The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libdwarf: heap-based buffer over-read in dwarf_formsdata() (CVE-2017-9055)

  - Use-after-free vulnerability in dwarfdump in libdwarf 20130126 through 20140805 might allow remote     attackers to cause a denial of service (program crash) via a crafted ELF file. (CVE-2014-9482)

  - dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV). (CVE-2015-8538)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Christian Rebischke reports :

libdwarf is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service.

Christian Rebischkeによる報告: 

libdwarfは、任意のコードの実行、情報漏洩、サービス拒否といった複数の問題に対して脆弱です。

ID	名稱	產品	系列	已發布	已更新	嚴重性
198610	RHEL 7 : libdwarf (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	critical
96368	FreeBSD : libdwarf -- multiple vulnerabilities (83041ca7-d690-11e6-9171-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	2017/1/10	2021/1/4	critical
96368	FreeBSD : libdwarf -- 複数の脆弱性（83041ca7-d690-11e6-9171-14dae9d210b8）	Nessus	FreeBSD Local Security Checks	2017/1/10	2021/1/4	critical

偵測

搜尋 Plugin

critical

critical

critical