There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment
    variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid
    (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses gettext can make
    it load a message catalog (.mo file) from an arbitrary location in the file system. A crafted .mo file can
    crash the program through out-of-range offsets, or supply translations whose format directives do not
    match the arguments passed by the program. That causes undefined behaviour in the printf family of
    functions and may allow arbitrary code execution with the privileges of the program. The safety of message
    catalogs relies on them being installed in trusted, read-only locations, and the directory traversal
    bypasses this. The fix for CVE-2014-0475 rejects ".." path components in locale names passed to setlocale
    or taken from the LC_ALL, LC_* and LANG environment variables. gettext reads LANGUAGE directly and appends
    each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE. LANGUAGE
    is only used when the LC_MESSAGES locale is not "C", "C.<encoding>" or "POSIX", so the attacker must also
    be able to select another installed locale, for example through LANG or LC_ALL. Exploitation also requires
    that the attacker can place the crafted file in a location readable by the target program, and that the
    environment crosses a trust boundary without the program running as AT_SECURE. An example is an SSH server
    that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a
    forced command; the attacker may use this to escape the restriction. (CVE-2026-84243)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - GNU C 程式庫版本 2.0 和更新版本中的 gettext 系列函數接受包含 '/' 或等於 .. 的 LANGUAGE 環境變數項目，除非程式是 setuid 或 setgid （AT_SECURE）。攻擊者若能在使用 gettext 的程式環境中設定 LANGUAGE，就可以使其從檔案系統中的任意位置載入訊息目錄 （.mo 檔案）。特製的 .mo 檔案可能會因超出範圍的位移而使程式當機，或提供格式指示詞與程式傳遞的引數不相符的翻譯。這會導致 printf 函式系列中出現未定義的行為，並可能允許以程式的權限執行任意程式碼。訊息型錄的安全性取決於將它們安裝在受信任的唯讀位置，而目錄遊走會繞過這一點。針對拒絕 CVE-2014-0475 .. 傳遞給 setlocale 或取自 LC_ALL、LC_* 和 LANG 環境變數的語言環境名稱中的路徑元件的修正。 gettext 會直接讀取 LANGUAGE，並將每個冒號分隔的項目附加到訊息目錄目錄中，因此該修正未涵蓋 LANGUAGE。LANGUAGE 僅在LC_MESSAGES語言環境不是 C、C 時使用。<encoding> 或 POSIX，因此攻擊者還必須能夠選取另一個已安裝的地區設定，例如透過 LANG 或 LC_ALL。利用還要求攻擊者可以將特製的檔案放置在目標程式可讀取的位置，並且環境跨越信任邊界，而程式不會以AT_SECURE方式執行。例如，SSH 伺服器會透過 AcceptEnv 指令接受來自用戶端的 LANGUAGE 和 LANG，並將帳戶限制為強制命令;攻擊者可能會利用此漏洞來逃避限制。（CVE-2026-84243）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - GNU C 库版本 2.0 和之后版本中的 gettext 系列函数接受包含“/”或等于 .. 的 LANGUAGE 环境变量条目，除非该程序为 setuid 或 setgid （AT_SECURE）。如果攻击者可在使用 gettext 的程序环境中设置 LANGUAGE，则可使其从文件系统中的任意位置加载消息目录（.mo 文件）。特制的 .mo 文件可通过超出范围偏移导致程序崩溃，或提供格式指令与程序传递的参数不匹配的翻译。这会导致 printf 系列函数中出现未定义行为，并可能允许以该程序的权限执行任意代码。消息目录的安全性取决于将其安装在受信任的只读位置，而目录遍历可绕过这一点。的 CVE-2014-0475 补丁拒绝将区域设置名称中的路径组件传递到 setlocale 或取自 LC_ALL、LC_* 和 LANG 环境变量。 gettext 直接读取 LANGUAGE 并将每个以冒号分隔的条目附加到消息目录，因此该补丁未涵盖 LANGUAGE。仅当LC_MESSAGES区域设置不是 C、C 时才使用 LANGUAGE。<encoding> 或 POSIX，因此攻击者还必须能够选择其他已安装的区域设置，例如通过 LANG 或 LC_ALL。要利用此漏洞，还需要攻击者能够将构建的文件放置到目标程序可读取的位置，并且环境必须在程序不以AT_SECURE身份运行的情况下跨越信任边界。例如，SSH 服务器通过 AcceptEnv 指令接受来自客户端的 LANGUAGE 和 LANG，并将帐户限制为强制命令;攻击者可利用此问题避开限制。（CVE-2026-84243）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - GNU C ライブラリのバージョン 2.0 以降の gettext ファミリー関数は、プログラムが setuid または setgid (AT_SECURE) でない限り、「/」を含むか、..に等しい LANGUAGE 環境変数エントリを受け入れます。gettext を使用するプログラムの環境で LANGUAGE を設定できる攻撃者が、ファイルシステム内の任意の場所からメッセージカタログ(.mo ファイル)をロードさせる可能性があります。細工された .mo ファイルにより、範囲外のオフセットによってプログラムがクラッシュしたり、フォーマットディレクティブがプログラムに渡された引数と一致しない変換が提供されたりする可能性があります。これにより、printf ファミリー関数内で定義されていない動作が発生し、プログラムの権限で任意のコードが実行される可能性があります。メッセージカタログの安全性は、それらが信頼できる読み取り専用の場所にインストールされているかどうかに依存しており、ディレクトリトラバーサルはこれをバイパスします。CVE-2014-0475 の修正では、setlocale に渡されるか、または LC_ALL、LC_* および LANG の環境変数から取得されたロケール名のパスコンポーネントを拒否します。 gettext は LANGUAGE を直接読み取り、コロンで区切られた各エントリをメッセージカタログディレクトリに追加するため、修正は LANGUAGE をカバーしませんでした。LANGUAGE は、LC_MESSAGESロケールが C、C.<encoding> でない場合のみ使用されます。そのため、攻撃者は、LANG や LC_ALL などを介して、別のインストール済みロケールも選択できる必要があります。悪用するには、攻撃者が細工されたファイルを標的のプログラムが読み取れる場所に配置できること、およびプログラムがAT_SECUREとして実行されずに環境が信頼境界を越えることも必要です。例として、AcceptEnv ディレクティブを通じてクライアントから言語と LANG を受け入れ、アカウントを強制コマンドに制限する SSH サーバーがあります。攻撃者はこれを利用して、制限を回避する可能性があります。(CVE-2026-84243)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793969685 advisory.

