Newest Nessus Plugins from Tenable https://www.tenable.com/plugins/feeds?sort=newest&type=nessus Get the latest plugin updates from Tenable Tue, 17 Mar 2026 09:37:47 GMT https://validator.w3.org/feed/docs/rss2.html Tenable Plugins Newest Nessus Plugins from Tenable https://www.tenable.com/themes/custom/tenable/img/favicons/apple-touch-icon.png https://www.tenable.com/plugins/feeds?sort=newest&type=nessus Copyright 2026 Tenable, Inc. All rights reserved. <![CDATA[EulerOS Virtualization 2.12.1 : ncurses (EulerOS-SA-2026-1445)]]> https://www.tenable.com/plugins/nessus/302741 https://www.tenable.com/plugins/nessus/302741 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302741 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the ncurses packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.(CVE-2025-6141)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization ncurses security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected ncurses packages.

Read more at https://www.tenable.com/plugins/nessus/302741

]]> <![CDATA[EulerOS Virtualization 2.12.0 : rsync (EulerOS-SA-2026-1517)]]> https://www.tenable.com/plugins/nessus/302740 https://www.tenable.com/plugins/nessus/302740 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302740 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the rsync package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The

 malicious

 rsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization rsync security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected rsync packages.

Read more at https://www.tenable.com/plugins/nessus/302740

]]> <![CDATA[EulerOS Virtualization 2.12.0 : binutils (EulerOS-SA-2026-1475)]]> https://www.tenable.com/plugins/nessus/302739 https://www.tenable.com/plugins/nessus/302739 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302739 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is named 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944. It is recommended to apply a patch to fix this issue.(CVE-2025-7545)

 A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.45 is able to address this issue. It is recommended to upgrade the affected component.(CVE-2025-5244)

 A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. It is recommended to apply a patch to fix this issue.(CVE-2025-3198)

 A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of the component objdump. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.(CVE-2025-5245)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization binutils security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected binutils packages.

Read more at https://www.tenable.com/plugins/nessus/302739

]]> <![CDATA[EulerOS Virtualization 2.12.1 : shim (EulerOS-SA-2026-1462)]]> https://www.tenable.com/plugins/nessus/302738 https://www.tenable.com/plugins/nessus/302738 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302738 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the shim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption.
 The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.(CVE-2022-4304)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization shim security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected shim packages.

Read more at https://www.tenable.com/plugins/nessus/302738

]]> <![CDATA[EulerOS Virtualization 2.12.0 : gdb (EulerOS-SA-2026-1481)]]> https://www.tenable.com/plugins/nessus/302737 https://www.tenable.com/plugins/nessus/302737 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302737 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the gdb packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c.(CVE-2021-32256)

 A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow.
 The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with '[f]ixed for 2.46'.(CVE-2025-11082)

 A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
 The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.(CVE-2025-11412)

 A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue.(CVE-2025-11494)

 A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be exploited. This patch is called 16357. It is best practice to apply a patch to resolve this issue.(CVE-2025-11840)

 A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
 The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with '[f]ixed for 2.46'.(CVE-2025-11083)

 GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.(CVE-2022-48064)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization gdb security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected gdb packages.

Read more at https://www.tenable.com/plugins/nessus/302737

]]> <![CDATA[EulerOS Virtualization 2.12.1 : sssd (EulerOS-SA-2026-1464)]]> https://www.tenable.com/plugins/nessus/302736 https://www.tenable.com/plugins/nessus/302736 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302736 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the sssd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.(CVE-2025-11561)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization sssd security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected sssd packages.

Read more at https://www.tenable.com/plugins/nessus/302736

]]> <![CDATA[EulerOS Virtualization 2.12.1 : httpd (EulerOS-SA-2026-1430)]]> https://www.tenable.com/plugins/nessus/302735 https://www.tenable.com/plugins/nessus/302735 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302735 with Critical Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd='...' directives.This issue affects Apache HTTP Server before 2.4.66.Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-58098)

 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.Users are recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

 mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-66200)

 HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.
 This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue. Users are recommended to upgrade to version 2.4.64, which fixes this issue.(CVE-2024-42516)

 In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.Only configurations using 'SSLEngine optional' to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.(CVE-2025-49812)

 In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.(CVE-2025-23048)

 Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.In a logging configuration where CustomLog is used with '%{varname}x' or '%{varname}c' to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.(CVE-2024-47252)

 SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.(CVE-2024-43204)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected httpd packages.

Read more at https://www.tenable.com/plugins/nessus/302735

]]> <![CDATA[EulerOS Virtualization 2.12.1 : vim (EulerOS-SA-2026-1469)]]> https://www.tenable.com/plugins/nessus/302734 https://www.tenable.com/plugins/nessus/302734 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302734 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vims tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1552 contains a patch for the vulnerability.(CVE-2025-53905)

 Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vims zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1551 contains a patch for the vulnerability.(CVE-2025-53906)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization vim security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected vim packages.

Read more at https://www.tenable.com/plugins/nessus/302734

]]> <![CDATA[EulerOS Virtualization 2.12.1 : bind (EulerOS-SA-2026-1417)]]> https://www.tenable.com/plugins/nessus/302733 https://www.tenable.com/plugins/nessus/302733 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302733 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.(CVE-2025-40780)

 Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.(CVE-2025-40778)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization bind security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected bind packages.

Read more at https://www.tenable.com/plugins/nessus/302733

]]> <![CDATA[EulerOS Virtualization 2.12.1 : glibc (EulerOS-SA-2026-1426)]]> https://www.tenable.com/plugins/nessus/302732 https://www.tenable.com/plugins/nessus/302732 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302732 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.

 Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [162+ 1, 163] and exactly 163 for posix_memalign and aligned_alloc.

 Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.(CVE-2026-0861)

 Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.(CVE-2025-15281)

 The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.(CVE-2025-8058)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected glibc packages.

Read more at https://www.tenable.com/plugins/nessus/302732

]]> <![CDATA[EulerOS Virtualization 2.12.1 : python-pip (EulerOS-SA-2026-1457)]]> https://www.tenable.com/plugins/nessus/302731 https://www.tenable.com/plugins/nessus/302731 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302731 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.(CVE-2025-50181)

 Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.(CVE-2023-32681)

 When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.Note that upgrading pip to a 'fixed' version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the 'vulnerable' fallback code.Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python =3.9.17, =3.10.12, =3.11.4, or =3.12),applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.(CVE-2025-8869)

 Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.(CVE-2024-47081)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-pip security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-pip packages.

Read more at https://www.tenable.com/plugins/nessus/302731

]]> <![CDATA[EulerOS Virtualization 2.12.1 : aide (EulerOS-SA-2026-1415)]]> https://www.tenable.com/plugins/nessus/302730 https://www.tenable.com/plugins/nessus/302730 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302730 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the aide package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.(CVE-2025-54409)

 AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized. This issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to stderr to a regular file.(CVE-2025-54389)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization aide security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected aide packages.

Read more at https://www.tenable.com/plugins/nessus/302730

]]> <![CDATA[EulerOS 2.0 SP11 : containerd (EulerOS-SA-2026-1572)]]> https://www.tenable.com/plugins/nessus/302729 https://www.tenable.com/plugins/nessus/302729 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302729 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the containerd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions.
 This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.(CVE-2024-25621)

Tenable has extracted the preceding description block directly from the EulerOS containerd security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected containerd packages.

Read more at https://www.tenable.com/plugins/nessus/302729

]]> <![CDATA[EulerOS Virtualization 2.10.0 : cups (EulerOS-SA-2026-1551)]]> https://www.tenable.com/plugins/nessus/302728 https://www.tenable.com/plugins/nessus/302728 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302728 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of- bound write. This issue has been patched in version 2.4.15.(CVE-2025-61915)

 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.(CVE-2025-58436)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization cups security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected cups packages.

Read more at https://www.tenable.com/plugins/nessus/302728

]]> <![CDATA[EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-1582)]]> https://www.tenable.com/plugins/nessus/302727 https://www.tenable.com/plugins/nessus/302727 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302727 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.(CVE-2024-36357)

 bpf: Fix oob access in cgroup local storage(CVE-2025-38502)

 vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects(CVE-2025-39850)

 tracing: Fix reading strings from synthetic events(CVE-2022-50255)

 x86/mce: Work around an erratum on fast string copy instructions(CVE-2022-49124)

 serial: 8250: fix panic due to PSLVERR(CVE-2025-39724)

 fbcon: fix integer overflow in fbcon_do_set_font(CVE-2025-39967)

 i40e: add max boundary check for VF filters(CVE-2025-39968)

 scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()(CVE-2023-53530)

 scsi: qla2xxx: Fix premature hw access after PCI error(CVE-2022-49157)

 vxlan: Fix NPD when refreshing an FDB entry with a nexthop object(CVE-2025-39851)

 bpf, cpumap: Make sure kthread is running before map update returns(CVE-2023-53577)

 scsi: qla4xxx: Add length check when parsing nlattrs(CVE-2023-53456)

 bnxt: avoid overflow in bnxt_get_nvram_directory()(CVE-2023-53661)

 scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()(CVE-2023-53521)

 pNFS: Fix uninited ptr deref in block/scsi layout(CVE-2025-38691)

 udf: Fix uninitialized array access for some pathnames(CVE-2023-53165)

 scsi: qla2xxx: Pointer may be dereferenced(CVE-2023-53150)

 firewire: net: fix use after free in fwnet_finish_incoming_packet()(CVE-2023-53432)

 i40e: fix MMIO write access to an invalid page in i40e_clear_hw(CVE-2025-38200)

 RDMA/mlx5: Initialize obj_event-obj_sub_list before xa_insert(CVE-2025-38387)

 usb: net: sierra: check for no status endpoint(CVE-2025-38474)

 hv_netvsc: Fix panic during namespace deletion with VF(CVE-2025-38683)

 ext4: improve error handling from ext4_dirhash()(CVE-2023-53473)

 benet: fix BUG when creating VFs(CVE-2025-38569)

 mm/slub: avoid accessing metadata when pointer is invalid in object_err()(CVE-2025-39902)

 xfrm: Duplicate SPI Handling(CVE-2025-39797)

 i40e: fix validation of VF state in get resources(CVE-2025-39969)

 i40e: fix input validation logic for action_meta(CVE-2025-39970)

 cnic: Fix use-after-free bugs in cnic_delete_task(CVE-2025-39945)

 net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb(CVE-2023-53548)

 bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT(CVE-2025-38439)

 blk-mq: avoid double -queue_rq() because of early timeout(CVE-2022-50554)

 NFSD: Define a proc_layoutcommit for the FlexFiles layout type(CVE-2025-40087)

 tracing: dynevent: Add a missing lockdown check on dynevent(CVE-2025-40021)

 ppp: fix memory leak in pad_compress_skb(CVE-2025-39847)

 i40e: Fix potential invalid access when MAC list is empty(CVE-2025-39853)

 IB/hfi1: Fix possible panic during hotplug remove(CVE-2023-53488)

 vfs: Don't leak disconnected dentries on umount(CVE-2025-40105)

 In kernel/trace/trace_kprobe.c at line 1308, the kprobe_perf_func function attempts to access the call- perf_events pointer, but due to the race condition, this pointer may not have been properly initialized.(CVE-2025-40042)

 perf: arm_spe: Prevent overflow in PERF_IDX2OFF()(CVE-2025-40081)

 crypto: essiv - Check ssize for decryption and in-place encryption(CVE-2025-40019)

 loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

 usb: xhci: Apply the link chain quirk on NEC isoc endpoints(CVE-2025-22022)

 nfsd: put dl_stid if fail to queue dl_recall(CVE-2025-22025)

