Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - MIME：：Words 之前 5.521 的 Perl 版本允許透過 decode_mimewords 中重複的 =？ 序列耗盡記憶體。對於每個 =？這不會啟動完整編碼字，decode_mimewords會將包含整個輸入字串的錯誤訊息附加到 $@。8,000 的邊界 =？pairs （16,000 位元組） 將自己的 8,000 個副本添加到 $@ 中，約為 128 MB。從版本 5.518MIME：:P arser 以這種方式解碼每個多部分邊界，因此遠端發送者可以使用一個 Content-Type 標頭耗盡剖析過程的記憶體。（CVE-2026-116270）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Perl 之前 5.521 的 MIME：：Words 版本允许通过 decode_mimewords 中重复的 =？ 序列耗尽内存。对于每个 =？不会启动完整编码字，decode_mimewords会将包含整个输入字符串的错误消息附加到 $@。8,000 的边界 =？pairs（16,000 字节）将自己的 8,000 个副本添加到 $@，约 128 MB。从版本 5.518开始，MIME：:P arser 以此方式解码每个多部分边界，因此远程发送者可使用一个 Content-Type 标头耗尽解析进程的内存。（CVE-2026-116270）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

リモートホストにインストールされている FreeBSD のバージョンは、テスト済みバージョンより前です。したがって、2b2d5d3e-d2c8-11f1-97dc-40b034429ecf のアドバイザリに記載されている複数の脆弱性の影響を受けます。

    MIME-tools プロジェクトによる報告:
    多数のセキュリティ問題が対処されました(次の 10 の CVE を参照)CPANSec セキュリティグループにより、問題が私の注意を喚起され、パッチが提供されました。

Tenable は、前述の記述ブロックを FreeBSD セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Perl に対する 5.521 より前の MIME::Words バージョンは、decode_mimewords で繰り返される =? シーケンスを介してメモリを枯渇させる可能性があります。それぞれ =?これは、完全にエンコードされた単語から始めdecode_mimewords、入力文字列全体を含むエラーメッセージを $@ に追加します。8,000の境界=?ペア (16,000 バイト) は、それ自体の 8,000 コピーを $@ (約 128 MB) に追加します。バージョン 5.518 から、MIME::P arser はこの方法ですべてのマルチパート境界をデコードするため、リモートの送信者が、1 つの Content-Type ヘッダーで解析プロセスのメモリを使い果たすことが可能です。(CVE-2026-116270)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-51fdfb7476 advisory.

    This is a cumulative bug-fix update, including multiple security fixes.

    Note that there is a change to some defaults: `max_parts` is now set to 1000 and `max_depth` to 64 rather     than being unlimited; this should not affect most real-world uses of `MIME::tools`, but you may need to     increase these values or set them to -1 (unlimited) if you run into trouble.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0e79d6ad13 advisory.

    This is a cumulative bug-fix update, including multiple security fixes.

    Note that there is a change to some defaults: `max_parts` is now set to 1000 and `max_depth` to 64 rather     than being unlimited; this should not affect most real-world uses of `MIME::tools`, but you may need to     increase these values or set them to -1 (unlimited) if you run into trouble.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a415b3bf48 advisory.

    This is a cumulative bug-fix update, including multiple security fixes.

    Note that there is a change to some defaults: `max_parts` is now set to 1000 and `max_depth` to 64 rather     than being unlimited; this should not affect most real-world uses of `MIME::tools`, but you may need to     increase these values or set them to -1 (unlimited) if you run into trouble.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2b2d5d3e-d2c8-11f1-97dc-40b034429ecf advisory.

    MIME-tools project reports:
    Many security issues were addressed (see the following ten CVEs)               Issues were brought to my attention, and patches supplied, by the               CPANSec security group.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated =? sequences in     decode_mimewords. For each =? that does not start a complete encoded word, decode_mimewords appends an     error message containing the whole input string to $@. A boundary of 8,000 =? pairs (16,000 bytes) adds     8,000 copies of itself to $@, about 128 MB. From version 5.518, MIME::Parser decodes every multipart     boundary this way, so a remote sender can exhaust the memory of the parsing process with one Content-Type     header. (CVE-2026-116270)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22226-1 advisory.