  - The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment     variable entries that contain '/' or that are equal to .., unless the program is setuid or setgid     (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses gettext can make     it load a message catalog (.mo file) from an arbitrary location in the file system. A crafted .mo file can     crash the program through out-of-range offsets, or supply translations whose format directives do not     match the arguments passed by the program. That causes undefined behaviour in the printf family of     functions and may allow arbitrary code execution with the privileges of the program. The safety of message     catalogs relies on them being installed in trusted, read-only locations, and the directory traversal     bypasses this. The fix for CVE-2014-0475 rejects .. path components in locale names passed to setlocale     or taken from the LC_ALL, LC_* and LANG environment variables. gettext reads LANGUAGE directly and appends     each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE. LANGUAGE     is only used when the LC_MESSAGES locale is not C, C.<encoding> or POSIX, so the attacker must also     be able to select another installed locale, for example through LANG or LC_ALL. Exploitation also requires     that the attacker can place the crafted file in a location readable by the target program, and that the     environment crosses a trust boundary without the program running as AT_SECURE. An example is an SSH server     that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a     forced command; the attacker may use this to escape the restriction. (CVE-2026-84243)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793969685 advisory.

  - The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment     variable entries that contain '/' or that are equal to .., unless the program is setuid or setgid     (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses gettext can make     it load a message catalog (.mo file) from an arbitrary location in the file system. A crafted .mo file can     crash the program through out-of-range offsets, or supply translations whose format directives do not     match the arguments passed by the program. That causes undefined behaviour in the printf family of     functions and may allow arbitrary code execution with the privileges of the program. The safety of message     catalogs relies on them being installed in trusted, read-only locations, and the directory traversal     bypasses this. The fix for CVE-2014-0475 rejects .. path components in locale names passed to setlocale     or taken from the LC_ALL, LC_* and LANG environment variables. gettext reads LANGUAGE directly and appends     each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE. LANGUAGE     is only used when the LC_MESSAGES locale is not C, C.<encoding> or POSIX, so the attacker must also     be able to select another installed locale, for example through LANG or LC_ALL. Exploitation also requires     that the attacker can place the crafted file in a location readable by the target program, and that the     environment crosses a trust boundary without the program running as AT_SECURE. An example is an SSH server     that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a     forced command; the attacker may use this to escape the restriction. (CVE-2026-84243)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793880080 advisory.