 PCI/ASPM: Fix link state exit during switch upstream function removal(CVE-2024-58093)

 KVM: arm64: Prevent access to vCPU events before init(CVE-2025-40102)

 HID: ignore non-functional sensor in HP 5MP Camera(CVE-2025-21992)

 partitions: mac: fix handling of bogus partition table(CVE-2025-21772)

 fs: udf: fix OOB read in lengthAllocDescs handling(CVE-2025-40044)

 acpi: nfit: fix narrowing conversion in acpi_nfit_ctl(CVE-2025-22044)

 crypto: rng - Ensure set_ent is always present(CVE-2025-40109)

 scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()(CVE-2023-53696)

 drm/hisilicon/hibmc: fix the hibmc loaded failed bug(CVE-2025-39772)

 uio_hv_generic: Let userspace take care of interrupt mask(CVE-2025-40048)

 KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O(CVE-2025-40026)

 ext4: detect invalid INLINE_DATA + EXTENTS flag combination(CVE-2025-40167)

 scsi: ses: Fix possible desc_ptr out-of-bounds accesses(CVE-2023-53675)

 fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

 crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg(CVE-2025-39964)

 mtd: core: fix possible resource leak in init_mtd()(CVE-2022-50304)

 RDMA/mlx5: Return the firmware result upon destroying QP/RQ(CVE-2023-53286)

 bnxt_en: Fix memory corruption when FW resources change during ifdown(CVE-2025-39810)

 RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()(CVE-2023-53335)

 fs: dlm: fix invalid derefence of sb_lvbptr(CVE-2022-50516)

 scsi: mpt3sas: Fix a memory leak(CVE-2023-53512)

 ext4: fix off-by-one errors in fast-commit block filling(CVE-2022-50428)

 KVM: x86: Reset IRTE to host control if *new* route isn't postable(CVE-2025-37885)

 PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type(CVE-2025-23161)

 scsi: st: Fix array overflow in st_setup()(CVE-2025-37857)

 isofs: Prevent the use of too small fid(CVE-2025-37780)

 md/raid1,raid10: don't ignore IO flags(CVE-2025-22125)

 virtiofs: add filesystem context source name check(CVE-2025-37773)

 vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint(CVE-2025-22083)

 crypto: af_alg - Set merge to zero early in af_alg_sendmsg(CVE-2025-39931)

 modpost: fix off by one in is_executable_section()(CVE-2023-53397)

 scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

 net: bridge: fix soft lockup in br_multicast_query_expired()(CVE-2025-39773)

 arm64: csum: Fix OoB access in IP checksum code for negative lengths(CVE-2023-53726)

 x86/MCE: Always save CS register on AMD Zen IF Poison errors(CVE-2023-53438)

 PCI: Fix reference leak in pci_register_host_bridge()(CVE-2025-37836)

 cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

 NFS: Fix the setting of capabilities when automounting a new filesystem(CVE-2025-39798)

 Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of privilege local access(CVE-2024-21823)

 mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

 virtio_net: Fix error unwinding of XDP initialization(CVE-2023-53499)

 RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device(CVE-2023-53393)

 gfs2: No more self recovery(CVE-2025-38659)

 scsi: target: Fix WRITE_SAME No Data Buffer crash(CVE-2022-21546)

 cifs: Fix connections leak when tlink setup failed(CVE-2022-49822)

 cifs: avoid NULL pointer dereference in dbg call(CVE-2025-37844)

 smb3: fix for slab out of bounds on mount to ksmbd(CVE-2025-38728)

 ceph: fix race condition validating r_parent before applying state(CVE-2025-39927)

 cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

 NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()(CVE-2025-39730)

 smb: client: fix use-after-free in cifs_oplock_break(CVE-2025-38527)

 scsi: qla2xxx: Fix potential NULL pointer dereference(CVE-2023-53451)

 objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()(CVE-2025-37937)

 scsi: libiscsi: Initialize iscsi_conn-dd_data only if memory is allocated(CVE-2025-38700)

 block: fix resource leak in blk_register_queue() error path(CVE-2025-37980)

 scsi: target: Fix multiple LUN_RESET handling(CVE-2023-53586)

 md/raid1: Fix stack memory use after return in raid1_reshape(CVE-2025-38445)

 blk-mq: fix NULL dereference on q-elevator in blk_mq_elv_switch_none(CVE-2023-53292)

 scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses(CVE-2023-7324)

 nbd: restrict sockets to TCP and UDP(CVE-2025-40080)

 scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()(CVE-2023-53676)

 mm: hugetlb: avoid soft lockup when mprotect to large memory area(CVE-2025-40153)

 fbdev: fix potential buffer overflow in do_register_framebuffer()(CVE-2025-38702)

 net: ena: fix shift-out-of-bounds in exponential backoff(CVE-2023-53272)

 software node: Correct a OOB check in software_node_get_reference_args()(CVE-2025-38342)

 virtio: break and reset virtio devices on device_shutdown()(CVE-2025-38064)

 net/sched: sch_qfq: Fix race condition on qfq_aggregate(CVE-2025-38477)

 netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX(CVE-2025-38201)

 qed: allow sleep in qed_mcp_trace_dump()(CVE-2023-53509)

 vsock: Fix transport_* TOCTOU(CVE-2025-38461)

 ice: Fix a null pointer dereference in ice_copy_and_init_pkg()(CVE-2025-38664)

 tcp_metrics: use dst_dev_net_rcu()(CVE-2025-40075)

 netfilter: nf_tables: reject duplicate device on updates(CVE-2025-38678)

 ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

 net/packet: fix a race in packet_set_ring() and packet_notifier()(CVE-2025-38617)

 xfrm: Zero padding when dumping algos and encap(CVE-2023-53684)

 ipv4: start using dst_dev_rcu()(CVE-2025-40074)

 IB/mad: Don't call to function that might sleep while in atomic context(CVE-2022-50472)

 iavf: Fix reset error handling(CVE-2022-50053)

 RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug(CVE-2025-38024)

 RDMA/bnxt_re: wraparound mbox producer index(CVE-2023-53201)

 net/mlx5e: Check for NOT_READY flag state after locking(CVE-2023-53581)

 i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path(CVE-2025-39911)

 RDMA/rxe: Fix incomplete state save in rxe_requester(CVE-2023-53539)

 net_sched: sch_sfq: reject invalid perturb period(CVE-2025-38193)

 netfilter: conntrack: fix wrong ct-timeout value(CVE-2023-53635)

 net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree(CVE-2025-38468)

 vsock: Fix transport_{g2h,h2g} TOCTOU(CVE-2025-38462)

 media: tuner: xc5000: Fix use-after-free in xc5000_release(CVE-2025-39994)

 mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race(CVE-2025-38085)

 media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()(CVE-2025-38694)

 cifs: prevent NULL pointer dereference in UTF16 conversion(CVE-2025-39838)

 sctp: linearize cloned gso packets in sctp_rcv(CVE-2025-38718)

 mm/vmscan: don't try to reclaim hwpoison folio(CVE-2025-37834)

 tun: Fix memory leak for detached NAPI queue.(CVE-2023-53685)

 iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()(CVE-2023-53476)

 smb: client: fix race with concurrent opens in rename(2)(CVE-2025-39825)

 Squashfs: check return result of sb_min_blocksize(CVE-2025-38415)

 HID: multitouch: Correct devm device reference for hidinput input_dev name(CVE-2023-53454)

 genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie(CVE-2025-38062)

 pinctrl: check the return value of pinmux_ops::get_function_name()(CVE-2025-40030)

 dm-stripe: fix a possible integer overflow(CVE-2025-39940)

 scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write(CVE-2023-53282)

 drm/vmwgfx: Fix a null-ptr access in the cursor snooper(CVE-2025-40110)

 fs: Prevent file descriptor table allocations exceeding INT_MAX(CVE-2025-39756)

 ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()(CVE-2025-40198)

 tty: n_gsm: fix deadlock and link starvation in outgoing data path(CVE-2022-50116)

 sctp: Fix MAC comparison to be constant-time(CVE-2025-40204)

 tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().(CVE-2025-40186)

 scsi: storvsc: Fix handling of virtual Fibre Channel timeouts(CVE-2023-53245)

 media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()(CVE-2025-39713)

 media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove(CVE-2025-39996)

 nubus: Partially revert proc_create_single_data() conversion(CVE-2023-53217)

 scsi: qla2xxx: Fix deletion race condition(CVE-2023-53615)

 Squashfs: fix uninit-value in squashfs_get_parent(CVE-2025-40049)

 RDMA/hns: Fix double destruction of rsv_qp(CVE-2025-38582)

 cifs: parse_dfs_referrals: prevent oob on malformed input(CVE-2025-40099)

 net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error(CVE-2025-21924)

 net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer(CVE-2025-39937)

 bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls(CVE-2025-38608)

 ACPI: CPPC: Make rmw_lock a raw_spin_lock(CVE-2024-50249)

 ACPI: video: Fix use-after-free in acpi_video_switch_brightness()(CVE-2025-40211)

 smb: client: Fix refcount leak for cifs_sb_tlink(CVE-2025-40103)

 nfsd: decrease sc_count directly if fail to queue dl_recall(CVE-2025-37871)

 iommu/amd: Avoid stack buffer overflow from kernel cmdline(CVE-2025-38676)

 crypto: hisilicon/qm - set NULL to qm-debug.qm_diff_regs(CVE-2025-40062)

 dma-buf: insert memory barrier before updating num_fences(CVE-2025-38095)

 mm/hugetlb: fix folio is still mapped when deleted(CVE-2025-40006)

 ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered(CVE-2025-39763)

 crypto: hisilicon/qm - request reserved interrupt for virtual function(CVE-2025-40136)

 gfs2: Fix possible data races in gfs2_show_options()(CVE-2023-53622)

 mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list(CVE-2025-39725)

 fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

 powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()(CVE-2022-50635)

 be2net: pass wrb_params in case of OS2BMC be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site.(CVE-2025-40264)

 fuse: fix livelock in synchronous file put from fuseblk workers(CVE-2025-40220)

 sctp: avoid NULL dereference when chunk data buffer is missing(CVE-2025-40240)

 tipc: Fix use-after-free in tipc_mon_reinit_self().(CVE-2025-40280)

 sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto(CVE-2025-40281)

 scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()(CVE-2025-68229)

 libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

 RDMA/core: Fix 'KASAN: slab-use-after-free Read in ib_register_device' problem(CVE-2025-38022)

 usbnet: Fix using smp_processor_id() in preemptible code warnings(CVE-2025-40164)

 scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT(CVE-2022-49534)

 NFSD: fix race between nfsd registration and exports_proc(CVE-2025-38232)

 scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()(CVE-2025-38724)

 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request(CVE-2025-38430)