    Changes in perl-MIME-tools:

    - updated to 5.522.0 (5.522)
      * 5.522
            * VERSION 5.522 RELEASED
            * Many security issues were addressed (see the following ten CVEs)               Issues were brought to my attention, and patches supplied, by the               CPANSec security group.
            * parse_params: flag a parameter list that could not be parsed               Detect additional ambiguous parse situations when parameter               names contain illegal characters.  Fixes:
              CVE-2026-116264 invalid parameter hides boundary/filename. bsc#1288723
            * parse_params: check the boundary after RFC 2231 reassembly               Another ambiguous-parse case was missed (trailing space after               boundary was not detected for RFC-2231-encoded boundaries.)  Fixes:
              CVE-2026-116265 RFC 2231 boundary skips ambiguity checks. bsc#1288722
            * parse_params: Stricter checking for encoded boundaries; earlier               versions would miss some cases.  Fixes:
              CVE-2026-116266 boundary changed by decoding not flagged. bsc#1288721
            * Cap the indentation levels in the Results: structure.  Otherwise,               specially-crafted messages could consume large amounts of memory.
              Fixes: CVE-2026-116267 indent stored per message per level bsc#1288720
            * parse_params: stop a comment match at the next parenthesis.
              Otherwise, specially-crafted messages could cause the regex               back-tracker to consume large amounts of CPU time.  Note that               MIME::Parser does not correctly parse ((nested comments)) and               has never done so.  Fixes:
              CVE-2026-116268 unclosed ( comments backtrack CPU exhaustion. bsc#1288719
            * parse_params: re-encode filename* values without charset tricks               Specially-crafted messages could trick recommended_filename()               into returning an empty string instead of a plausible filename.
              Fixes: CVE-2026-116269 RFC 2231 language tag empties filename. bsc#1288718
            * decode_mimewords: do not copy the input into each error.  Otherwise,               specially-crafted messages could consume large amounts of memory.
              Fixes: CVE-2026-116270 each bad =? copies the input into $@. bsc#1288717
            * FileUnder: do not reuse an existing generated directory.  Otherwise,               attackers might be able to use symbolic links to get files created               in unexpected locations.  Fixes:
              CVE-2026-116271 FileUnder reuses a pre-created directory. bsc#1288716
            * parse_params: flag comments other readers do not skip               Specially-crafted messages could create ambiguous messages without               setting the ambiguous_parse flag.  Fixes:
              CVE-2026-116272  comment hides a duplicate boundary. bsc#1288715
            * Call whine() rather than error() if max_parts or max_depth is               exceeded during a parse.  This lets us return undef rather than               throwing an exception if ignore_errors() is set to 0.
            * Change to defaults: max_parts is now set to 1000 and max_depth               to 64 rather than being unlimited.  This should not affect most               real-world uses of MIME::tools, but you may need to increase               these values or set them to -1 (unlimited) if you run into trouble.
                  ***** NOTE INCOMPATIBILITY *****               Fixes: CVE-2026-116273 max_parts and max_depth unlimited. bsc#1288714
            * Do not signal an ambiguous parse if we have filename= or               name=
            * Update author names in META.yml
            * Add git repo to META.yml
      * 5.520
            * VERSION 5.520 RELEASED
            * MIME::Parser used O(N^2) CPU time and memory parsing a MIME               message nested N levels deep.  A smallish specially-crafted               message could DOS the computer by making it consume enormous               amounts of memory and CPU time.  The parser was modified to use               O(N) time and memory in this case.  Additionally, a new               MIME::Parser::max_depth() function was added to limit the nesting               depth before declaring a parse failure.  Problem was reported to               me by Zhaoyang Li and Xiang Li from AOSP Lab at Nankai University.
            * MIME::Parser would ignore multiple blank lines in a message               preamble when parsing it; this could break DKIM.  Problem pointed               out and fix suggested by Tim Henderson.
            * If a MIME boundary includes trailing whitespace, we mark the               parse as ambiguous.  Problem noted and patch submitted by               Christian Herdtweck
      * 5.519
            * VERSION 5.519 RELEASED
            * Some (buggy) software creates base64-encoded parts as a               concatenation of multiple base64-encoded streams, and some client               software decodes each stream separately and concatenates the               results.  Duplicate this behavior in MIME::tools to prevent it               from being used as a mechanism to sneak dangerous content past a               security scanner.  Patch courtesy of Giorgio Premi               <giosh94mhz@gmail.com>.