  - The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment     variable entries that contain '/' or that are equal to .., unless the program is setuid or setgid     (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses gettext can make     it load a message catalog (.mo file) from an arbitrary location in the file system. A crafted .mo file can     crash the program through out-of-range offsets, or supply translations whose format directives do not     match the arguments passed by the program. That causes undefined behaviour in the printf family of     functions and may allow arbitrary code execution with the privileges of the program. The safety of message     catalogs relies on them being installed in trusted, read-only locations, and the directory traversal     bypasses this. The fix for CVE-2014-0475 rejects .. path components in locale names passed to setlocale     or taken from the LC_ALL, LC_* and LANG environment variables. gettext reads LANGUAGE directly and appends     each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE. LANGUAGE     is only used when the LC_MESSAGES locale is not C, C.<encoding> or POSIX, so the attacker must also     be able to select another installed locale, for example through LANG or LC_ALL. Exploitation also requires     that the attacker can place the crafted file in a location readable by the target program, and that the     environment crosses a trust boundary without the program running as AT_SECURE. An example is an SSH server     that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a     forced command; the attacker may use this to escape the restriction. (CVE-2026-84243)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1794401578 advisory.

  - The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment     variable entries that contain '/' or that are equal to .., unless the program is setuid or setgid     (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses gettext can make     it load a message catalog (.mo file) from an arbitrary location in the file system. A crafted .mo file can     crash the program through out-of-range offsets, or supply translations whose format directives do not     match the arguments passed by the program. That causes undefined behaviour in the printf family of     functions and may allow arbitrary code execution with the privileges of the program. The safety of message     catalogs relies on them being installed in trusted, read-only locations, and the directory traversal     bypasses this. The fix for CVE-2014-0475 rejects .. path components in locale names passed to setlocale     or taken from the LC_ALL, LC_* and LANG environment variables. gettext reads LANGUAGE directly and appends     each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE. LANGUAGE     is only used when the LC_MESSAGES locale is not C, C.<encoding> or POSIX, so the attacker must also     be able to select another installed locale, for example through LANG or LC_ALL. Exploitation also requires     that the attacker can place the crafted file in a location readable by the target program, and that the     environment crosses a trust boundary without the program running as AT_SECURE. An example is an SSH server     that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a     forced command; the attacker may use this to escape the restriction. (CVE-2026-84243)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1793958787 advisory.

  - The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment     variable entries that contain '/' or that are equal to .., unless the program is setuid or setgid     (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses gettext can make     it load a message catalog (.mo file) from an arbitrary location in the file system. A crafted .mo file can     crash the program through out-of-range offsets, or supply translations whose format directives do not     match the arguments passed by the program. That causes undefined behaviour in the printf family of     functions and may allow arbitrary code execution with the privileges of the program. The safety of message     catalogs relies on them being installed in trusted, read-only locations, and the directory traversal     bypasses this. The fix for CVE-2014-0475 rejects .. path components in locale names passed to setlocale     or taken from the LC_ALL, LC_* and LANG environment variables. gettext reads LANGUAGE directly and appends     each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE. LANGUAGE     is only used when the LC_MESSAGES locale is not C, C.<encoding> or POSIX, so the attacker must also     be able to select another installed locale, for example through LANG or LC_ALL. Exploitation also requires     that the attacker can place the crafted file in a location readable by the target program, and that the     environment crosses a trust boundary without the program running as AT_SECURE. An example is an SSH server     that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a     forced command; the attacker may use this to escape the restriction. (CVE-2026-84243)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment     variable entries that contain '/' or that are equal to .., unless the program is setuid or setgid     (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses gettext can make     it load a message catalog (.mo file) from an arbitrary location in the file system. A crafted .mo file can     crash the program through out-of-range offsets, or supply translations whose format directives do not     match the arguments passed by the program. That causes undefined behaviour in the printf family of     functions and may allow arbitrary code execution with the privileges of the program. The safety of message     catalogs relies on them being installed in trusted, read-only locations, and the directory traversal     bypasses this. The fix for CVE-2014-0475 rejects .. path components in locale names passed to setlocale     or taken from the LC_ALL, LC_* and LANG environment variables. gettext reads LANGUAGE directly and appends     each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE. LANGUAGE     is only used when the LC_MESSAGES locale is not C, C.<encoding> or POSIX, so the attacker must also     be able to select another installed locale, for example through LANG or LC_ALL. Exploitation also requires     that the attacker can place the crafted file in a location readable by the target program, and that the     environment crosses a trust boundary without the program running as AT_SECURE. An example is an SSH server     that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a     forced command; the attacker may use this to escape the restriction. (CVE-2026-84243)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-9065-1 advisory.

