遠端 Oracle Linux 7 主機中安裝的套件受到 ELSA-2021-0348 公告中提及的多個弱點影響。

  - 如果 80 位長的雙精度函式輸入項中包含非正式位元模式，則  2.32 之前的 GNU C 程式庫 (即 glibc 或 libc6) 可在範圍縮小期間造成堆疊上緩衝區溢位，向 x86 目標上的 sinl 傳送 0x5d414141414141410000 值時即可看到。這與 sysdeps/ieee754/ldbl-96/e_rem_pio2l.c 有關。 (CVE-2020-10029)

  - 如果任何 printf 系列函式的輸入是包含非正式位元模式的 80 位元長雙精度數，x86 目標上 2.23 版之前 GNU C 程式庫 (亦即 glibc 或 libc6) 中的 sysdeps/i386/ldbl2mpn.c 會發生堆疊型緩衝區溢位，如將 \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 值傳送至 sprintf 時所見。注意：在 2016 年或之後 (即 2.23 或更新版本中)，此問題預設不會影響 glibc，這是因為在 2015 年已針對透過使用 GCC 內建函式內嵌 C99 math 函式進行了提交。換句話說，儘管在 26649 參照中提及對 glibc 2.33 的修正，但參照 2.23 是有意為之。
    (CVE-2020-29573)

  - 在 GNU C 程式庫 (亦即 glibc 或 libc6) 2.32 及之前所有版本中，iconv 功能在 EUC-KR 編碼中無效的多位元組輸入序列時，可能會發生緩衝區過度讀取。(CVE-2019-25013)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

遠端 CentOS Linux 8 主機上安裝的套件受到 CESA-2020: 4444 公告中所提及的多個弱點影響。

  - glibc：cosl、sinl、sincosl 和 tanl 函式的特製輸入中存在堆疊損毀問題 (CVE-2020-10029)

  - glibc：powerpc 的反向追蹤函式中存在陣列溢位問題 (CVE-2020-1751)

  - glibc：擴充 〜user 時，glob() 函式中會發生釋放後使用 (CVE-2020-1752)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

遠端 CentOS Linux 7 主機上安裝的套件受到 RHSA-2021:0348 公告中提及的多個弱點影響。

  - 在 GNU C 程式庫 (亦即 glibc 或 libc6) 2.32 及之前所有版本中，iconv 功能在 EUC-KR 編碼中無效的多位元組輸入序列時，可能會發生緩衝區過度讀取。(CVE-2019-25013)

  - 如果 80 位長的雙精度函式輸入項中包含非正式位元模式，則 2.32 之前的 GNU C 程式庫 (即 glibc 或 libc6) 可在範圍縮小期間造成堆疊上緩衝區溢位，向 x86 目標上的 sinl 傳送 0x5d414141414141410000 值時即可看到。這與 sysdeps/ieee754/ldbl-96/e_rem_pio2l.c 有關。(CVE-2020-10029)

  - 如果任何 printf 系列函式的輸入是包含非正式位元模式的 80 位元長雙精度數，x86 目標上 2.23 版之前 GNU C 程式庫 (亦即 glibc 或 libc6) 中的 sysdeps/i386/ldbl2mpn.c 會發生堆疊型緩衝區溢位，如將 \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 值傳送至 sprintf 時所見。注意：在 2016 年或之後 (即 2.23 或更新版本中)，此問題預設不會影響 glibc，這是因為在 2015 年已針對透過使用 GCC 內建函式內嵌 C99 math 函式進行了提交。換句話說，儘管在 26649 參照中提及對 glibc 2.33 的修正，但參照 2.23 是有意為之。
    (CVE-2020-29573)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

An update of the glibc package has been released.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has glibc packages installed that are affected by multiple vulnerabilities:

  - The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in     accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-     free vulnerabilities. (CVE-2014-4043)

  - In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has     Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep. (CVE-2018-20796)

  - On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the     LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition,     allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass     ASLR for a setuid program. (CVE-2019-19126)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range     reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when     passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to     sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. (CVE-2020-10029)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-     based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with     a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the mention of Fixed for glibc 2.33 in the 26649 reference.
    (CVE-2020-29573)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of glibc installed on the remote host is prior to 2.26-37. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1944 advisory.