 HID: core: Harden s32ton() against conversion to 0 bits(CVE-2025-38556)

 iavf: Fix out-of-bounds when setting channels on remove(CVE-2023-53659)

 start_kernel: Add __no_stack_protector function attribute(CVE-2023-53491)

 efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

 drm/scheduler: fix fence ref counting(CVE-2022-49829)

 scsi: qla2xxx: Wait for io return on terminate rport(CVE-2023-53322)

 scsi: lpfc: Fix buffer free/clear order in deferred receive path(CVE-2025-39841)

 tcp: Clear tcp_sk(sk)-fastopen_rsk in tcp_disconnect().(CVE-2025-39955)

 icmp6: Fix null-ptr-deref of ip6_null_entry-rt6i_idev in icmp6_dev().(CVE-2023-53343)

 cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()(CVE-2025-40194)

 i40e: remove read access to debugfs files(CVE-2025-39901)

 nexthop: Forbid FDB status change while nexthop is in a group(CVE-2025-39980)

 netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed(CVE-2022-50500)

 nfsd: call op_release, even when op_func returns an error(CVE-2023-53241)

 media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID(CVE-2025-40016)

 igb: Fix igb_down hung on surprise removal(CVE-2023-53148)

 __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock(CVE-2025-38058)

 ext4: guard against EA inode refcount underflow in xattr update(CVE-2025-40190)

 ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

 scsi: core: Fix possible memory leak if device_add() fails(CVE-2023-53174)

 md/raid10: fix wrong setting of max_corr_read_errors(CVE-2023-53313)

 lwt: Fix return values of BPF xmit ops(CVE-2023-53338)

 netfilter: ctnetlink: fix refcount leak on table dump(CVE-2025-38721)

 netfilter: ctnetlink: remove refcounting in expectation dumpers(CVE-2025-39764)

 netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm(CVE-2025-39894)

 blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx(CVE-2025-40125)

 cifs: Release folio lock on fscache read hit.(CVE-2023-53593)

 io_uring: wait interruptibly for request completions on exit(CVE-2023-53461)

 net: dlink: handle copy_thresh allocation failure(CVE-2025-40053)

 net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast(CVE-2025-40140)

 i40e: fix idx validation in i40e_validate_queue_map(CVE-2025-39972)

 net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM(CVE-2025-39770)

 ipv6: use RCU in ip6_xmit()(CVE-2025-40135)

 pstore/ram: Check start of empty przs during init(CVE-2023-53331)

 ipv6: use RCU in ip6_output()(CVE-2025-40158)

 net: use dst_dev_rcu() in sk_setup_caps()(CVE-2025-40170)

 KVM: x86: use array_index_nospec with indices that come from guest(CVE-2025-39823)

 vxlan: Annotate FDB data races(CVE-2025-38037)

 drm/vmwgfx: Fix Use-after-free in validation(CVE-2025-40111)

 cifs: fix mid leak during reconnection after timeout threshold(CVE-2023-53597)

 xfs: do not propagate ENODATA disk errors into xattr code(CVE-2025-39835)

 of: check previous kernel's ima-kexec-buffer against memory bounds(CVE-2022-50159)

 Squashfs: reject negative file sizes in squashfs_read_inode()(CVE-2025-40200)

 skmsg: Fix wrong last sg check in sk_msg_recvmsg()(CVE-2022-49973)

 mm/smaps: fix race between smaps_hugetlb_range and migration(CVE-2025-39754)

 Drivers: hv: vmbus: Don't dereference ACPI root object handle(CVE-2023-53647)

 scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel packages.

Read more at https://www.tenable.com/plugins/nessus/302727

]]> <![CDATA[EulerOS Virtualization 2.12.0 : libtiff (EulerOS-SA-2026-1498)]]> https://www.tenable.com/plugins/nessus/302726 https://www.tenable.com/plugins/nessus/302726 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302726 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that '[t]his error only occurs if DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. 'rD') option is used.'(CVE-2025-8534)

 A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.(CVE-2024-13978)

 A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue.(CVE-2025-8851)

 A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It is recommended to apply a patch to fix this issue. This vulnerability only affects products that are no longer supported by the maintainer.(CVE-2025-8177)

 A flaw has been found in LibTIFF 4.7.0. This affects the function
 _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because 'this is a memory leak on a command line tool that is about to exit anyway'. In the reply the project maintainer declares this issue as 'a simple 'bug' when leaving the command line tool and (...) not a security issue at all'.(CVE-2025-9165)

 A flaw was found in Libtiff. This vulnerability is a 'write-what-where' condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.(CVE-2025-9900)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libtiff security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libtiff packages.

Read more at https://www.tenable.com/plugins/nessus/302726

]]> <![CDATA[EulerOS Virtualization 2.12.1 : libvirt (EulerOS-SA-2026-1470)]]> https://www.tenable.com/plugins/nessus/302725 https://www.tenable.com/plugins/nessus/302725 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302725 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.(CVE-2025-12748)

 A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.(CVE-2025-13193)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libvirt security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libvirt packages.

Read more at https://www.tenable.com/plugins/nessus/302725

]]> <![CDATA[EulerOS Virtualization 2.12.1 : unbound (EulerOS-SA-2026-1467)]]> https://www.tenable.com/plugins/nessus/302724 https://www.tenable.com/plugins/nessus/302724 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302724 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the unbound packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks.
 Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and non-referral nodata replies, further mitigating the possible poison effect.(CVE-2025-11411)

 A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet- always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.(CVE-2025-5994)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization unbound security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected unbound packages.

Read more at https://www.tenable.com/plugins/nessus/302724

]]> <![CDATA[EulerOS Virtualization 2.12.0 : libxslt (EulerOS-SA-2026-1500)]]> https://www.tenable.com/plugins/nessus/302723 https://www.tenable.com/plugins/nessus/302723 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302723 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libxslt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.(CVE-2025-10911)

 A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.(CVE-2025-7424)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libxslt security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libxslt packages.

Read more at https://www.tenable.com/plugins/nessus/302723

]]> <![CDATA[EulerOS Virtualization 2.10.0 : libtasn1 (EulerOS-SA-2026-1560)]]> https://www.tenable.com/plugins/nessus/302722 https://www.tenable.com/plugins/nessus/302722 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302722 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the libtasn1 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.(CVE-2025-13151)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libtasn1 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libtasn1 packages.

Read more at https://www.tenable.com/plugins/nessus/302722

]]> <![CDATA[EulerOS 2.0 SP11 : cups (EulerOS-SA-2026-1573)]]> https://www.tenable.com/plugins/nessus/302721 https://www.tenable.com/plugins/nessus/302721 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302721 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the cups package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.(CVE-2025-58436)

 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of- bound write. This issue has been patched in version 2.4.15.(CVE-2025-61915)

Tenable has extracted the preceding description block directly from the EulerOS cups security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected cups packages.

Read more at https://www.tenable.com/plugins/nessus/302721

]]> <![CDATA[EulerOS Virtualization 2.12.1 : python3 (EulerOS-SA-2026-1455)]]> https://www.tenable.com/plugins/nessus/302720 https://www.tenable.com/plugins/nessus/302720 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302720 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.(CVE-2025-12084)

 The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.(CVE-2025-8291)

 CPython 3.9 and earlier doesn't disallow configuring an empty list ('[]') for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).(CVE-2024-5642)

 When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.(CVE-2025-13836)

 When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues(CVE-2025-13837)

 The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.(CVE-2025-6069)

 During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.(CVE-2025-1795)

 There is an issue in CPython when using `bytes.decode('unicode_escape', error='ignore|replace')`. If you are not using the 'unicode_escape' encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.(CVE-2025-4516)

 Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of 'data'or 'tar'. See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.Note that for Python 3.14 or later the default value of filter=changed from 'no filtering' to `'data', so if you are relying on this new default behavior then your usage is also affected.Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.(CVE-2025-4330)

 Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of 'data'or 'tar'. See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.Note that for Python 3.14 or later the default value of filter=changed from 'no filtering' to `'data', so if you are relying on this new default behavior then your usage is also affected.Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.(CVE-2025-4138)

 There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the tarfile module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1(CVE-2025-8194)

 Allows arbitrary filesystem writes outside the extraction directory during extraction with filter='data'.
 You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of 'data'or 'tar'. See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Note that for Python 3.14 or later the default value of filter=changed from 'no filtering' to `'data', so if you are relying on this new default behavior then your usage is also affected. Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.(CVE-2025-4517)

 When using a TarFile.errorlevel = 0and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0in affected versions is that the member would still be extracted and not skipped.(CVE-2025-4435)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3 packages.

Read more at https://www.tenable.com/plugins/nessus/302720

]]> <![CDATA[EulerOS Virtualization 2.10.1 : glib2 (EulerOS-SA-2026-1533)]]> https://www.tenable.com/plugins/nessus/302719 https://www.tenable.com/plugins/nessus/302719 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302719 with Critical Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the glib2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.(CVE-2025-14087)

 A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.(CVE-2025-13601)

 A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.(CVE-2025-14512)

 A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).(CVE-2026-0988)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization glib2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected glib2 packages.

Read more at https://www.tenable.com/plugins/nessus/302719

]]> <![CDATA[EulerOS Virtualization 2.12.1 : libsodium (EulerOS-SA-2026-1438)]]> https://www.tenable.com/plugins/nessus/302718 https://www.tenable.com/plugins/nessus/302718 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302718 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the libsodium package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.(CVE-2025-69277)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libsodium security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libsodium packages.

Read more at https://www.tenable.com/plugins/nessus/302718

]]> <![CDATA[EulerOS Virtualization 2.12.1 : gnutls (EulerOS-SA-2026-1428)]]> https://www.tenable.com/plugins/nessus/302717 https://www.tenable.com/plugins/nessus/302717 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302717 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the gnutls packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.(CVE-2025-9820)

 A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure.This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.(CVE-2025-32988)

 A NULL pointer dereference flaw was found in the GnuTLS software in
 _gnutls_figure_common_ciphersuite().(CVE-2025-6395)

 A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.(CVE-2025-32990)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization gnutls security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected gnutls packages.

Read more at https://www.tenable.com/plugins/nessus/302717

]]> <![CDATA[EulerOS Virtualization 2.12.0 : shim (EulerOS-SA-2026-1519)]]> https://www.tenable.com/plugins/nessus/302716 https://www.tenable.com/plugins/nessus/302716 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302716 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the shim package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption.
 The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.(CVE-2022-4304)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization shim security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected shim packages.

Read more at https://www.tenable.com/plugins/nessus/302716

]]> <![CDATA[EulerOS Virtualization 2.12.1 : edk2 (EulerOS-SA-2026-1471)]]> https://www.tenable.com/plugins/nessus/302715 https://www.tenable.com/plugins/nessus/302715 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302715 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the edk2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2024-38805)

 EDK2 contains a vulnerability in BIOS where an attacker may cause 'Protection Mechanism Failure' by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.(CVE-2025-3770)

 EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability.(CVE-2024-38797)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization edk2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected edk2 packages.

Read more at https://www.tenable.com/plugins/nessus/302715

]]> <![CDATA[EulerOS Virtualization 2.12.0 : dhcp (EulerOS-SA-2026-1479)]]> https://www.tenable.com/plugins/nessus/302714 https://www.tenable.com/plugins/nessus/302714 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302714 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the dhcp package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.
 This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.(CVE-2025-40778)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization dhcp security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected dhcp packages.

Read more at https://www.tenable.com/plugins/nessus/302714

]]> <![CDATA[EulerOS Virtualization 2.12.1 : gnupg2 (EulerOS-SA-2026-1427)]]> https://www.tenable.com/plugins/nessus/302713 https://www.tenable.com/plugins/nessus/302713 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302713 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the gnupg2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)(CVE-2025-68973)

 In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a 'verification DoS.'(CVE-2025-30258)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization gnupg2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected gnupg2 packages.

