The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2024_5306 advisory.

    * orc: Stack-based buffer overflow vulnerability in ORC (CVE-2024-40897)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1725650489 advisory.

  - Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a     developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code     may be executed on the developer's build environment. This may lead to compromise of developer machines or     CI build environments. (CVE-2024-40897)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of orc installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-40897 advisory.

  - Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a     developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code     May be executed on the developer's build environment. This May lead to compromise of developer machines or     CI build environments. (CVE-2024-40897)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5306 advisory.

    Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays     of data.  The language is a generic assembly language that represents many of the features available in     SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.

    Security Fix(es):

    * orc: Stack-based buffer overflow vulnerability in ORC (CVE-2024-40897)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5629 advisory.

    Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays     of data.  The language is a generic assembly language that represents many of the features available in     SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.

    Security Fix(es):

    * orc: Stack-based buffer overflow vulnerability in ORC (CVE-2024-40897)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5638 advisory.

    Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays     of data.  The language is a generic assembly language that represents many of the features available in     SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.

    Security Fix(es):

    * orc: Stack-based buffer overflow vulnerability in ORC (CVE-2024-40897)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of orc installed on the remote host is prior to 0.4.26-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2727 advisory.

    Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a     developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code     may be executed on the developer's build environment. (CVE-2024-40897)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0197 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-40897:
    Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a     developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code     may be executed on the developer's build environment. This may lead to compromise of developer machines or     CI build environments.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
354308	Rocky Linux 8 [CIQ] Security Update: orc / orc-compiler / orc-compiler-debuginfo / orc-debuginfo / etc (crlsa-2024_5306)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
361762	CentOS Linux 7 [TuxCare] Security Update: orc / orc-compiler / orc-devel / orc-doc (CENTOS7:CLSA-2024:1725650489)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	medium
295738	Azure Linux 3.0 Security Update: orc (CVE-2024-40897)	Nessus	Azure Linux Local Security Checks	2026/1/22	2026/1/22	medium
205502	RHEL 8 : orc (RHSA-2024:5306)	Nessus	Red Hat Local Security Checks	2024/8/14	2025/3/28	medium
205878	RHEL 9 : orc (RHSA-2024:5629)	Nessus	Red Hat Local Security Checks	2024/8/20	2024/11/8	medium
205883	RHEL 9 : orc:0.4.31 (RHSA-2024:5638)	Nessus	Red Hat Local Security Checks	2024/8/20	2025/4/8	medium
213667	Amazon Linux 2 : orc (ALAS-2025-2727)	Nessus	Amazon Linux Local Security Checks	2025/1/9	2025/1/9	medium
236339	Alibaba Cloud Linux 3 : 0197: orc (ALINUX3-SA-2024:0197)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

medium