    A vulnerability was discovered in glibc where the LD_PREFER_MAP_32BIT_EXEC environment variable is not     ignored when running binaries with the setuid flag on x86_64 architectures. This allows an attacker to     force system to utilize only half of the memory (making the system think the software is 32-bit only),     thus lowering the amount of memory being used with address space layout randomization (ASLR). The highest     threat is confidentiality although the complexity of attack is high. The affected application must already     have other vulnerabilities for this flaw to be usable. (CVE-2019-19126)

    A flaw was found in glibc in versions prior to 2.32. Pseudo-zero values are not validated causing a stack     corruption due to a stack-based overflow. The highest threat from this vulnerability is to system     availability. (CVE-2020-10029)

    A use-after-free vulnerability was found in glibc in the way the tilde expansion was carried out.
    Directory paths containing an initial tilde followed by a valid username were affected by this issue. A     local attacker could exploit this flaw by creating a specially crafted path that, when processed by the     glob function, would potentially lead to arbitrary code execution. (CVE-2020-1752)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2998 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions (CVE-2020-10029)

    * glibc: stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit     long double with a non-canonical bit pattern (CVE-2020-29573)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4444 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: array overflow in backtrace functions for powerpc (CVE-2020-1751)

    * glibc: use-after-free in glob() function when expanding ~user (CVE-2020-1752)

    * glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions (CVE-2020-10029)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4444 advisory.

    - CVE-2020-1751: Fix an array overflow in backtrace on PowerPC. (#1813399)
    - CVE-2020-10029: Prevent stack corruption from crafted input in cosl, sinl,       sincosl, and tanl function. (#1811796)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the glibc packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - The GNU C Library (aka glibc or libc6) before 2.32     could overflow an on-stack buffer during range     reduction if an input to an 80-bit long double function     contains a non-canonical bit pattern, a seen when     passing a 0x5d414141414141410000 value to sinl on x86     targets. This is related to     sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.(CVE-2020-10029)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202006-04 (glibc: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in glibc. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The glibc package contains standard libraries which are     used by multiple programs on the system. In order to     save disk space and memory, as well as to make     upgrading easier, common system code is kept in one     place and shared between programs. This particular     package contains the most important sets of shared     libraries: the standard C library and the standard math     library. Without these two libraries, a Linux system     will not function.Security Fix(es):Stack-based buffer     overflow in the getaddrinfo function in     sysdeps/posix/getaddrinfo.c in the GNU C Library (aka     glibc or libc6) allows remote attackers to cause a     denial of service (crash) via vectors involving hostent     conversion. NOTE: this vulnerability exists because of     an incomplete fix for CVE-2013-4458.(CVE-2016-3706)In     the GNU C Library (aka glibc or libc6) through 2.29,     check_dst_limits_calc_pos_1 in posix/regexec.c has     Uncontrolled Recursion, as demonstrated by     '(|)(\\1\\1)*' in grep, a different issue than     CVE-2018-20796. NOTE: the software maintainer disputes     that this is a vulnerability because the behavior     occurs only with a crafted pattern.(CVE-2019-9192)In     the GNU C Library (aka glibc or libc6) through 2.29,     check_dst_limits_calc_pos_1 in posix/regexec.c has     Uncontrolled Recursion, as demonstrated by     '(\227|)(\\1\\1|t1|\\\2537)+' in     grep.(CVE-2018-20796)GNU Libc current is affected by:
    Re-mapping current loaded library with malicious ELF     file. The impact is: In worst case attacker may     evaluate privileges. The component is: libld. The     attack vector is: Attacker sends 2 ELF files to victim     and asks to run ldd on it. ldd execute     code.(CVE-2019-1010023)A use-after-free vulnerability     introduced in glibc upstream version 2.14 was found in     the way the tilde expansion was carried out. Directory     paths containing an initial tilde followed by a valid     username were affected by this issue. A local attacker     could exploit this flaw by creating a specially crafted     path that, when processed by the glob function, would     potentially lead to arbitrary code execution. This was     fixed in version 2.32.(CVE-2020-1752)The GNU C Library     (aka glibc or libc6) before 2.32 could overflow an     on-stack buffer during range reduction if an input to     an 80-bit long double function contains a non-canonical     bit pattern, a seen when passing a     0x5d414141414141410000 value to sinl on x86 targets.
    This is related to     sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.(CVE-2020-10029)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The GNU C Library (aka glibc or libc6) before 2.32     could overflow an on-stack buffer during range     reduction if an input to an 80-bit long double function     contains a non-canonical bit pattern, a seen when     passing a 0x5d414141414141410000 value to sinl on x86     targets. This is related to     sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.(CVE-2020-10029)