Read more at https://www.tenable.com/plugins/nessus/302713

]]> <![CDATA[EulerOS Virtualization 2.12.1 : glib2 (EulerOS-SA-2026-1425)]]> https://www.tenable.com/plugins/nessus/302712 https://www.tenable.com/plugins/nessus/302712 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302712 with Critical Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the glib2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).(CVE-2026-0988)

 A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.(CVE-2025-14512)

 A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.(CVE-2025-13601)

 A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.(CVE-2025-14087)

 A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations.(CVE-2025-7039)

 A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite.(CVE-2025-4373)

 A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.(CVE-2025-3360)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization glib2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected glib2 packages.

Read more at https://www.tenable.com/plugins/nessus/302712

]]> <![CDATA[EulerOS Virtualization 2.12.1 : polkit (EulerOS-SA-2026-1453)]]> https://www.tenable.com/plugins/nessus/302711 https://www.tenable.com/plugins/nessus/302711 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302711 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the polkit packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.(CVE-2025-7519)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization polkit security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected polkit packages.

Read more at https://www.tenable.com/plugins/nessus/302711

]]> <![CDATA[EulerOS Virtualization 2.12.0 : python3 (EulerOS-SA-2026-1512)]]> https://www.tenable.com/plugins/nessus/302710 https://www.tenable.com/plugins/nessus/302710 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302710 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.(CVE-2025-12084)

 The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.(CVE-2025-8291)

 CPython 3.9 and earlier doesn't disallow configuring an empty list ('[]') for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).(CVE-2024-5642)

 When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.(CVE-2025-13836)

 When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues(CVE-2025-13837)

 The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.(CVE-2025-6069)

 During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.(CVE-2025-1795)

 There is an issue in CPython when using `bytes.decode('unicode_escape', error='ignore|replace')`. If you are not using the 'unicode_escape' encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.(CVE-2025-4516)

 Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of 'data'or 'tar'. See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.Note that for Python 3.14 or later the default value of filter=changed from 'no filtering' to `'data', so if you are relying on this new default behavior then your usage is also affected.Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.(CVE-2025-4330)

 Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of 'data'or 'tar'. See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information.Note that for Python 3.14 or later the default value of filter=changed from 'no filtering' to `'data', so if you are relying on this new default behavior then your usage is also affected.Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.(CVE-2025-4138)

 There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the tarfile module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1(CVE-2025-8194)

 Allows arbitrary filesystem writes outside the extraction directory during extraction with filter='data'.
 You are affected by this vulnerability if using the tarfilemodule to extract untrusted tar archives using TarFile.extractall()or TarFile.extract()using the filter=parameter with a value of 'data'or 'tar'. See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Note that for Python 3.14 or later the default value of filter=changed from 'no filtering' to `'data', so if you are relying on this new default behavior then your usage is also affected. Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links.(CVE-2025-4517)

 When using a TarFile.errorlevel = 0and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0in affected versions is that the member would still be extracted and not skipped.(CVE-2025-4435)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3 packages.

Read more at https://www.tenable.com/plugins/nessus/302710

]]> <![CDATA[EulerOS Virtualization 2.12.1 : libtasn1 (EulerOS-SA-2026-1440)]]> https://www.tenable.com/plugins/nessus/302709 https://www.tenable.com/plugins/nessus/302709 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302709 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the libtasn1 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.(CVE-2025-13151)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libtasn1 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libtasn1 packages.

Read more at https://www.tenable.com/plugins/nessus/302709

]]> <![CDATA[EulerOS Virtualization 2.12.0 : libpng (EulerOS-SA-2026-1494)]]> https://www.tenable.com/plugins/nessus/302708 https://www.tenable.com/plugins/nessus/302708 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302708 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libpng package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of- bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.(CVE-2025-64506)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
 Upgrade to libpng 1.6.52 or later.(CVE-2025-66293)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018.
 This vulnerability is fixed in 1.6.54.(CVE-2026-22695)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.(CVE-2026-22801)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component alpha 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.(CVE-2025-64720)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libpng packages.

Read more at https://www.tenable.com/plugins/nessus/302708

]]> <![CDATA[EulerOS Virtualization 2.12.1 : curl (EulerOS-SA-2026-1421)]]> https://www.tenable.com/plugins/nessus/302707 https://www.tenable.com/plugins/nessus/302707 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302707 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers.Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.(CVE-2025-14017)

 When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP,POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

 When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

 When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.(CVE-2025-15079)

 curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.This prevents curl from detecting MITM attackers and more.(CVE-2025-10966)

 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3.
 The same cookie name is set - but with just a slash as path (`path=\'/\',`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.(CVE-2025-9086)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected curl packages.

Read more at https://www.tenable.com/plugins/nessus/302707

]]> <![CDATA[EulerOS Virtualization 2.12.0 : glibc (EulerOS-SA-2026-1483)]]> https://www.tenable.com/plugins/nessus/302706 https://www.tenable.com/plugins/nessus/302706 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302706 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.

 Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [162+ 1, 163] and exactly 163 for posix_memalign and aligned_alloc.

 Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.(CVE-2026-0861)

 Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.(CVE-2025-15281)

 The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.(CVE-2025-8058)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected glibc packages.

Read more at https://www.tenable.com/plugins/nessus/302706

]]> <![CDATA[EulerOS 2.0 SP11 : glib2 (EulerOS-SA-2026-1577)]]> https://www.tenable.com/plugins/nessus/302705 https://www.tenable.com/plugins/nessus/302705 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302705 with Critical Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the glib2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.(CVE-2025-13601)

 A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.(CVE-2025-14087)

Tenable has extracted the preceding description block directly from the EulerOS glib2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected glib2 packages.

Read more at https://www.tenable.com/plugins/nessus/302705

]]> <![CDATA[EulerOS Virtualization 2.10.0 : python-ldap (EulerOS-SA-2026-1563)]]> https://www.tenable.com/plugins/nessus/302704 https://www.tenable.com/plugins/nessus/302704 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302704 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the python-ldap packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.(CVE-2025-61911)

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.(CVE-2025-61912)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-ldap security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-ldap packages.

Read more at https://www.tenable.com/plugins/nessus/302704

]]> <![CDATA[EulerOS Virtualization 2.12.1 : openssh (EulerOS-SA-2026-1449)]]> https://www.tenable.com/plugins/nessus/302703 https://www.tenable.com/plugins/nessus/302703 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302703 with Low Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.(CVE-2025-61985)

 ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)(CVE-2025-61984)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization openssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected openssh packages.

Read more at https://www.tenable.com/plugins/nessus/302703

]]> <![CDATA[EulerOS Virtualization 2.12.0 : libvirt (EulerOS-SA-2026-1527)]]> https://www.tenable.com/plugins/nessus/302702 https://www.tenable.com/plugins/nessus/302702 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302702 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.(CVE-2025-12748)

 A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.(CVE-2025-13193)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libvirt security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libvirt packages.

Read more at https://www.tenable.com/plugins/nessus/302702

]]> <![CDATA[EulerOS Virtualization 2.12.0 : icu (EulerOS-SA-2026-1488)]]> https://www.tenable.com/plugins/nessus/302701 https://www.tenable.com/plugins/nessus/302701 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302701 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the icu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.(CVE-2025-5222)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization icu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected icu packages.

Read more at https://www.tenable.com/plugins/nessus/302701

]]> <![CDATA[EulerOS Virtualization 2.12.0 : brotli (EulerOS-SA-2026-1476)]]> https://www.tenable.com/plugins/nessus/302700 https://www.tenable.com/plugins/nessus/302700 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302700 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the brotli package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.(CVE-2025-6176)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization brotli security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected brotli packages.

Read more at https://www.tenable.com/plugins/nessus/302700

]]> <![CDATA[EulerOS Virtualization 2.12.1 : rsync (EulerOS-SA-2026-1460)]]> https://www.tenable.com/plugins/nessus/302699 https://www.tenable.com/plugins/nessus/302699 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302699 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the rsync package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The

 malicious

 rsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization rsync security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected rsync packages.

Read more at https://www.tenable.com/plugins/nessus/302699

]]> <![CDATA[EulerOS Virtualization 2.12.0 : glib2 (EulerOS-SA-2026-1482)]]> https://www.tenable.com/plugins/nessus/302698 https://www.tenable.com/plugins/nessus/302698 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302698 with Critical Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the glib2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).(CVE-2026-0988)

 A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.(CVE-2025-14512)

 A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.(CVE-2025-13601)

 A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.(CVE-2025-14087)

 A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations.(CVE-2025-7039)

 A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite.(CVE-2025-4373)

 A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.(CVE-2025-3360)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization glib2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected glib2 packages.

Read more at https://www.tenable.com/plugins/nessus/302698

]]> <![CDATA[EulerOS Virtualization 2.12.0 : coreutils (EulerOS-SA-2026-1477)]]> https://www.tenable.com/plugins/nessus/302697 https://www.tenable.com/plugins/nessus/302697 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302697 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the coreutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.(CVE-2025-5278)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization coreutils security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected coreutils packages.

Read more at https://www.tenable.com/plugins/nessus/302697

]]> <![CDATA[EulerOS Virtualization 2.12.0 : mod_http2 (EulerOS-SA-2026-1501)]]> https://www.tenable.com/plugins/nessus/302696 https://www.tenable.com/plugins/nessus/302696 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302696 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the mod_http2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 In certain proxy configurations, a denial of service attack againstApache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2.

 Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to 'on'.(CVE-2025-49630)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization mod_http2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected mod_http2 packages.

Read more at https://www.tenable.com/plugins/nessus/302696

]]> <![CDATA[EulerOS Virtualization 2.12.0 : pam (EulerOS-SA-2026-1508)]]> https://www.tenable.com/plugins/nessus/302695 https://www.tenable.com/plugins/nessus/302695 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302695 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the pam package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.(CVE-2025-6020)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization pam security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected pam packages.

Read more at https://www.tenable.com/plugins/nessus/302695

]]> <![CDATA[EulerOS Virtualization 2.12.1 : python-ldap (EulerOS-SA-2026-1456)]]> https://www.tenable.com/plugins/nessus/302694 https://www.tenable.com/plugins/nessus/302694 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302694 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the python-ldap packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.(CVE-2025-61911)

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.(CVE-2025-61912)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-ldap security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-ldap packages.

Read more at https://www.tenable.com/plugins/nessus/302694

]]> <![CDATA[EulerOS Virtualization 2.12.0 : ncurses (EulerOS-SA-2026-1502)]]> https://www.tenable.com/plugins/nessus/302693 https://www.tenable.com/plugins/nessus/302693 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302693 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the ncurses packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.(CVE-2025-6141)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization ncurses security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected ncurses packages.

Read more at https://www.tenable.com/plugins/nessus/302693

]]> <![CDATA[EulerOS Virtualization 2.12.1 : net-snmp (EulerOS-SA-2026-1446)]]> https://www.tenable.com/plugins/nessus/302692 https://www.tenable.com/plugins/nessus/302692 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302692 with Critical Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the net-snmp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash. This issue has been patched in versions 5.9.5 and 5.10.pre2.(CVE-2025-68615)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization net-snmp security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected net-snmp packages.

