The version of glibc installed on the remote host is prior to 2.17-322.181. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2021-1511 advisory.

    A vulnerability was discovered in glibc where the LD_PREFER_MAP_32BIT_EXEC environment variable is not     ignored when running binaries with the setuid flag on x86_64 architectures. This allows an attacker to     force system to utilize only half of the memory (making the system think the software is 32-bit only),     thus lowering the amount of memory being used with address space layout randomization (ASLR). The highest     threat is confidentiality although the complexity of attack is high. The affected application must already     have other vulnerabilities for this flaw to be usable. (CVE-2019-19126)

    A flaw was found in glibc. When processing input in the EUC-KR encoding, an invalid input sequence could     cause glibc to read beyond the end of a buffer, resulting in a segmentation fault. The highest threat from     this vulnerability is to system availability. (CVE-2019-25013)

    A flaw was found in glibc in versions prior to 2.32. Pseudo-zero values are not validated causing a stack     corruption due to a stack-based overflow. The highest threat from this vulnerability is to system     availability. (CVE-2020-10029)

    A stack buffer overflow flaw was found in glibc in the way the printf family of functions processed an     80-bit long double with a non-canonical bit pattern. This flaw allows an attacker who can control the     arguments of these functions with the non-standard long double pattern to trigger an overflow and cause an     application crash. The highest threat from this vulnerability is to system availability. (CVE-2020-29573)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202107-07 (glibc: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in glibc. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker could cause a possible Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for glibc fixes the following issues :

Fix buffer overrun in EUC-KR conversion module (CVE-2019-25013, bsc#1182117, BZ #24973)

gconv: Fix assertion failure in ISO-2022-JP-3 module (CVE-2021-3326, bsc#1181505, BZ #27256)

Fix parsing of /sys/devices/system/cpu/online (bsc#1180038, BZ #25859)

powerpc: Add support for POWER10 (bsc#1181365)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc     or libc6) before 2.23 on x86 targets has a stack-based     buffer overflow if the input to any of the printf     family of functions is an 80-bit long double with a     non-canonical bit pattern, as seen when passing a     \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by     default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math     functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the     mention of 'Fixed for glibc 2.33' in the 26649     reference.(CVE-2020-29573)

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.30 to 2.32, when converting UCS4 text     containing an irreversible character, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2020-29562)

  - A flaw was found in glibc. When processing input in the     EUC-KR encoding, an invalid input sequence could cause     glibc to read beyond the end of a buffer, resulting in     a segmentation fault. The highest threat from this     vulnerability is to system     availability.(CVE-2019-25013)

  - The iconv function in the GNU C Library (aka glibc or     libc6) 2.32 and earlier, when processing invalid input     sequences in the ISO-2022-JP-3 encoding, fails an     assertion in the code path and aborts the program,     potentially resulting in a denial of     service.(CVE-2021-3326)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of AOS installed on the remote host is prior to 5.15.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.15.6 advisory.

  - encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write     access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character     sequence. (CVE-2021-26937)

  - Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java     SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16;
    Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded,     Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2021-2163)

  - In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a     malicious USB device in the Linux kernel HID drivers, aka CID-d9d4b1e46d95. This affects drivers/hid/hid-     axff.c, drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c, drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c,     drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c, drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c,     drivers/hid/hid-logitech-hidpp.c, drivers/hid/hid-microsoft.c, drivers/hid/hid-sony.c, drivers/hid/hid-     tmff.c, and drivers/hid/hid-zpff.c. (CVE-2019-19532)

  - In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could     lead to local information disclosure with no additional execution privileges needed. User interaction is     not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171     (CVE-2020-0427)

  - A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem     allowing a local attacker with permission to monitor perf events to corrupt memory and possibly escalate     privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2020-14351)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.19.1.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.1.5 advisory.

  - Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

  - Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as root. (CVE-2020-15862)

  - Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain     privileges or cause a denial of service by leveraging improper access to a certain error field.
    (CVE-2020-15436)

  - A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system)     functionality was found in the way user create and delete object using NFSv4.2 or newer if both     simultaneously accessing the NFS by the other process that is not using new NFSv4.2. A user with access to     the NFS could use this flaw to starve the resources causing denial of service. (CVE-2020-35513)

  - Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular     expression quantifiers have an integer overflow. (CVE-2020-10543)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
151518	Amazon Linux AMI : glibc (ALAS-2021-1511)	Nessus	Amazon Linux Local Security Checks	2021/7/13	2024/12/11	low
157005	GLSA-202107-07 : glibc: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2022/1/24	2023/12/21	critical
146924	SUSE SLES12 Security Update : glibc (SUSE-SU-2021:0608-1)	Nessus	SuSE Local Security Checks	2021/3/1	2022/5/10	high
147455	EulerOS Virtualization for ARM 64 3.0.2.0 : glibc (EulerOS-SA-2021-1382)	Nessus	Huawei Local Security Checks	2021/3/10	2024/1/11	high
164567	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.6)	Nessus	Misc.	2022/9/1	2025/7/22	critical
164609	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.1.5)	Nessus	Misc.	2022/9/1	2025/7/22	high

検出

プラグインの検索

low

critical

high

high

critical

high