  - A use-after-free vulnerability introduced in glibc     upstream version 2.14 was found in the way the tilde     expansion was carried out. Directory paths containing     an initial tilde followed by a valid username were     affected by this issue. A local attacker could exploit     this flaw by creating a specially crafted path that,     when processed by the glob function, would potentially     lead to arbitrary code execution. This was fixed in     version 2.32.(CVE-2020-1752)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0348 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: buffer over-read in iconv when processing invalid multi-byte input sequences in the EUC-KR     encoding (CVE-2019-25013)

    * glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions (CVE-2020-10029)

    * glibc: stack-based buffer overflow if the input to any of the printf family of functions is an 80-bit     long double with a non-canonical bit pattern (CVE-2020-29573)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * glibc: 64bit_strstr_via_64bit_strstr_sse2_unaligned detection fails with large device and inode numbers     (BZ#1883162)

    * glibc: Performance regression in ebizzy benchmark (BZ#1889977)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-0348 advisory.

    - CVE-2020-10029: Prevent stack corruption from crafted input in cosl, sinl,       sincosl, and tanl function. (#1812119)
    - CVE-2020-29573: Harden printf family of functions (#1869380)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4444 advisory.

  - glibc: stack corruption from crafted input in cosl, sinl, sincosl, and tanl functions (CVE-2020-10029)

  - glibc: array overflow in backtrace functions for powerpc (CVE-2020-1751)

  - glibc: use-after-free in glob() function when expanding ~user (CVE-2020-1752)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0348 advisory.

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range     reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when     passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to     sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. (CVE-2020-10029)

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-     based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with     a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the mention of Fixed for glibc 2.33 in the 26649 reference.
    (CVE-2020-29573)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	名稱	產品	系列	已發布	已更新	嚴重性
146101	Oracle Linux 7：glibc (ELSA-2021-0348)	Nessus	Oracle Linux Local Security Checks	2021/2/4	2024/11/1	high
145977	CentOS 8：glibc (CESA-2020: 4444)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/24	high
146097	CentOS 7：glibc (RHSA-2021:0348)	Nessus	CentOS Local Security Checks	2021/2/3	2024/10/9	high
202790	Photon OS 3.0: Glibc PHSA-2020-3.0-0093	Nessus	PhotonOS Local Security Checks	2024/7/22	2024/7/24	medium
154607	NewStart CGSL CORE 5.04 / MAIN 5.04 : glibc Multiple Vulnerabilities (NS-SA-2021-0095)	Nessus	NewStart CGSL Local Security Checks	2021/10/28	2022/5/9	low
171823	Amazon Linux 2 : glibc (ALAS-2023-1944)	Nessus	Amazon Linux Local Security Checks	2023/2/23	2024/12/11	high
152350	RHEL 7 : glibc (RHSA-2021:2998)	Nessus	Red Hat Local Security Checks	2021/8/9	2024/11/7	high
142396	RHEL 8 : glibc (RHSA-2020:4444)	Nessus	Red Hat Local Security Checks	2020/11/4	2025/3/6	high
142780	Oracle Linux 8 : glibc (ELSA-2020-4444)	Nessus	Oracle Linux Local Security Checks	2020/11/12	2024/11/1	high
135156	EulerOS Virtualization for ARM 64 3.0.6.0 : glibc (EulerOS-SA-2020-1369)	Nessus	Huawei Local Security Checks	2020/4/2	2024/3/19	medium
137441	GLSA-202006-04 : glibc: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/6/17	2024/3/7	critical
137509	EulerOS 2.0 SP2 : glibc (EulerOS-SA-2020-1667)	Nessus	Huawei Local Security Checks	2020/6/17	2024/3/6	high
137931	EulerOS Virtualization 3.0.6.0 : glibc (EulerOS-SA-2020-1712)	Nessus	Huawei Local Security Checks	2020/7/1	2024/3/5	high
146081	RHEL 7 : glibc (RHSA-2021:0348)	Nessus	Red Hat Local Security Checks	2021/2/3	2024/11/7	high
146101	Oracle Linux 7 : glibc (ELSA-2021-0348)	Nessus	Oracle Linux Local Security Checks	2021/2/4	2024/11/1	high
145977	CentOS 8 : glibc (CESA-2020:4444)	Nessus	CentOS Local Security Checks	2021/2/1	2024/1/24	high
146097	CentOS 7 : glibc (RHSA-2021:0348)	Nessus	CentOS Local Security Checks	2021/2/3	2024/10/9	high
502979	Siemens SIMATIC S7-1500 TM MFP BIOS Out-of-bounds Write (CVE-2020-10029)	Tenable OT Security	Tenable.ot	2025/2/25	2025/3/10	medium

偵測

搜尋 Plugin

high

high

high

medium

low

high

high

high

high

medium

critical

high

high

high

high

high

high

medium