Read more at https://www.tenable.com/plugins/nessus/302692

]]> <![CDATA[EulerOS 2.0 SP11 : haproxy (EulerOS-SA-2026-1580)]]> https://www.tenable.com/plugins/nessus/302691 https://www.tenable.com/plugins/nessus/302691 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302691 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.(CVE-2025-11230)

Tenable has extracted the preceding description block directly from the EulerOS haproxy security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected haproxy packages.

Read more at https://www.tenable.com/plugins/nessus/302691

]]> <![CDATA[EulerOS Virtualization 2.12.0 : gnupg2 (EulerOS-SA-2026-1484)]]> https://www.tenable.com/plugins/nessus/302690 https://www.tenable.com/plugins/nessus/302690 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302690 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the gnupg2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)(CVE-2025-68973)

 In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a 'verification DoS.'(CVE-2025-30258)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization gnupg2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected gnupg2 packages.

Read more at https://www.tenable.com/plugins/nessus/302690

]]> <![CDATA[EulerOS 2.0 SP11 : aide (EulerOS-SA-2026-1569)]]> https://www.tenable.com/plugins/nessus/302689 https://www.tenable.com/plugins/nessus/302689 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302689 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the aide package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized. This issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to stderr to a regular file.(CVE-2025-54389)

 AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.(CVE-2025-54409)

Tenable has extracted the preceding description block directly from the EulerOS aide security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected aide packages.

Read more at https://www.tenable.com/plugins/nessus/302689

]]> <![CDATA[EulerOS Virtualization 2.12.0 : kernel (EulerOS-SA-2026-1490)]]> https://www.tenable.com/plugins/nessus/302688 https://www.tenable.com/plugins/nessus/302688 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302688 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-cork.(CVE-2025-39913)

 md: fix rcu protection in md_wakeup_thread(CVE-2025-68374)

 usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer(CVE-2025-68331)

 fs: dlm: fix invalid derefence of sb_lvbptr(CVE-2022-50516)

 net: atlantic: fix fragment overflow handling in RX path(CVE-2025-68301)

 netfilter: nf_reject: don't leak dst refcount for loopback packets(CVE-2025-38732)

 net: ipv6: fix field-spanning memcpy warning in AH output(CVE-2025-40363)

 net/mlx5e: Remove skb secpath if xfrm state is not found(CVE-2025-38590)

 fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

 Squashfs: fix uninit-value in squashfs_get_parent(CVE-2025-40049)

 scsi: lpfc: Fix buffer free/clear order in deferred receive path(CVE-2025-39841)

 media: imon: make send_packet() more robust(CVE-2025-68194)

 libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

 pid: Add a judgment for ns null in pid_nr_ns(CVE-2025-40178)

 scsi: qla2xxx: Clear cmds after chip reset(CVE-2025-68745)

 ACPI: video: Fix use-after-free in acpi_video_switch_brightness()(CVE-2025-40211)

 tty: n_gsm: fix deadlock and link starvation in outgoing data path(CVE-2022-50116)

 nexthop: Forbid FDB status change while nexthop is in a group(CVE-2025-39980)

 icmp6: Fix null-ptr-deref of ip6_null_entry-rt6i_idev in icmp6_dev().(CVE-2023-53343)

 i40e: remove read access to debugfs files(CVE-2025-39901)

 raw: Fix NULL deref in raw_get_next().(CVE-2023-53198)

 NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid(CVE-2025-68349)

 sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto(CVE-2025-40281)

 RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device(CVE-2023-53393)

 netfilter: nft_objref: validate objref and objrefmap expressions(CVE-2025-40206)

 cifs: fix session state check in reconnect to avoid use-after-free issue(CVE-2023-53794)

 cifs: parse_dfs_referrals: prevent oob on malformed input(CVE-2025-40099)

 crypto: af_alg - Set merge to zero early in af_alg_sendmsg(CVE-2025-39931)

 nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.(CVE-2025-38400)

 fs: Prevent file descriptor table allocations exceeding INT_MAX(CVE-2025-39756)

 mtd: core: fix possible resource leak in init_mtd()(CVE-2022-50304)

 ipv4: start using dst_dev_rcu()(CVE-2025-40074)

 bpf: Reject narrower access to pointer ctx fields(CVE-2025-38591)

 RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()(CVE-2023-53335)

 bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}(CVE-2025-40183)

 Squashfs: reject negative file sizes in squashfs_read_inode()(CVE-2025-40200)

 nvme-multipath: fix lockdep WARN due to partition scan work(CVE-2025-68218)

 fbdev: fix potential buffer overflow in do_register_framebuffer()(CVE-2025-38702)

 PCI/AER: Fix NULL pointer access by aer_info(CVE-2025-68309)

 x86/apic: Don't disable x2APIC if locked(CVE-2022-50720)

 netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm(CVE-2025-39894)

 fuse: fix livelock in synchronous file put from fuseblk workers(CVE-2025-40220)

 md/raid1: Fix stack memory use after return in raid1_reshape(CVE-2025-38445)

 iommu/amd: Avoid stack buffer overflow from kernel cmdline(CVE-2025-38676)

 ext4: fix off-by-one errors in fast-commit block filling(CVE-2022-50428)

 Squashfs: check return result of sb_min_blocksize(CVE-2025-38415)

 ext4: refresh inline data size before write operations(CVE-2025-68264)

 bpf: Sync pending IRQ work before freeing ring buffer(CVE-2025-40319)

 block: avoid possible overflow for chunk_sectors check in blk_stack_limits()(CVE-2025-39795)

 xfrm: Zero padding when dumping algos and encap(CVE-2023-53684)

 crypto: hisilicon/qm - request reserved interrupt for virtual function(CVE-2025-40136)

 scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()(CVE-2025-68229)

 nbd: defer config unlock in nbd_genl_connect(CVE-2025-68366)

 virtiofs: add filesystem context source name check(CVE-2025-37773)

 net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast(CVE-2025-40140)

 page_pool: always add GFP_NOWARN for ATOMIC allocations(CVE-2025-68321)

 i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path(CVE-2025-39911)

 drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE(CVE-2025-40277)

 qed: allow sleep in qed_mcp_trace_dump()(CVE-2023-53509)

 IB/mad: Don't call to function that might sleep while in atomic context(CVE-2022-50472)

 net: openvswitch: remove never-working support for setting nsh fields(CVE-2025-40254)

 md/raid0, raid10: Don't set discard sectors for request queue(CVE-2022-50583)

 futex: Don't leak robust_list pointer on exec race(CVE-2025-40341)

 x86/MCE: Always save CS register on AMD Zen IF Poison errors(CVE-2023-53438)

 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item(CVE-2025-68211)

 tcp_metrics: use dst_dev_net_rcu()(CVE-2025-40075)

 net/ip6_tunnel: Prevent perpetual tunnel growth(CVE-2025-40173)

 fbdev: bitblit: bound-check glyph index in bit_putcs*(CVE-2025-40322)

 xfs: do not propagate ENODATA disk errors into xattr code(CVE-2025-39835)

 scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write(CVE-2023-53282)

 smb: client: fix race with concurrent opens in rename(2)(CVE-2025-39825)

 PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type(CVE-2025-23161)

 tipc: Fix use-after-free in tipc_mon_reinit_self().(CVE-2025-40280)

 usbnet: Fix using smp_processor_id() in preemptible code warnings(CVE-2025-40164)

 mm/hugetlb: fix folio is still mapped when deleted(CVE-2025-40006)

 binfmt_misc: restore write access before closing files opened by open_exec()(CVE-2025-68239)

 scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT(CVE-2022-49534)

 smb: client: Fix refcount leak for cifs_sb_tlink(CVE-2025-40103)

 KVM: x86: use array_index_nospec with indices that come from guest(CVE-2025-39823)

 bpf: Fix invalid prog-stats access when update_effective_progs fails(CVE-2025-68742)

 of: check previous kernel's ima-kexec-buffer against memory bounds(CVE-2022-50159)

 media: tuner: xc5000: Fix use-after-free in xc5000_release(CVE-2025-39994)

 i40e: fix idx validation in i40e_validate_queue_map(CVE-2025-39972)

 net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()(CVE-2025-40252)

 __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock(CVE-2025-38058)

 ipv6: prevent infinite loop in rt6_nlmsg_size()(CVE-2025-38588)

 vsock: Ignore signal/timeout on connect() if already established(CVE-2025-40248)

 cifs: fix mid leak during reconnection after timeout threshold(CVE-2023-53597)

 ixgbevf: fix mailbox API compatibility by negotiating supported features(CVE-2025-40104)

 iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()(CVE-2023-53476)

 usb: storage: sddr55: Reject out-of-bound new_pba(CVE-2025-40345)

 drm/vmwgfx: Fix Use-after-free in validation(CVE-2025-40111)

 sctp: initialize more fields in sctp_v6_from_sk()(CVE-2025-39812)

 mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race(CVE-2025-38085)

 media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()(CVE-2025-38694)

 crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id(CVE-2025-68724)

 netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed(CVE-2022-50500)

 net: bridge: fix soft lockup in br_multicast_query_expired()(CVE-2025-39773)

 cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

 blk-mq: fix NULL dereference on q-elevator in blk_mq_elv_switch_none(CVE-2023-53292)

 ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

 pinctrl: check the return value of pinmux_ops::get_function_name()(CVE-2025-40030)

 of: overlay: Call of_changeset_init() early(CVE-2023-53856)

 macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse(CVE-2025-68367)

 fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

 ipv6/sit: use DEV_STATS_INC() to avoid data-races(CVE-2022-50764)

 sctp: linearize cloned gso packets in sctp_rcv(CVE-2025-38718)

 timers: Fix NULL function pointer race in timer_shutdown_sync()(CVE-2025-68214)

 ARM: 9317/1: kexec: Make smp stop calls asynchronous(CVE-2023-53712)

 media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()(CVE-2025-39713)

 drm/vmwgfx: Fix a null-ptr access in the cursor snooper(CVE-2025-40110)

 sctp: Fix MAC comparison to be constant-time(CVE-2025-40204)

 scsi: st: Fix array overflow in st_setup()(CVE-2025-37857)

 ceph: fix potential use-after-free bug when trimming caps(CVE-2023-53867)

 sctp: avoid NULL dereference when chunk data buffer is missing(CVE-2025-40240)

 x86/fpu: Ensure XFD state on signal delivery(CVE-2025-68171)

 mm/compaction: fix UBSAN shift-out-of-bounds warning(CVE-2025-21815)

 netfilter: xt_nfacct: don't assume acct name is null-terminated(CVE-2025-38639)

 usb: typec: ucsi: displayport: Fix NULL pointer access(CVE-2025-37994)

 NFSD: free copynotify stateid in nfs4_free_ol_stateid()(CVE-2025-40273)

 RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction(CVE-2025-38161)

 scsi: target: Fix multiple LUN_RESET handling(CVE-2023-53586)

 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr(CVE-2025-68183)

 bpf: Add preempt_count_{sub,add} into btf id deny list(CVE-2023-54086)

 tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().(CVE-2025-40186)

 bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls(CVE-2025-38608)

 smb: client: fix memory leak in cifs_construct_tcon()(CVE-2025-68295)

 bpf: Fix stackmap overflow check in __bpf_get_stackid()(CVE-2025-68378)

 usb: early: xhci-dbc: Fix a potential out-of-bound memory access(CVE-2023-53840)

 scsi: libiscsi: Initialize iscsi_conn-dd_data only if memory is allocated(CVE-2025-38700)

 usbnet: Prevents free active kevent(CVE-2025-68312)

 media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove(CVE-2025-39996)

 xfrm: delete x-tunnel as we delete x(CVE-2025-40215)

