checking PEND.
    This leads to a heap-based buffer     over-read.(CVE-2019-19204)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x     through 2.6.4 allows code injection if the first     argument (aka the 'command' argument) to Shell#[] or     Shell#test in lib/shell.rb is untrusted data. An     attacker can exploit this to call an arbitrary Ruby     method.(CVE-2019-16255)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x     through 2.6.4 mishandles path checking within     File.fnmatch functions.(CVE-2019-15845)

  - WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7,     2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a     regular expression Denial of Service cause by     looping/backtracking. A victim must expose a WEBrick     server that uses DigestAuth to the Internet or a     untrusted network.(CVE-2019-16201)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x     through 2.6.4 mishandles path checking within     File.fnmatch functions.(CVE-2019-15845)

  - Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x     through 2.6.4 allows code injection if the first     argument (aka the 'command' argument) to Shell#[] or     Shell#test in lib/shell.rb is untrusted data. An     attacker can exploit this to call an arbitrary Ruby     method.(CVE-2019-16255)

  - An issue was discovered in Oniguruma 6.x before     6.9.4_rc2. In the function fetch_interval_quantifier     (formerly known as fetch_range_quantifier) in     regparse.c, PFETCH is called without checking PEND.
    This leads to a heap-based buffer     over-read.(CVE-2019-19204)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3662 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    The following packages have been upgraded to a later upstream version: php (7.3.20). (BZ#1856655)

    Security Fix(es):

    * php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

    * php: Buffer over-read in exif_read_data() (CVE-2019-11040)

    * php: DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at     that byte (CVE-2019-11045)

    * php: Information disclosure in exif_read_data() (CVE-2019-11047)

    * php: Integer wraparounds when receiving multipart forms (CVE-2019-11048)

    * oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)

    * oniguruma: NULL pointer dereference in match_at() in regexec.c (CVE-2019-13225)

    * oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c (CVE-2019-16163)

    * oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file gb18030.c     (CVE-2019-19203)

    * oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier in regparse.c     (CVE-2019-19204)

    * pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode (CVE-2019-20454)

    * php: Out of bounds read in php_strip_tags_ex (CVE-2020-7059)

    * php: Global buffer-overflow in mbfl_filt_conv_big5_wchar function (CVE-2020-7060)

    * php: NULL pointer dereference in PHP session upload progress (CVE-2020-7062)

    * php: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)

    * php: Information disclosure in exif_read_data() function (CVE-2020-7064)

    * php: Using mb_strtolower() function with UTF-32LE encoding leads to potential code execution     (CVE-2020-7065)

    * php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

    * php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

    * php: Out of bounds read when parsing EXIF information (CVE-2019-11050)

    * oniguruma: Heap-based buffer overflow in str_lower_case_match in regexec.c (CVE-2019-19246)

    * php: Information disclosure in function get_headers (CVE-2020-7066)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-779:01 advisory.

    * php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers()     (CVE-2019-11039)
    * php: Buffer over-read in exif_read_data() (CVE-2019-11040)
    * php: DirectoryIterator class accepts filenames with embedded \0 byte and     treats them as terminating at that byte (CVE-2019-11045)
    * php: Information disclosure in exif_read_data() (CVE-2019-11047)
    * php: Integer wraparounds when receiving multipart forms (CVE-2019-11048)
    * oniguruma: Use-after-free in onig_new_deluxe() in regext.c (CVE-2019-13224)
    * oniguruma: NULL pointer dereference in match_at() in regexec.c     (CVE-2019-13225)
    * oniguruma: Stack exhaustion in regcomp.c because of recursion in regparse.c     (CVE-2019-16163)
    * oniguruma: Heap-based buffer over-read in function gb18030_mbc_enc_len in file     gb18030.c (CVE-2019-19203)
    * oniguruma: Heap-based buffer over-read in function fetch_interval_quantifier     in regparse.c (CVE-2019-19204)
    * pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode     (CVE-2019-20454)
    * php: Out of bounds read in php_strip_tags_ex (CVE-2020-7059)
    * php: Global buffer-overflow in mbfl_filt_conv_big5_wchar function     (CVE-2020-7060)
    * php: NULL pointer dereference in PHP session upload progress (CVE-2020-7062)
    * php: Files added to tar with Phar::buildFromIterator have all-access     permissions (CVE-2020-7063)
    * php: Information disclosure in exif_read_data() function (CVE-2020-7064)
    * php: Using mb_strtolower() function with UTF-32LE encoding leads to potential     code execution (CVE-2020-7065)
    * php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)
    * php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)
    * php: Out of bounds read when parsing EXIF information (CVE-2019-11050)
    * oniguruma: Heap-based buffer overflow in str_lower_case_match in regexec.c     (CVE-2019-19246)
    * php: Information disclosure in function get_headers (CVE-2020-7066)     Modularity name: php     Stream name: 7.3

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1776951056 advisory.

  - Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.
    (CVE-2019-16163)

  - An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file     gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string.
    This leads to a heap-based buffer over-read. (CVE-2019-19203)

  - An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier     (formerly known as fetch_range_quantifier) in regparse.c, PFETCH is called without checking PEND. This     leads to a heap-based buffer over-read. (CVE-2019-19204)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7.9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0728 advisory.

    This advisory aggregates security fixes for the php SRPM in CIQ CentOS Bridge 7.9. It addresses 65 CVEs:
    CVE-2023-0568, CVE-2021-21702, CVE-2015-6838, CVE-2019-19204, CVE-2016-6297, and 60 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0889 advisory.

  - A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause     information disclosure, denial of service, or possibly code execution by providing a crafted regular     expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that     gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional     libraries for PHP and Rust. (CVE-2019-13224)

  - Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.
    (CVE-2019-16163)

  - An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads     to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only     affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information     disclosure, or possibly have unspecified other impact, via a crafted regular expression. (CVE-2019-19012)

  - An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file     gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string.
    This leads to a heap-based buffer over-read. (CVE-2019-19203)

  - An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier     (formerly known as fetch_range_quantifier) in regparse.c, PFETCH is called without checking PEND. This     leads to a heap-based buffer over-read. (CVE-2019-19204)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0076 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-13224:
    A use-after-free in onig_new_deluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause     information disclosure, denial of service, or possibly code execution by providing a crafted regular     expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that     gets handled by onig_new_deluxe(). Oniguruma issues often affect Ruby, as well as common optional     libraries for PHP and Rust.

    CVE-2019-16163:
    Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.

    CVE-2019-19012:
    An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads     to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only     affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or information     disclosure, or possibly have unspecified other impact, via a crafted regular expression.

    CVE-2019-19203:
    An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in file     gb18030.c, a UChar pointer is dereferenced without checking if it passed the end of the matched string.
    This leads to a heap-based buffer over-read.

    CVE-2019-19204:
    An issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function fetch_interval_quantifier     (formerly known as fetch_range_quantifier) in regparse.c, PFETCH is called without checking PEND. This     leads to a heap-based buffer over-read.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Address CVE-2019-19204 CVE-2019-19203 CVE-2019-19012. Fixes are backported.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
165304	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : oniguruma (SUSE-SU-2022:3327-1)	Nessus	SuSE Local Security Checks	2022/9/22	2026/6/25	critical
136232	EulerOS Virtualization for ARM 64 3.0.2.0 : ruby (EulerOS-SA-2020-1529)	Nessus	Huawei Local Security Checks	2020/5/1	2024/3/13	high
134815	EulerOS 2.0 SP5 : ruby (EulerOS-SA-2020-1324)	Nessus	Huawei Local Security Checks	2020/3/23	2024/3/21	high
140396	RHEL 8 : php:7.3 (RHSA-2020:3662)	Nessus	Red Hat Local Security Checks	2020/9/8	2025/3/13	critical
293880	MiracleLinux 8 : php:7.3 (AXSA:2020-779:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/21	critical
351655	CentOS Linux 8 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1776951056)	Nessus	CentOS Local Security Checks	2026/9/30	2026/9/30	high
355689	CentOS Linux 7.9 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0728)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/8	critical
190903	AlmaLinux 8 : oniguruma (ALSA-2024:0889)	Nessus	Alma Linux Local Security Checks	2024/2/22	2024/2/22	critical
236383	Alibaba Cloud Linux 3 : 0076: oniguruma (ALINUX3-SA-2024:0076)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
131792	Fedora 30 : oniguruma (2019-73197ff9a0)	Nessus	Fedora Local Security Checks	2019/12/9	2024/4/5	critical

検出

プラグインの検索

critical

high

high

critical

critical

high

critical

critical

critical

critical