The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:7500 advisory.

    * perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-     ASCII bytes (CVE-2024-56406)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-11fcc87c66 advisory.

    Fix CVE-2024-56406




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2025 CPU advisory.

  - Vulnerability in the Oracle Database component of Oracle Database Server.  Supported versions that     are affected are 19.3-19.27 and  23.4-23.8. Easily exploitable vulnerability allows low privileged     attacker having Create Session, Create Procedure privilege with network access via Oracle Net to     compromise Oracle Database.  Successful attacks of this vulnerability can result in takeover of Oracle     Database. (CVE-2025-30751)

  - Vulnerability in the Java VM component of Oracle Database Server.  Supported versions that are affected     are 19.3-19.27 and  21.3-21.18. Easily exploitable vulnerability allows low privileged attacker having     Create Session, Create Procedure privilege with network access via Oracle Net to compromise Java VM.
    While the vulnerability is in Java VM, attacks may significantly impact additional products (scope change).
    Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete     access to all Java VM accessible data. (CVE-2025-50069)

  - Vulnerability in the Oracle Text (FreeType) component of Oracle Database Server.  Supported versions     that are affected are 19.3-19.27, 21.3-21.18 and  23.4-23.8. Difficult to exploit vulnerability allows     low privileged attacker having Create Session, Create Index privilege with network access via Oracle Net     to compromise Oracle Text (FreeType).  Successful attacks of this vulnerability can result in takeover     of Oracle Text (FreeType). (CVE-2025-27363)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40     are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes     in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.
    $ perl -e '$_ = '\x{FF}' x 1000000; tr/\xFF/\x{100}/;'    Segmentation fault (core dumped) It is believed     that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that     lack sufficient defenses.(CVE-2024-56406)

    Perl threads have a working directory race condition where file operations may target unintended paths.If     a directory handle is open at thread creation, the process-wide current working directory is temporarily     changed in order to clonethat handle for the new thread, which is visible from any third (ormore)     thread already running.This may lead to unintended operationssuch as loading code or accessing files     from unexpected locations,which a local attacker may be able to exploit.The bug was introduced in     commit11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6(CVE-2025-40909)

    Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a     repeated fixed string on 32-bit builds.Perl_study_chunk in regcomp_study.c checked the size of the joined     substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum     count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the     subsequent copy writes past the end of the buffer.A caller that compiles an attacker-controlled regular     expression on a 32-bit perl build triggers a heap buffer overflow at compile time.(CVE-2026-8376)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization perl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40     are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes     in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.
    $ perl -e '$_ = '\x{FF}' x 1000000; tr/\xFF/\x{100}/;'    Segmentation fault (core dumped) It is believed     that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that     lack sufficient defenses.(CVE-2024-56406)

Tenable has extracted the preceding description block directly from the EulerOS perl security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0388 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-56406:
    A heap buffer overflow vulnerability was discovered in Perl.

    Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1     through 5.41.10.

    When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can     overflow the destination pointer `d`.

     $ perl -e '$_ = \x{FF} x 1000000; tr/\xFF/\x{100}/;'      Segmentation fault (core dumped)

    It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on     platforms that lack sufficient defenses.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5902 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5902-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     April 13, 2025                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : perl     CVE ID         : CVE-2024-56406

    Nathan Mills discovered a heap-based buffer overflow vulnerability in     the implementation of the Perl programming language when transliterating     non-ASCII bytes with tr///, which may result in denial of service, or     potentially the execution of arbitrary code.

    For the stable distribution (bookworm), this problem has been fixed in     version 5.36.0-7+deb12u2.

    We recommend that you upgrade your perl packages.

    For the detailed security status of perl please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/perl

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the perl package has been released.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7500 advisory.

    [4:5.40.2-512.1]
    - 5.40.2 bump (see <https://metacpan.org/release/SHAY/perl-5.40.2/view/pod/perldelta.pod>)
    - Resolves: RHEL-87186

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has perl packages installed that are affected by a vulnerability:

  - A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40     are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes     in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.
    $ perl -e '$_ = \x{FF} x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped) It is believed     that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that     lack sufficient defenses. (CVE-2024-56406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
266650	RockyLinux 10 : perl (RLSA-2025:7500)	Nessus	Rocky Linux Local Security Checks	2025/10/6	2025/10/6	high
234709	Fedora 41 : perl / perl-Devel-Cover / perl-PAR-Packer (2025-11fcc87c66)	Nessus	Fedora Local Security Checks	2025/4/22	2025/6/26	high
242296	Oracle Database Server (July 2025 CPU)	Nessus	Databases	2025/7/18	2026/1/21	critical
348028	EulerOS Virtualization 2.11.0 : perl (EulerOS-SA-2026-3537)	Nessus	Huawei Local Security Checks	2026/9/18	2026/9/18	critical
238400	EulerOS 2.0 SP11 : perl (EulerOS-SA-2025-1673)	Nessus	Huawei Local Security Checks	2025/6/12	2025/6/12	high
239936	TencentOS Server 4: perl (TSSA-2025:0388)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
234241	Debian dsa-5902 : libperl-dev - security update	Nessus	Debian Local Security Checks	2025/4/13	2025/4/13	critical
235141	Photon OS 5.0: Perl PHSA-2025-5.0-0514	Nessus	PhotonOS Local Security Checks	2025/5/5	2026/10/14	high
334109	Photon OS 5.0: Perl PHSA-2025-5.0-91-0514	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/11/2	high
348035	EulerOS Virtualization 2.11.1 : perl (EulerOS-SA-2026-3450)	Nessus	Huawei Local Security Checks	2026/9/18	2026/9/18	critical
242466	EulerOS 2.0 SP12 : perl (EulerOS-SA-2025-1835)	Nessus	Huawei Local Security Checks	2025/7/21	2025/7/21	high
238378	EulerOS 2.0 SP11 : perl (EulerOS-SA-2025-1674)	Nessus	Huawei Local Security Checks	2025/6/12	2025/6/12	high
240858	Oracle Linux 10 : perl (ELSA-2025-7500)	Nessus	Oracle Linux Local Security Checks	2025/6/27	2025/6/27	high
240993	EulerOS 2.0 SP13 : perl (EulerOS-SA-2025-1695)	Nessus	Huawei Local Security Checks	2025/6/30	2025/6/30	high
271288	NewStart CGSL MAIN 7.02 : perl Vulnerability (NS-SA-2025-0251)	Nessus	NewStart CGSL Local Security Checks	2025/10/24	2025/10/24	high

偵測

搜尋 Plugin

high

high

critical

critical

high

high

critical

high

high

critical

high

high

high

high

high