 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()(CVE-2025-40346)

 eventpoll: Fix semi-unbounded recursion(CVE-2025-38614)

 smb3: fix for slab out of bounds on mount to ksmbd(CVE-2025-38728)

 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()(CVE-2025-38724)

 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()(CVE-2025-68188)

 software node: Correct a OOB check in software_node_get_reference_args()(CVE-2025-38342)

 jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted(CVE-2025-68337)

 be2net: pass wrb_params in case of OS2BMC be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site.(CVE-2025-40264)

 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request(CVE-2025-38430)

 net: dlink: handle copy_thresh allocation failure(CVE-2025-40053)

 net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer(CVE-2025-39937)

 nfs4_setup_readdir(): insufficient locking for -d_parent-d_inode dereferencing(CVE-2025-68185)

 dm-stripe: fix a possible integer overflow(CVE-2025-39940)

 netfilter: ctnetlink: fix refcount leak on table dump(CVE-2025-38721)

 RDMA/rxe: Fix null deref on srq-rq.queue after resize failure(CVE-2025-68379)

 usb: typec: ucsi: displayport: Fix deadlock(CVE-2025-37967)

 netdevsim: fix memory leak in nsim_bus_dev_new()(CVE-2022-50772)

 ceph: fix race condition validating r_parent before applying state(CVE-2025-39927)

 bnxt_en: Fix memory corruption when FW resources change during ifdown(CVE-2025-39810)

 virtio_net: Fix error unwinding of XDP initialization(CVE-2023-53499)

 virtio: break and reset virtio devices on device_shutdown()(CVE-2025-38064)

 NFS: Fix a race when updating an existing write(CVE-2025-39697)

 nvme-fc: use lock accessing port_state and rport state(CVE-2025-40342)

 net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM(CVE-2025-39770)

 NFSD: fix race between nfsd registration and exports_proc(CVE-2025-38232)

 net: netpoll: fix incorrect refcount handling causing incorrect cleanup(CVE-2025-68245)

 bpf: Fix issue in verifying allow_ptr_leaks(CVE-2023-54181)

 cifs: Fix connections leak when tlink setup failed(CVE-2022-49822)

 cifs: avoid NULL pointer dereference in dbg call(CVE-2025-37844)

 objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()(CVE-2025-37937)

 bpf: Explicitly check accesses to bpf_sock_addr(CVE-2025-40078)

 nvmet-fc: avoid scheduling association deletion twice(CVE-2025-40343)

 md/raid1,raid10: don't ignore IO flags(CVE-2025-22125)

 KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT(CVE-2022-50224)

 vfio/type1: prevent underflow of locked_vm via exec()(CVE-2023-53171)

 RDMA/bnxt_re: Prevent handling any completions after qp destroy(CVE-2023-54048)

 ipv6: fix possible infinite loop in fib6_info_uses_dev()(CVE-2025-38587)

 mm: hugetlb: avoid soft lockup when mprotect to large memory area(CVE-2025-40153)

 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup(CVE-2025-68192)

 tcp: Clear tcp_sk(sk)-fastopen_rsk in tcp_disconnect().(CVE-2025-39955)

 udp_tunnel: use netdev_warn() instead of netdev_WARN()(CVE-2025-68191)

 mm/vmscan: don't try to reclaim hwpoison folio(CVE-2025-37834)

 ima: Handle error code returned by ima_filter_rule_match()(CVE-2025-68740)

 bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log(CVE-2023-54145)

 net/mlx5e: Move representor neigh cleanup to profile cleanup_tx(CVE-2023-54148)

 dma-buf: insert memory barrier before updating num_fences(CVE-2025-38095)

 bpf: Do not let BPF test infra emit invalid GSO types to stack(CVE-2025-68725)

 ext4: guard against EA inode refcount underflow in xattr update(CVE-2025-40190)

 iavf: use internal state to free traffic IRQs(CVE-2023-53850)

 genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie(CVE-2025-38062)

 mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list(CVE-2025-39725)

 nbd: restrict sockets to TCP and UDP(CVE-2025-40080)

 crypto: hisilicon/qm - set NULL to qm-debug.qm_diff_regs(CVE-2025-40062)

 libceph: replace BUG_ON with bounds check for map-max_osd(CVE-2025-68283)

 ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe(CVE-2025-68241)

 net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()(CVE-2025-40187)

 fbcon: Set fb_display[i]-mode to NULL when the mode is released(CVE-2025-40323)

 net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error(CVE-2025-21924)

 HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()(CVE-2025-39808)

 ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()(CVE-2025-68261)

 ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()(CVE-2025-40198)

 scsi: sg: Do not sleep in atomic context(CVE-2025-40259)

 drm/scheduler: fix fence ref counting(CVE-2022-49829)

 nvmet-fc: move lsop put work to nvmet_fc_ls_req_op(CVE-2025-40171)

 PCI: Fix reference leak in pci_register_host_bridge()(CVE-2025-37836)

 scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

 Drivers: hv: vmbus: Don't dereference ACPI root object handle(CVE-2023-53647)

 tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().(CVE-2025-40149)

 NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()(CVE-2025-39730)

 vxlan: Annotate FDB data races(CVE-2025-38037)

 iio: common: st_sensors: Fix use of uninitialize device structs(CVE-2025-38531)

 usb: storage: Fix memory leak in USB bulk transport(CVE-2025-68288)

 cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()(CVE-2025-40194)

 cifs: prevent NULL pointer dereference in UTF16 conversion(CVE-2025-39838)

 scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

 netfilter: nft_ct: add seqadj extension for natted connections(CVE-2025-68206)

 mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

 regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex(CVE-2025-68354)

 bpf: Enforce expected_attach_type for tailcall compatibility(CVE-2025-40123)

 media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID(CVE-2025-40016)

 scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

 block: fix resource leak in blk_register_queue() error path(CVE-2025-37980)

 blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx(CVE-2025-40125)

 NFSD: Fix crash in nfsd4_read_release()(CVE-2025-40324)

 RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug(CVE-2025-38024)

 vsock: Fix transport_* TOCTOU(CVE-2025-38461)

 net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree(CVE-2025-38468)

 e1000: fix OOB in e1000_tbi_should_accept()(CVE-2025-71093)

 mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats(CVE-2025-68800)

 iavf: Fix reset error handling(CVE-2022-50053)

 net/mlx5: Handle pairing of E-switch via uplink un/load APIs(CVE-2023-53347)

 vsock: Fix transport_{g2h,h2g} TOCTOU(CVE-2025-38462)

 x86/fpu: Drop fpregs lock before inheriting FPU permissions(CVE-2022-49783)

 fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds(CVE-2025-40304)

 net: phy: mscc: Fix memory leak when using one step timestamping(CVE-2025-38148)

 RDMA/hns: Fix double destruction of rsv_qp(CVE-2025-38582)

 mlxsw: spectrum_router: Fix neighbour use-after-free(CVE-2025-68801)

 net_sched: sch_sfq: reject invalid perturb period(CVE-2025-38193)

 iavf: fix off-by-one issues in iavf_config_rss_reg()(CVE-2025-71087)

 RDMA/rxe: Fix incomplete state save in rxe_requester(CVE-2023-53539)

 net: drop UFO packets in udp_rcv_segment()(CVE-2025-38622)

 A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.(CVE-2024-36357)

 x86/mce: Work around an erratum on fast string copy instructions(CVE-2022-49124)

 scsi: qla2xxx: Implement ref count for SRB(CVE-2022-49159)

 rcu: Fix rcu_read_unlock() deadloop due to IRQ work(CVE-2025-39744)

 jbd2: prevent softlockup in jbd2_log_do_checkpoint()(CVE-2025-39782)

 drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED(CVE-2022-50390)

 crypto: essiv - Check ssize for decryption and in-place encryption(CVE-2025-40019)

 media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar(CVE-2025-38693)

 rcu: Protect -defer_qs_iw_pending from data race(CVE-2025-39749)

 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit(CVE-2025-38685)

 media: rc: fix races with imon_disconnect()(CVE-2025-39993)

 mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()(CVE-2023-53401)

 scsi: lpfc: Use memcpy() for BIOS version(CVE-2025-38332)

 usb: core: config: Prevent OOB read in SS endpoint companion parsing(CVE-2025-39760)

 scsi: qla2xxx: Fix premature hw access after PCI error(CVE-2022-49157)

 fbcon: fix integer overflow in fbcon_do_set_font(CVE-2025-39967)

 scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

 mm: fix uprobe pte be overwritten when expanding vma(CVE-2025-38207)

 scsi: qla2xxx: Fix crash when I/O abort times out(CVE-2022-50493)

 media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()(CVE-2025-38680)

 scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()(CVE-2023-53530)

 fs/buffer: fix use-after-free when call bh_read() helper(CVE-2025-39691)

 HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras(CVE-2025-38540)

 mmc: rtsx_pci: fix return value check of mmc_add_host()(CVE-2022-50267)

 RDMA/mlx5: Initialize obj_event-obj_sub_list before xa_insert(CVE-2025-38387)

 i40e: fix validation of VF state in get resources(CVE-2025-39969)

 vxlan: Fix NPD when refreshing an FDB entry with a nexthop object(CVE-2025-39851)

 tracing: Limit access to parser-buffer when trace_get_user failed(CVE-2025-39683)

 firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle(CVE-2023-53250)

 perf: arm_spe: Prevent overflow in PERF_IDX2OFF()(CVE-2025-40081)

 ARM: rockchip: fix kernel hang during smp initialization(CVE-2025-39752)

 x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper(CVE-2025-39681)

 i40e: Fix potential invalid access when MAC list is empty(CVE-2025-39853)

 drm/dp_mst: Fix MST sideband message body length check(CVE-2024-56616)

 vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint(CVE-2025-22083)

 bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT(CVE-2025-38439)

 tracing: Fix race condition in kprobe initialization causing NULL pointer dereference(CVE-2025-40042)

 PCI/ASPM: Fix link state exit during switch upstream function removal(CVE-2024-58093)

 ext4: detect invalid INLINE_DATA + EXTENTS flag combination(CVE-2025-40167)

 scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()(CVE-2023-53696)

 qed: Don't collect too many protection override GRC elements(CVE-2025-39949)

 partitions: mac: fix handling of bogus partition table(CVE-2025-21772)

 usb: xhci: Apply the link chain quirk on NEC isoc endpoints(CVE-2025-22022)

 start_kernel: Add __no_stack_protector function attribute(CVE-2023-53491)

 isofs: Prevent the use of too small fid(CVE-2025-37780)

 crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg(CVE-2025-39964)

 acpi: nfit: fix narrowing conversion in acpi_nfit_ctl(CVE-2025-22044)

 KVM: x86: Reset IRTE to host control if *new* route isn't postable(CVE-2025-37885)

 i40e: fix MMIO write access to an invalid page in i40e_clear_hw(CVE-2025-38200)

 net/sched: sch_qfq: Fix null-deref in agg_dequeue(CVE-2025-40083)

 net/sched: sch_qfq: Fix race condition on qfq_aggregate(CVE-2025-38477)

 KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O(CVE-2025-40026)

 fs: udf: fix OOB read in lengthAllocDescs handling(CVE-2025-40044)

 x86/vmscape: Add conditional IBPB mitigation(CVE-2025-40300)

 ppp: fix memory leak in pad_compress_skb(CVE-2025-39847)

 benet: fix BUG when creating VFs(CVE-2025-38569)

 uio_hv_generic: Let userspace take care of interrupt mask(CVE-2025-40048)

 HID: ignore non-functional sensor in HP 5MP Camera(CVE-2025-21992)

 Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of privilege local access(CVE-2024-21823)

 cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

 usb: net: sierra: check for no status endpoint(CVE-2025-38474)

 NFSD: Define a proc_layoutcommit for the FlexFiles layout type(CVE-2025-40087)

 vfs: Don't leak disconnected dentries on umount(CVE-2025-40105)

 netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX(CVE-2025-38201)

 firewire: net: fix use after free in fwnet_finish_incoming_packet()(CVE-2023-53432)

 serial: 8250: fix panic due to PSLVERR(CVE-2025-39724)

 HID: core: Harden s32ton() against conversion to 0 bits(CVE-2025-38556)

 tracing: dynevent: Add a missing lockdown check on dynevent(CVE-2025-40021)

 NFS: Fix the setting of capabilities when automounting a new filesystem(CVE-2025-39798)

 RDMA/core: Fix 'KASAN: slab-use-after-free Read in ib_register_device' problem(CVE-2025-38022)

 hv_netvsc: Fix panic during namespace deletion with VF(CVE-2025-38683)

 mm/slub: avoid accessing metadata when pointer is invalid in object_err()(CVE-2025-39902)

 calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().(CVE-2025-38181)

 crypto: rng - Ensure set_ent is always present(CVE-2025-40109)

 ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr(CVE-2025-38701)

 RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()(CVE-2025-39742)

 ice: Fix a null pointer dereference in ice_copy_and_init_pkg()(CVE-2025-38664)

 netfilter: nf_tables: reject duplicate device on updates(CVE-2025-38678)

 ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

 vsock: Do not allow binding to VMADDR_PORT_ANY(CVE-2025-38618)

 efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

 blk-mq: avoid double -queue_rq() because of early timeout(CVE-2022-50554)

 i40e: add max boundary check for VF filters(CVE-2025-39968)

 net/packet: fix a race in packet_set_ring() and packet_notifier()(CVE-2025-38617)

 xfrm: Duplicate SPI Handling(CVE-2025-39797)

 loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

 scsi: target: Fix WRITE_SAME No Data Buffer crash(CVE-2022-21546)

 ftrace: Fix potential warning in trace_printk_seq during ftrace_dump(CVE-2025-39813)

 cgroup: split cgroup_destroy_wq into 3 workqueues(CVE-2025-39953)

 ext4: fix potential out of bound read in ext4_fc_replay_scan()(CVE-2022-50306)

 padata: Fix pd UAF once and for all(CVE-2025-38584)

 i40e: add validation for ring_len param(CVE-2025-39973)

 mm: fix zswap writeback race condition(CVE-2023-53178)

 bnxt: avoid overflow in bnxt_get_nvram_directory()(CVE-2023-53661)

 tracing: Fix reading strings from synthetic events(CVE-2022-50255)

 trace/fgraph: Fix the warning caused by missing unregister notifier(CVE-2025-39829)

 tee: fix NULL pointer dereference in tee_shm_put(CVE-2025-39865)

 scsi: qla2xxx: Fix warning message due to adisc being flushed(CVE-2022-49158)

 thunderbolt: Do not double dequeue a configuration request(CVE-2025-38174)

 pNFS: Fix uninited ptr deref in block/scsi layout(CVE-2025-38691)

 i40e: fix idx validation in config queues msg(CVE-2025-39971)

 ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

 net/sched: Restrict conditions for adding duplicating netems to qdisc tree(CVE-2025-38553)

 bpf: Fix oob access in cgroup local storage(CVE-2025-38502)

 vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects(CVE-2025-39850)

 cnic: Fix use-after-free bugs in cnic_delete_task(CVE-2025-39945)

 i40e: fix input validation logic for action_meta(CVE-2025-39970)

 drm/sched: Increment job count before swapping tail spsc queue(CVE-2025-38515)

 tracing: Add down_write(trace_event_sem) when adding trace event(CVE-2025-38539)

 tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer(CVE-2025-38184)

 pinmux: fix r ...

 Please note that the description has been truncated due to length. Please refer to vendor advisory for the full description.

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel packages.

Read more at https://www.tenable.com/plugins/nessus/302688

]]> <![CDATA[EulerOS Virtualization 2.12.1 : libxml2 (EulerOS-SA-2026-1442)]]> https://www.tenable.com/plugins/nessus/302687 https://www.tenable.com/plugins/nessus/302687 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302687 with Low Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files.
 When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.(CVE-2025-6170)

 A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.(CVE-2025-6021)

 A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the sch:name path='...'/ schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.(CVE-2025-49794)

 A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.(CVE-2025-49796)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libxml2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libxml2 packages.

Read more at https://www.tenable.com/plugins/nessus/302687

]]> <![CDATA[EulerOS Virtualization 2.12.1 : icu (EulerOS-SA-2026-1431)]]> https://www.tenable.com/plugins/nessus/302686 https://www.tenable.com/plugins/nessus/302686 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302686 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the icu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.(CVE-2025-5222)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization icu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected icu packages.

Read more at https://www.tenable.com/plugins/nessus/302686

]]> <![CDATA[EulerOS Virtualization 2.12.1 : binutils (EulerOS-SA-2026-1418)]]> https://www.tenable.com/plugins/nessus/302685 https://www.tenable.com/plugins/nessus/302685 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302685 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is named 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944. It is recommended to apply a patch to fix this issue.(CVE-2025-7545)

 A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.45 is able to address this issue. It is recommended to upgrade the affected component.(CVE-2025-5244)

 A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. It is recommended to apply a patch to fix this issue.(CVE-2025-3198)

 A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of the component objdump. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.(CVE-2025-5245)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization binutils security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected binutils packages.

Read more at https://www.tenable.com/plugins/nessus/302685

]]> <![CDATA[EulerOS Virtualization 2.12.1 : kernel (EulerOS-SA-2026-1433)]]> https://www.tenable.com/plugins/nessus/302684 https://www.tenable.com/plugins/nessus/302684 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302684 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-cork.(CVE-2025-39913)

 md: fix rcu protection in md_wakeup_thread(CVE-2025-68374)

 usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer(CVE-2025-68331)

 fs: dlm: fix invalid derefence of sb_lvbptr(CVE-2022-50516)

 net: atlantic: fix fragment overflow handling in RX path(CVE-2025-68301)

 netfilter: nf_reject: don't leak dst refcount for loopback packets(CVE-2025-38732)

 net: ipv6: fix field-spanning memcpy warning in AH output(CVE-2025-40363)

 net/mlx5e: Remove skb secpath if xfrm state is not found(CVE-2025-38590)

 fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

 Squashfs: fix uninit-value in squashfs_get_parent(CVE-2025-40049)

 scsi: lpfc: Fix buffer free/clear order in deferred receive path(CVE-2025-39841)

 media: imon: make send_packet() more robust(CVE-2025-68194)

 libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

 pid: Add a judgment for ns null in pid_nr_ns(CVE-2025-40178)

 scsi: qla2xxx: Clear cmds after chip reset(CVE-2025-68745)

 ACPI: video: Fix use-after-free in acpi_video_switch_brightness()(CVE-2025-40211)

 tty: n_gsm: fix deadlock and link starvation in outgoing data path(CVE-2022-50116)

 nexthop: Forbid FDB status change while nexthop is in a group(CVE-2025-39980)

 icmp6: Fix null-ptr-deref of ip6_null_entry-rt6i_idev in icmp6_dev().(CVE-2023-53343)

 i40e: remove read access to debugfs files(CVE-2025-39901)

 raw: Fix NULL deref in raw_get_next().(CVE-2023-53198)

 NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid(CVE-2025-68349)

 sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto(CVE-2025-40281)

 RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device(CVE-2023-53393)

 netfilter: nft_objref: validate objref and objrefmap expressions(CVE-2025-40206)

 cifs: fix session state check in reconnect to avoid use-after-free issue(CVE-2023-53794)

 cifs: parse_dfs_referrals: prevent oob on malformed input(CVE-2025-40099)

 crypto: af_alg - Set merge to zero early in af_alg_sendmsg(CVE-2025-39931)

 nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.(CVE-2025-38400)

 fs: Prevent file descriptor table allocations exceeding INT_MAX(CVE-2025-39756)

 mtd: core: fix possible resource leak in init_mtd()(CVE-2022-50304)

 ipv4: start using dst_dev_rcu()(CVE-2025-40074)

 bpf: Reject narrower access to pointer ctx fields(CVE-2025-38591)

 RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()(CVE-2023-53335)

 bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}(CVE-2025-40183)

 Squashfs: reject negative file sizes in squashfs_read_inode()(CVE-2025-40200)

 nvme-multipath: fix lockdep WARN due to partition scan work(CVE-2025-68218)

 fbdev: fix potential buffer overflow in do_register_framebuffer()(CVE-2025-38702)

 PCI/AER: Fix NULL pointer access by aer_info(CVE-2025-68309)

 x86/apic: Don't disable x2APIC if locked(CVE-2022-50720)

 netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm(CVE-2025-39894)

 fuse: fix livelock in synchronous file put from fuseblk workers(CVE-2025-40220)

 md/raid1: Fix stack memory use after return in raid1_reshape(CVE-2025-38445)

 iommu/amd: Avoid stack buffer overflow from kernel cmdline(CVE-2025-38676)

 ext4: fix off-by-one errors in fast-commit block filling(CVE-2022-50428)

 Squashfs: check return result of sb_min_blocksize(CVE-2025-38415)

 ext4: refresh inline data size before write operations(CVE-2025-68264)

 bpf: Sync pending IRQ work before freeing ring buffer(CVE-2025-40319)

 block: avoid possible overflow for chunk_sectors check in blk_stack_limits()(CVE-2025-39795)

 xfrm: Zero padding when dumping algos and encap(CVE-2023-53684)

 crypto: hisilicon/qm - request reserved interrupt for virtual function(CVE-2025-40136)

 scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()(CVE-2025-68229)

 nbd: defer config unlock in nbd_genl_connect(CVE-2025-68366)

 virtiofs: add filesystem context source name check(CVE-2025-37773)

 net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast(CVE-2025-40140)

 page_pool: always add GFP_NOWARN for ATOMIC allocations(CVE-2025-68321)

 i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path(CVE-2025-39911)

 drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE(CVE-2025-40277)

 qed: allow sleep in qed_mcp_trace_dump()(CVE-2023-53509)

 IB/mad: Don't call to function that might sleep while in atomic context(CVE-2022-50472)

 net: openvswitch: remove never-working support for setting nsh fields(CVE-2025-40254)

 md/raid0, raid10: Don't set discard sectors for request queue(CVE-2022-50583)

 futex: Don't leak robust_list pointer on exec race(CVE-2025-40341)

 x86/MCE: Always save CS register on AMD Zen IF Poison errors(CVE-2023-53438)

