Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - league/commonmark 之前 2.6.0 的版本在 Markdown 解析中包含多项式时间复杂度漏洞，允许攻击者造成拒绝服务。攻击者可提交精心构建的 Markdown 输入，以触发最坏情况的性能，并行发送多个请求会耗尽 CPU 资源和 PHP-FPM 进程。（CVE-2024-58382）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - league/commonmark 之前的 2.6.0 版本在 Markdown 剖析中包含多項式時間複雜度弱點，允許攻擊者造成拒絕服務。攻擊者可以提交精心設計的 Markdown 輸入，旨在觸發最壞情況的效能，並行發送多個請求會耗盡 CPU 資源和 PHP-FPM 進程。（CVE-2024-58382）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 2.6.0 より前の league/commonmark バージョンには、Markdown 解析に多項式時間複雑度の脆弱性があるため、攻撃者がサービス拒否を引き起こす可能性があります。攻撃者は、最悪のパフォーマンスを発生させるように設計された、注意深く細工された Markdown 入力を送信する可能性があり、複数のリクエストを並行して送信すると、CPU リソースと PHP-FPM プロセスが使い果たされます。(CVE-2024-58382)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7002464a52 advisory.

    ## Version 1.7.5

    - Installer: Add possibility to detsroy the installer session/cookie
    - Enigma: Fix db_sync() never restoring keyring files (#10343)
    - Markasjunk: Skip messages whose %s/%h values start with '-' (#10344)
    - Password: Replace SQL query placeholders in a single pass (#10345)
    - Fix exit code of the healthcheck.sh script (#10337)
    - Security: Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/viewsource     action
    - Security: Fix bug where an alias login wasn't qualified by IMAP host
    - Security: Add a size limit to the CSS proxy content processing
    - Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
    - Security: Fix remote content blocking bypass via SVG SMIL `by` attribute
    - Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
    - Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
    - Security: Fix mail header injection via the From display-name in the Bounce (resend) action
    - Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
    - Security: Fix object injection primitive in rcube_session::unserialize() via !-prefixed session keys
    - Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
    - Security: Fix CSS scoping bypass in HTML messages using at-rules
    - Security: Fix bug where deprecated action aliases bypassed `disabled_actions` setting
    - Security: Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action
    - Security: Fix CSRF validation bypass in the mark-as-junk action
    - Security: Fix XSS issue in handling of password driver error responses
    - Security: Fix mail header injection via subject of a message forwarded as attachment
    - Security: Fix mail header injection via media type in an inline image data URI
    - Security: Fix bug where Password Modoboa driver could change password for another account
    - Security: Fix unsafe use of a login name in SquirrelMail import file path




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2aba9ce8fc advisory.

    ## Version 1.7.5

    - Installer: Add possibility to detsroy the installer session/cookie
    - Enigma: Fix db_sync() never restoring keyring files (#10343)
    - Markasjunk: Skip messages whose %s/%h values start with '-' (#10344)
    - Password: Replace SQL query placeholders in a single pass (#10345)
    - Fix exit code of the healthcheck.sh script (#10337)
    - Security: Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/viewsource     action
    - Security: Fix bug where an alias login wasn't qualified by IMAP host
    - Security: Add a size limit to the CSS proxy content processing
    - Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
    - Security: Fix remote content blocking bypass via SVG SMIL `by` attribute
    - Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
    - Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
    - Security: Fix mail header injection via the From display-name in the Bounce (resend) action
    - Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
    - Security: Fix object injection primitive in rcube_session::unserialize() via !-prefixed session keys
    - Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
    - Security: Fix CSS scoping bypass in HTML messages using at-rules
    - Security: Fix bug where deprecated action aliases bypassed `disabled_actions` setting
    - Security: Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action
    - Security: Fix CSRF validation bypass in the mark-as-junk action
    - Security: Fix XSS issue in handling of password driver error responses
    - Security: Fix mail header injection via subject of a message forwarded as attachment
    - Security: Fix mail header injection via media type in an inline image data URI
    - Security: Fix bug where Password Modoboa driver could change password for another account
    - Security: Fix unsafe use of a login name in SquirrelMail import file path




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown     parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown     inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU     resources and PHP-FPM processes. (CVE-2024-58382)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名稱	產品	系列	已發布	已更新	嚴重性
345003	Linux Distros 未修补的漏洞：CVE-2024-58382	Nessus	Misc.	2026/9/12	2026/11/11	high
345003	Linux Distros 未修補弱點：CVE-2024-58382	Nessus	Misc.	2026/9/12	2026/11/11	high
345003	Linux Distros のパッチ未適用の脆弱性: CVE-2024-58382	Nessus	Misc.	2026/9/12	2026/11/11	high
376321	Fedora 45 : roundcubemail (2026-7002464a52)	Nessus	Fedora Local Security Checks	2026/11/5	2026/11/5	high
376336	Fedora 44 : roundcubemail (2026-2aba9ce8fc)	Nessus	Fedora Local Security Checks	2026/11/5	2026/11/5	high
345003	Linux Distros Unpatched Vulnerability : CVE-2024-58382	Nessus	Misc.	2026/9/12	2026/11/11	high

偵測

搜尋 Plugin

high

high

high

high

high

high