    - updated to 5.518.0 (5.518)
      * 5.518
            * VERSION 5.518 RELEASED
            * Add tests for encoded boundary=XXX parameters and set               the ambiguous-parse flag if any are found.  Patch courtesy               of Dominik Csapak <d.csapak@proxmox.com>               MIME::tools chooses to decode encoded boundary parameters.
              MUA behaviors differ; Claws-Mail decodes them while Thunderbird               does not.
            * Don't ignore invalid whitespace after boundary=XXX parameter.
              Patch courtesy of Dominik Csapak <d.csapak@proxmox.com>
            * Ignore comments between tokens.  A header parameter can be               written foo(comment)=bar and it's the same as foo=bar.
              Patch courtesy of Dominik Csapak <d.csapak@proxmox.com>

    - updated to 5.517.0 (5.517)
      * 5.517
            * VERSION 5.517 RELEASED
            * Add a missing test message file that was causing tests to fail.
      * 5.516
            * VERSION 5.516 RELEASED
            * Handle MIME parameters of the form param= better (ie,               a parameter with no value at all.)  It's treated the               same as param= rather than aborting the parse.
            * Diagnose additional types of malformed MIME as ambiguous.
              Specifically, an empty boundary parameters like boundary= or               boundary= is treated as ambiguous.  Thanks to Stoiko Ivanov               <s.ivanov@proxmox.com> for pointing out this missing case.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
372864	Linux Distros 未修補弱點：CVE-2026-116270	Nessus	Misc.	2026/10/28	2026/11/5	high
372864	Linux Distros 未修补的漏洞：CVE-2026-116270	Nessus	Misc.	2026/10/28	2026/11/5	high
373481	FreeBSD:p5-MIME-Tools -- 複数の脆弱性(2b2d5d3e-d2c8-11f1-97dc-40b034429ecf)	Nessus	FreeBSD Local Security Checks	2026/10/29	2026/11/6	high
372864	Linux Distros のパッチ未適用の脆弱性: CVE-2026-116270	Nessus	Misc.	2026/10/28	2026/11/5	high
376845	Fedora 45 : perl-MIME-tools (2026-51fdfb7476)	Nessus	Fedora Local Security Checks	2026/11/6	2026/11/6	high
376833	Fedora 44 : perl-MIME-tools (2026-0e79d6ad13)	Nessus	Fedora Local Security Checks	2026/11/6	2026/11/6	high
376854	Fedora 43 : perl-MIME-tools (2026-a415b3bf48)	Nessus	Fedora Local Security Checks	2026/11/6	2026/11/6	high
373481	FreeBSD : p5-MIME-Tools -- multiple vulnerabilities (2b2d5d3e-d2c8-11f1-97dc-40b034429ecf)	Nessus	FreeBSD Local Security Checks	2026/10/29	2026/11/6	high
372864	Linux Distros Unpatched Vulnerability : CVE-2026-116270	Nessus	Misc.	2026/10/28	2026/11/5	high
376246	openSUSE 16 Security Update : perl-MIME-tools (openSUSE-SU-2026:22226-1)	Nessus	SuSE Local Security Checks	2026/11/5	2026/11/5	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high