The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1968 advisory.

  - In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application     because of missing validation of a sqlite_stat1 sz field, aka a severe division by zero in the query     planner. (CVE-2019-16168)

  - SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. (CVE-2020-13434)

  - ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet     feature. (CVE-2020-13630)

  - SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related     to alter.c and build.c. (CVE-2020-13631)

  - ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo()     query. (CVE-2020-13632)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202007-26 (SQLite: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in SQLite. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of macOS / Mac OS X that is 11.0.x prior to 11.0.1. It is, therefore, affected by multiple vulnerabilities, including the following:

  - An out-of-bounds write issue that can lead to unexpected application termination or arbitrary code     execution when opening a maliciously crafted PDF file. (CVE-2020-9876)

  - An out-of-bounds write caused by insufficient input validation that can lead to arbitrary code execution     when processing a maliciously crafted image. (CVE-2020-9883)

  - A remote attacker may be able to unexpectedly alter the Mail application date due to insufficient checks.
    (CVE-2020-9941)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA69705 advisory.

  - ** DISPUTED ** A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0     via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the     relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally     allowed to execute commands). This report does NOT imply any problem in the SQLite library.
    (CVE-2021-36690)

  - A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who     is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible     code execution by triggering a use-after-free. The highest threat from this vulnerability is to system     availability. (CVE-2021-20227)

  - In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy     heap overflow because of misuse of transitive properties for constant propagation. (CVE-2020-15358)

  - SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for     window functions is too late. (CVE-2020-13871)

  - ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo()     query. (CVE-2020-13632)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0121 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-13734:
    Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page.

    CVE-2019-16168:
    In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application     because of missing validation of a sqlite_stat1 sz field, aka a severe division by zero in the query     planner.

    CVE-2019-19959:
    ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving     embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for     example) valgrind.

    CVE-2019-5018:
    An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0.
    A specially crafted SQL command can cause a use after free vulnerability, potentially resulting in remote     code execution. An attacker can send a malicious SQL command to trigger this vulnerability.

    CVE-2020-13434:
    SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

    CVE-2020-13630:
    ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet     feature.

    CVE-2020-13631:
    SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related     to alter.c and build.c.

    CVE-2020-13632:
    ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo()     query.

    CVE-2020-15358:
    In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy     heap overflow because of misuse of transitive properties for constant propagation.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1581 advisory.

    - Fixed CVE-2020-13434 (#1845843)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1581 advisory.

  - SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. (CVE-2020-13434)

  - In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy     heap overflow because of misuse of transitive properties for constant propagation. (CVE-2020-15358)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An integer overflow vulnerability was found in the sqlite3_str_vappendf function of the src/printf.c file of sqlite3 from version 3.8.3.

For Debian 8 'Jessie', this problem has been fixed in version 3.8.7.1-1+deb8u6.

We recommend that you upgrade your sqlite3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the sqlite package has been released.

According to the versions of the sqlite packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - SQLite through 3.32.0 has a segmentation fault in     sqlite3ExprCodeTarget in expr.c.(CVE-2020-13435)

  - SQLite through 3.32.0 has an integer overflow in     sqlite3_str_vappendf in printf.c.(CVE-2020-13434)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
157470	AlmaLinux 8 : mingw packages (ALSA-2021:1968)	Nessus	Alma Linux Local Security Checks	2022/2/9	2023/11/13	high
138949	GLSA-202007-26 : SQLite: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/7/27	2024/2/28	critical
143115	macOS 11.0.x < 11.0.1	Nessus	MacOS X Local Security Checks	2020/11/19	2024/5/28	high
163770	Juniper Junos OS Multiple Vulnerabilities (JSA69705)	Nessus	Junos Local Security Checks	2022/8/3	2024/10/28	critical
276396	TencentOS Server 3: mingw packages (TSSA-2022:0121)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	high
149928	Oracle Linux 8 : sqlite (ELSA-2021-1581)	Nessus	Oracle Linux Local Security Checks	2021/5/26	2024/11/1	medium
157651	AlmaLinux 8 : sqlite (ALSA-2021:1581)	Nessus	Alma Linux Local Security Checks	2022/2/9	2023/11/10	medium
136893	Debian DLA-2221-1 : sqlite3	Nessus	Debian Local Security Checks	2020/5/27	2024/3/8	medium
137188	Photon OS 3.0: Sqlite PHSA-2020-3.0-0101	Nessus	PhotonOS Local Security Checks	2020/6/6	2025/8/22	high
142554	EulerOS Virtualization 3.0.6.6 : sqlite (EulerOS-SA-2020-2453)	Nessus	Huawei Local Security Checks	2020/11/6	2024/2/9	medium

検出

プラグインの検索

high

critical

high

critical

high

medium

medium

medium

high

medium