The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5629 advisory.

    Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays     of data.  The language is a generic assembly language that represents many of the features available in     SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.

    Security Fix(es):

    * orc: Stack-based buffer overflow vulnerability in ORC (CVE-2024-40897)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:5638 advisory.

    Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays     of data.  The language is a generic assembly language that represents many of the features available in     SIMD architectures, including saturated addition and subtraction, and many arithmetic operations.

    Security Fix(es):

    * orc: Stack-based buffer overflow vulnerability in ORC (CVE-2024-40897)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of orc installed on the remote host is prior to 0.4.26-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2727 advisory.

    Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a     developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code     may be executed on the developer's build environment. (CVE-2024-40897)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0197 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-40897:
    Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a     developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code     may be executed on the developer's build environment. This may lead to compromise of developer machines or     CI build environments.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:6184 advisory.

    * orc: Stack-based buffer overflow vulnerability in ORC (CVE-2024-40897)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-728 advisory.

    Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a     developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code     may be executed on the developer's build environment. (CVE-2024-40897)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a     developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code     may be executed on the developer's build environment. This may lead to compromise of developer machines or     CI build environments. (CVE-2024-40897)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202505-05 (Orc: Arbitrary Code Execution)

    Please review the CVE identifier referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
205878	RHEL 9 : orc (RHSA-2024:5629)	Nessus	Red Hat Local Security Checks	2024/8/20	2024/11/8	medium
205883	RHEL 9 : orc:0.4.31 (RHSA-2024:5638)	Nessus	Red Hat Local Security Checks	2024/8/20	2025/4/8	medium
213667	Amazon Linux 2 : orc (ALAS-2025-2727)	Nessus	Amazon Linux Local Security Checks	2025/1/9	2025/1/9	medium
236339	Alibaba Cloud Linux 3 : 0197: orc (ALINUX3-SA-2024:0197)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
206608	AlmaLinux 9 : orc (ALSA-2024:6184)	Nessus	Alma Linux Local Security Checks	2024/9/4	2024/9/4	medium
208983	Amazon Linux 2023 : orc, orc-compiler, orc-devel (ALAS2023-2024-728)	Nessus	Amazon Linux Local Security Checks	2024/10/14	2024/10/14	medium
229319	Linux Distros Unpatched Vulnerability : CVE-2024-40897	Nessus	Misc.	2025/3/5	2026/9/2	medium
235725	GLSA-202505-05 : Orc: Arbitrary Code Execution	Nessus	Gentoo Local Security Checks	2025/5/12	2025/5/12	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

medium