There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0,
    ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the
    attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an
    impossible capacity, causing the infallible allocation path to abort the process before the entry is
    validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial
    of service in archive-processing applications. This issue is fixed in version 9.0.0. (CVE-2026-115909)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - zip 是一個適用於 Rust 的 zip 函式庫，支援讀取和寫入簡單的 ZIP 檔案。From 1.3.0 until 9.0.0， src/read/mod.rs 中的 ZipArchive：：extract 會在讀取項目資料之前，使用攻擊者控制 ZIP64 的uncompressed_size呼叫符號連結目標的 Vec：：with_capacity。小型封存可能會要求不可能的容量，導致無誤配置路徑在驗證項目之前中止處理程序。失敗無法包含在catch_unwind或工作執行緒中，從而允許在封存處理應用程式中重複拒絕服務。9.0.0 版已修正此問題。(CVE-2026-115909)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - zip 是适用于 Rust 的 zip 库，支持读取和写入简单的 ZIP 文件。From 1.3.0 until 9.0.0， src/read/mod.rs 中的 ZipArchive：：extract 会在读取条目数据之前，使用攻击者控制 ZIP64 的 uncompressed_size 为符号链接目标调用 Vec：：with_capacity。小型存档可请求不可能的容量，从而导致 infallible 分配路径在验证条目之前中止进程。无法通过catch_unwind或工作线程来遏制此故障，从而允许存档处理应用程序反复拒绝服务。此问题已在 9.0.0 版本中修复。(CVE-2026-115909)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - zip は、単純な ZIP ファイルの読み書きをサポートする Rust 用の zip ライブラリです。1.3.0から9.0.0まで、src/read/mod.rsのZipArchive::extractはエントリデータを読み込む前に、攻撃者が制御するZIP64 uncompressed_sizeを使用してシンボリックリンクターゲット用のVec::with_capacity呼び出します。小さいアーカイブでは、不可能な容量をリクエストすることができ、エントリが検証される前に、間違いのない割り当てパスがプロセスを中止させる可能性があります。この障害を catch_unwind またはワーカースレッドで封じ込めることができないため、アーカイブ処理アプリケーションでサービス拒否が繰り返される可能性があります。この問題はバージョン 9.0.0 で修正されています。(CVE-2026-115909)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24658-1 advisory.

    This update for rust-keylime fixes the following issue:

    - CVE-2026-115905: zip: security control bypass via parser differential between central directory and     local headers       (bsc#1287921)
    - CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification     (bsc#1287921)
    - CVE-2026-115907: zip: denial of service via unbounded memory allocation in legacy decoders (bsc#1287921)
    - CVE-2026-115908: zip: path traversal via lexical symlink validation during extraction (bsc#1287921)
    - CVE-2026-115909: zip: denial of service via uncontrolled memory allocation on symlink targets     (bsc#1287921)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22249-1 advisory.

    This update for rust-keylime fixes the following issue:

    - CVE-2026-115905: zip: security control bypass via parser differential between central directory and     local headers       (bsc#1287921)
    - CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification     (bsc#1287921)
    - CVE-2026-115907: zip: denial of service via unbounded memory allocation in legacy decoders (bsc#1287921)
    - CVE-2026-115908: zip: path traversal via lexical symlink validation during extraction (bsc#1287921)
    - CVE-2026-115909: zip: denial of service via uncontrolled memory allocation on symlink targets     (bsc#1287921)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0,     ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the     attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an     impossible capacity, causing the infallible allocation path to abort the process before the entry is     validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial     of service in archive-processing applications. This issue is fixed in version 9.0.0. (CVE-2026-115909)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
478185	Chainguard: verus: security update to 0.2026.10.18-r1	Tenable Cloud Security	Chainguard Local Security Checks	2026/11/2	2026/11/2	high
478185	Chainguard: verus: security update to 0.2026.10.18-r1	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	2026/11/2	2026/11/2	high
372215	Linux Distros 未修補弱點：CVE-2026-115909	Nessus	Misc.	2026/10/27	2026/11/13	high
372215	Linux Distros 未修补的漏洞：CVE-2026-115909	Nessus	Misc.	2026/10/27	2026/11/13	high
372215	Linux Distros のパッチ未適用の脆弱性: CVE-2026-115909	Nessus	Misc.	2026/10/27	2026/11/13	high
379469	SUSE SLES16 Security Update : rust-keylime (SUSE-SU-2026:24658-1)	Nessus	SuSE Local Security Checks	2026/11/12	2026/11/12	critical
379533	openSUSE 16 Security Update : rust-keylime (openSUSE-SU-2026:22249-1)	Nessus	SuSE Local Security Checks	2026/11/12	2026/11/12	critical
372215	Linux Distros Unpatched Vulnerability : CVE-2026-115909	Nessus	Misc.	2026/10/27	2026/11/13	high

偵測

搜尋 Plugin

high

high

high

high

high

critical

critical

high