Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 在 FFmpeg 4.4.6中發現一個弱點，直到 /5.1.8/6.1.4/7.1.3/8.0.1。受此問題影響的是元件 Convolution Filter 的 libavfilter/vf_convolution.c 檔案的函式setup_3x3。這類操作會導致越界讀取。攻擊者可從遠端執行此攻擊。攻擊程式已向公眾披露且可能會遭到利用。升級至版本 4.4.7、 5.1.9、 6.1.57.1.4、 8.0.2、 可以9.08.1.1解決此問題。修補程式的名稱是 8970658472/e24b9820b4。建議升級受影響的元件。（CVE-2026-90815）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 FFmpeg /8.0.17.1.36.1.45.1.8 及之前版本4.4.6中发现一个漏洞。Convolution Filter 组件的 libavfilter/vf_convolution.c 文件的函数setup_3x3受到此问题的影响。这种操控会导致越界读取。攻击者可远程利用该漏洞发动攻击。该漏洞已被公开并可被使用。升级到版本 4.4.7、 5.1.9、 6.1.5、 7.1.4和 8.0.2可以 8.1.19.0 解决此问题。修补程序的名称为 8970658472/e24b9820b4。建议升级受影响的组件。（CVE-2026-90815）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1 までの FFmpeg で脆弱性が見つかっています。この問題の影響を受けるのは、コンポーネント Convolution Filter の libavfilter/vf_convolution.c ファイルの関数setup_3x3です。このような操作により、領域外読み取りが発生します。攻撃はリモートで実行できます。このエクスプロイトは一般に公開されており、使用される可能性があります。この問題は、バージョン 4.4.7、 5.1.9、 6.1.5、 7.1.4、 8.0.2、 8.1.1 、 9.0 にアップグレードすることで解決できます。パッチの名前は 8970658472/e24b9820b4 です。影響を受けるコンポーネントをアップグレードすることをお勧めします。(CVE-2026-90815)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150456 advisory.

    A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is     the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such     manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been     disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and     9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the     affected component.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5220-1 advisory.

    - CVE-2023-6602: HLS Force TTY Demuxer (bsc#1220546).
    - CVE-2023-6604: HLS XBIN Demuxer DoS Amplification (bsc#1220549).
    - CVE-2024-35367: FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static     const vec_s8       h_subpel_filters_outer (bsc#1234029).
    - CVE-2026-18393: Heap buffer overflow in tdsc_load_cursor() via CUR_FMT_MONO cursor (bsc#1277377).
    - CVE-2026-38344: A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of     FFmpeg       N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video     file       (bsc#1277309).
    - CVE-2026-38345: FFmpeg: Denial of Service via division-by-zero vulnerability in     `ff_sws_init_single_context` function       (bsc#1277376).
    - CVE-2026-38346: FFmpeg: Denial of Service via crafted video file due to integer overflow (bsc#1277375).
    - CVE-2026-38347: FFmpeg: Heap overflow vulnerability leads to Denial of Service (bsc#1277373).
    - CVE-2026-38348: FFmpeg: Denial of Service via crafted image file due to integer overflow (bsc#1277368).
    - CVE-2026-38349: FFmpeg: Denial of Service via crafted image file due to integer overflow (bsc#1277369).
    - CVE-2026-38350: FFmpeg: Integer overflow leads to Denial of Service (bsc#1277370).
    - CVE-2026-52296: out-of-bounds read due to missing required padding in WMA extradata allocation paths     (bsc#1280752).
    - CVE-2026-65705: vf_floodfill Out-of-Bounds Write via filter_frame() (bsc#1272761).
    - CVE-2026-66036: Heap Out-of-Bounds Write in vf_hqdn3d Filter (bsc#1272763).
    - CVE-2026-70628: signed integer underflows during subtitle buffer checks can cause heap buffer overflows     (bsc#1274268).
    - CVE-2026-70629: unvalidated decompressed frame sizes in video decoders can cause uninitialized heap     memory reads       (bsc#1274270).
    - CVE-2026-70630: unvalidated decompression sizes in Screenpresso frame decoding can cause uninitialized     heap memory       reads (bsc#1274282).
    - CVE-2026-70631: unvalidated decompression sizes in TIFF strip decoding can cause uninitialized heap     memory reads       (bsc#1274287).
    - CVE-2026-70632: unenforced frame dimensions in CineForm HD decoding can cause heap-based out-of-bounds     writes       (bsc#1274289).
    - CVE-2026-75141: heap buffer overflow in the hvcC box writer (bsc#1276407).
    - CVE-2026-75142: stack buffer overflow in the MPEG-PS muxer (bsc#1276408).
    - CVE-2026-75144: heap buffer overflow in the VC-2/Dirac RTP packetizer (bsc#1276410).
    - CVE-2026-75146: out-of-bounds read in the DASH demuxer (bsc#1276412).
    - CVE-2026-90815: out-of-bounds read in the convolution video filter when processing videos with     dimensions smaller than       the convolution kernel size (bsc#1280754).
    - CVE-2026-90816: CPU exhaustion due to missing validations in the `parse_playlist()` function when     processing a crafted       HLS playlist (bsc#1280755).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is     the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such     manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been     disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and     9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the     affected component. (CVE-2026-90815)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
346340	Linux Distros 未修補弱點：CVE-2026-90815	Nessus	Misc.	2026/9/16	2026/11/12	medium
346340	Linux Distros 未修补的漏洞：CVE-2026-90815	Nessus	Misc.	2026/9/16	2026/11/12	medium
346340	Linux Distros のパッチ未適用の脆弱性: CVE-2026-90815	Nessus	Misc.	2026/9/16	2026/11/12	medium
376622	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-150456)	Nessus	Unity Linux Local Security Checks	2026/11/5	2026/11/6	medium
380997	SUSE SLED15: ffmpeg / libavcodec-devel / libavcodec57 / libavdevice57 / etc (SUSE-SU-2026:5220-1)	Nessus	SuSE Local Security Checks	2026/11/14	2026/11/14	high
346340	Linux Distros Unpatched Vulnerability : CVE-2026-90815	Nessus	Misc.	2026/9/16	2026/11/12	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

high

medium