    It was discovered that the GNU C Library incorrectly handled the ccs= option in the fopen function. An     attacker could possibly use this issue to cause GNU C Library to crash or execute arbitrary code.
    (CVE-2026-18374)

    It was discovered that the GNU C Library incorrectly handled long domain names in DNS search lists. An     attacker on the local network could possibly use this issue to cause GNU C Library to crash, resulting in     a denial of service. (CVE-2026-8674)

    It was discovered that the GNU C Library dynamic loader had a time-of-check to time-of-use race condition     when handling the $ORIGIN path expansion in setuid or setgid programs. A local attacker could possibly use     this issue to execute arbitrary code with elevated privileges. (CVE-2026-86805)

    It was discovered that the GNU C Library dynamic loader incorrectly handled $ORIGIN path expansion,     leading to a stack-based buffer overflow. A local attacker could possibly use this issue to cause GNU C     Library to crash, resulting in a denial of service, or obtain sensitive information. (CVE-2026-95818)

    It was discovered that the GNU C Library nscd service incorrectly handled large DNS responses. An attacker     could possibly use this issue to cause nscd to crash, resulting in a denial of service. (CVE-2026-89092)

    It was discovered that the GNU C Library strncasecmp function optimized for the Power8 architecture     incorrectly handled certain inputs. An attacker could possibly use this issue to cause GNU C Library to     crash, resulting in a denial of service. (CVE-2026-97399)

    It was discovered that the GNU C Library incorrectly restricted path traversal when processing the     LANGUAGE environment variable in gettext. A local attacker could possibly use this issue to load message     catalogs from arbitrary locations and execute arbitrary code. (CVE-2026-84243)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
478286	Echo: glibc: security update to 2.41-12+deb13u4+e5	Tenable Cloud Security	Echo Local Security Checks	2026/11/4	2026/11/4	high
478286	Echo: glibc: security update to 2.41-12+deb13u4+e5	Tenable Self-Hosted Container Security	Echo Local Security Checks	2026/11/4	2026/11/4	high
374413	Linux Distros 未修補弱點：CVE-2026-84243	Nessus	Misc.	2026/10/31	2026/11/9	high
374413	Linux Distros 未修补的漏洞：CVE-2026-84243	Nessus	Misc.	2026/10/31	2026/11/9	high
374413	Linux Distros のパッチ未適用の脆弱性: CVE-2026-84243	Nessus	Misc.	2026/10/31	2026/11/9	high
377093	AlmaLinux 9.6 [TuxCare] Security Update: compat-libpthread-nonshared / glibc / glibc-all-langpacks / etc (ALMALINUX9.6:CLSA-2026:1793969685)	Nessus	Alma Linux Local Security Checks	2026/11/6	2026/11/6	high
377100	Rocky Linux 9.6 [TuxCare] Security Update: compat-libpthread-nonshared / glibc / glibc-all-langpacks / etc (ALMALINUX9.6:CLSA-2026:1793969685)	Nessus	Rocky Linux Local Security Checks	2026/11/6	2026/11/6	high
377993	CentOS Linux 6 [TuxCare] Security Update: glibc / glibc-common / glibc-devel / glibc-headers / glibc-static / etc (CENTOS6:CLSA-2026:1793880080)	Nessus	CentOS Local Security Checks	2026/11/9	2026/11/9	high
378945	CentOS Linux 8 [TuxCare] Security Update: compat-libpthread-nonshared / glibc / glibc-all-langpacks / etc (CENTOS-STREAM8:CLSA-2026:1794401578)	Nessus	CentOS Local Security Checks	2026/11/11	2026/11/11	high
377001	CentOS Linux 8.5 [TuxCare] Security Update: compat-libpthread-nonshared / glibc / glibc-all-langpacks / etc (CENTOS8.5:CLSA-2026:1793958787)	Nessus	CentOS Local Security Checks	2026/11/6	2026/11/6	high
374413	Linux Distros Unpatched Vulnerability : CVE-2026-84243	Nessus	Misc.	2026/10/31	2026/11/9	high
381334	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : GNU C Library vulnerabilities (USN-9065-1)	Nessus	Ubuntu Local Security Checks	2026/11/14	2026/11/14	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high