 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item(CVE-2025-68211)

 tcp_metrics: use dst_dev_net_rcu()(CVE-2025-40075)

 net/ip6_tunnel: Prevent perpetual tunnel growth(CVE-2025-40173)

 fbdev: bitblit: bound-check glyph index in bit_putcs*(CVE-2025-40322)

 xfs: do not propagate ENODATA disk errors into xattr code(CVE-2025-39835)

 scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write(CVE-2023-53282)

 smb: client: fix race with concurrent opens in rename(2)(CVE-2025-39825)

 PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type(CVE-2025-23161)

 tipc: Fix use-after-free in tipc_mon_reinit_self().(CVE-2025-40280)

 usbnet: Fix using smp_processor_id() in preemptible code warnings(CVE-2025-40164)

 mm/hugetlb: fix folio is still mapped when deleted(CVE-2025-40006)

 binfmt_misc: restore write access before closing files opened by open_exec()(CVE-2025-68239)

 scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT(CVE-2022-49534)

 smb: client: Fix refcount leak for cifs_sb_tlink(CVE-2025-40103)

 KVM: x86: use array_index_nospec with indices that come from guest(CVE-2025-39823)

 bpf: Fix invalid prog-stats access when update_effective_progs fails(CVE-2025-68742)

 of: check previous kernel's ima-kexec-buffer against memory bounds(CVE-2022-50159)

 media: tuner: xc5000: Fix use-after-free in xc5000_release(CVE-2025-39994)

 i40e: fix idx validation in i40e_validate_queue_map(CVE-2025-39972)

 net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()(CVE-2025-40252)

 __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock(CVE-2025-38058)

 ipv6: prevent infinite loop in rt6_nlmsg_size()(CVE-2025-38588)

 vsock: Ignore signal/timeout on connect() if already established(CVE-2025-40248)

 cifs: fix mid leak during reconnection after timeout threshold(CVE-2023-53597)

 ixgbevf: fix mailbox API compatibility by negotiating supported features(CVE-2025-40104)

 iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()(CVE-2023-53476)

 usb: storage: sddr55: Reject out-of-bound new_pba(CVE-2025-40345)

 drm/vmwgfx: Fix Use-after-free in validation(CVE-2025-40111)

 sctp: initialize more fields in sctp_v6_from_sk()(CVE-2025-39812)

 mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race(CVE-2025-38085)

 media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()(CVE-2025-38694)

 crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id(CVE-2025-68724)

 netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed(CVE-2022-50500)

 net: bridge: fix soft lockup in br_multicast_query_expired()(CVE-2025-39773)

 cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

 blk-mq: fix NULL dereference on q-elevator in blk_mq_elv_switch_none(CVE-2023-53292)

 ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

 pinctrl: check the return value of pinmux_ops::get_function_name()(CVE-2025-40030)

 of: overlay: Call of_changeset_init() early(CVE-2023-53856)

 macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse(CVE-2025-68367)

 fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

 ipv6/sit: use DEV_STATS_INC() to avoid data-races(CVE-2022-50764)

 sctp: linearize cloned gso packets in sctp_rcv(CVE-2025-38718)

 timers: Fix NULL function pointer race in timer_shutdown_sync()(CVE-2025-68214)

 ARM: 9317/1: kexec: Make smp stop calls asynchronous(CVE-2023-53712)

 media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()(CVE-2025-39713)

 drm/vmwgfx: Fix a null-ptr access in the cursor snooper(CVE-2025-40110)

 sctp: Fix MAC comparison to be constant-time(CVE-2025-40204)

 scsi: st: Fix array overflow in st_setup()(CVE-2025-37857)

 ceph: fix potential use-after-free bug when trimming caps(CVE-2023-53867)

 sctp: avoid NULL dereference when chunk data buffer is missing(CVE-2025-40240)

 x86/fpu: Ensure XFD state on signal delivery(CVE-2025-68171)

 mm/compaction: fix UBSAN shift-out-of-bounds warning(CVE-2025-21815)

 netfilter: xt_nfacct: don't assume acct name is null-terminated(CVE-2025-38639)

 usb: typec: ucsi: displayport: Fix NULL pointer access(CVE-2025-37994)

 NFSD: free copynotify stateid in nfs4_free_ol_stateid()(CVE-2025-40273)

 RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction(CVE-2025-38161)

 scsi: target: Fix multiple LUN_RESET handling(CVE-2023-53586)

 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr(CVE-2025-68183)

 bpf: Add preempt_count_{sub,add} into btf id deny list(CVE-2023-54086)

 tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().(CVE-2025-40186)

 bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls(CVE-2025-38608)

 smb: client: fix memory leak in cifs_construct_tcon()(CVE-2025-68295)

 bpf: Fix stackmap overflow check in __bpf_get_stackid()(CVE-2025-68378)

 usb: early: xhci-dbc: Fix a potential out-of-bound memory access(CVE-2023-53840)

 scsi: libiscsi: Initialize iscsi_conn-dd_data only if memory is allocated(CVE-2025-38700)

 usbnet: Prevents free active kevent(CVE-2025-68312)

 media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove(CVE-2025-39996)

 xfrm: delete x-tunnel as we delete x(CVE-2025-40215)

 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()(CVE-2025-40346)

 eventpoll: Fix semi-unbounded recursion(CVE-2025-38614)

 smb3: fix for slab out of bounds on mount to ksmbd(CVE-2025-38728)

 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()(CVE-2025-38724)

 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()(CVE-2025-68188)

 software node: Correct a OOB check in software_node_get_reference_args()(CVE-2025-38342)

 jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted(CVE-2025-68337)

 be2net: pass wrb_params in case of OS2BMC be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site.(CVE-2025-40264)

 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request(CVE-2025-38430)

 net: dlink: handle copy_thresh allocation failure(CVE-2025-40053)

 net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer(CVE-2025-39937)

 nfs4_setup_readdir(): insufficient locking for -d_parent-d_inode dereferencing(CVE-2025-68185)

 dm-stripe: fix a possible integer overflow(CVE-2025-39940)

 netfilter: ctnetlink: fix refcount leak on table dump(CVE-2025-38721)

 RDMA/rxe: Fix null deref on srq-rq.queue after resize failure(CVE-2025-68379)

 usb: typec: ucsi: displayport: Fix deadlock(CVE-2025-37967)

 netdevsim: fix memory leak in nsim_bus_dev_new()(CVE-2022-50772)

 ceph: fix race condition validating r_parent before applying state(CVE-2025-39927)

 bnxt_en: Fix memory corruption when FW resources change during ifdown(CVE-2025-39810)

 virtio_net: Fix error unwinding of XDP initialization(CVE-2023-53499)

 virtio: break and reset virtio devices on device_shutdown()(CVE-2025-38064)

 NFS: Fix a race when updating an existing write(CVE-2025-39697)

 nvme-fc: use lock accessing port_state and rport state(CVE-2025-40342)

 net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM(CVE-2025-39770)

 NFSD: fix race between nfsd registration and exports_proc(CVE-2025-38232)

 net: netpoll: fix incorrect refcount handling causing incorrect cleanup(CVE-2025-68245)

 bpf: Fix issue in verifying allow_ptr_leaks(CVE-2023-54181)

 cifs: Fix connections leak when tlink setup failed(CVE-2022-49822)

 cifs: avoid NULL pointer dereference in dbg call(CVE-2025-37844)

 objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()(CVE-2025-37937)

 bpf: Explicitly check accesses to bpf_sock_addr(CVE-2025-40078)

 nvmet-fc: avoid scheduling association deletion twice(CVE-2025-40343)

 md/raid1,raid10: don't ignore IO flags(CVE-2025-22125)

 KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT(CVE-2022-50224)

 vfio/type1: prevent underflow of locked_vm via exec()(CVE-2023-53171)

 RDMA/bnxt_re: Prevent handling any completions after qp destroy(CVE-2023-54048)

 ipv6: fix possible infinite loop in fib6_info_uses_dev()(CVE-2025-38587)

 mm: hugetlb: avoid soft lockup when mprotect to large memory area(CVE-2025-40153)

 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup(CVE-2025-68192)

 tcp: Clear tcp_sk(sk)-fastopen_rsk in tcp_disconnect().(CVE-2025-39955)

 udp_tunnel: use netdev_warn() instead of netdev_WARN()(CVE-2025-68191)

 mm/vmscan: don't try to reclaim hwpoison folio(CVE-2025-37834)

 ima: Handle error code returned by ima_filter_rule_match()(CVE-2025-68740)

 bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log(CVE-2023-54145)

 net/mlx5e: Move representor neigh cleanup to profile cleanup_tx(CVE-2023-54148)

 dma-buf: insert memory barrier before updating num_fences(CVE-2025-38095)

 bpf: Do not let BPF test infra emit invalid GSO types to stack(CVE-2025-68725)

 ext4: guard against EA inode refcount underflow in xattr update(CVE-2025-40190)

 iavf: use internal state to free traffic IRQs(CVE-2023-53850)

 genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie(CVE-2025-38062)

 mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list(CVE-2025-39725)

 nbd: restrict sockets to TCP and UDP(CVE-2025-40080)

 crypto: hisilicon/qm - set NULL to qm-debug.qm_diff_regs(CVE-2025-40062)

 libceph: replace BUG_ON with bounds check for map-max_osd(CVE-2025-68283)

 ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe(CVE-2025-68241)

 net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()(CVE-2025-40187)

 fbcon: Set fb_display[i]-mode to NULL when the mode is released(CVE-2025-40323)

 net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error(CVE-2025-21924)

 HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()(CVE-2025-39808)

 ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()(CVE-2025-68261)

 ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()(CVE-2025-40198)

 scsi: sg: Do not sleep in atomic context(CVE-2025-40259)

 drm/scheduler: fix fence ref counting(CVE-2022-49829)

 nvmet-fc: move lsop put work to nvmet_fc_ls_req_op(CVE-2025-40171)

 PCI: Fix reference leak in pci_register_host_bridge()(CVE-2025-37836)

 scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

 Drivers: hv: vmbus: Don't dereference ACPI root object handle(CVE-2023-53647)

 tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().(CVE-2025-40149)

 NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()(CVE-2025-39730)

 vxlan: Annotate FDB data races(CVE-2025-38037)

 iio: common: st_sensors: Fix use of uninitialize device structs(CVE-2025-38531)

 usb: storage: Fix memory leak in USB bulk transport(CVE-2025-68288)

 cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()(CVE-2025-40194)

 cifs: prevent NULL pointer dereference in UTF16 conversion(CVE-2025-39838)

 scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

 netfilter: nft_ct: add seqadj extension for natted connections(CVE-2025-68206)

 mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

 regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex(CVE-2025-68354)

 bpf: Enforce expected_attach_type for tailcall compatibility(CVE-2025-40123)

 media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID(CVE-2025-40016)

 scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

 block: fix resource leak in blk_register_queue() error path(CVE-2025-37980)

 blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx(CVE-2025-40125)

 NFSD: Fix crash in nfsd4_read_release()(CVE-2025-40324)

 RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug(CVE-2025-38024)

 vsock: Fix transport_* TOCTOU(CVE-2025-38461)

 net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree(CVE-2025-38468)

 e1000: fix OOB in e1000_tbi_should_accept()(CVE-2025-71093)

 mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats(CVE-2025-68800)

 iavf: Fix reset error handling(CVE-2022-50053)

 net/mlx5: Handle pairing of E-switch via uplink un/load APIs(CVE-2023-53347)

 vsock: Fix transport_{g2h,h2g} TOCTOU(CVE-2025-38462)

 x86/fpu: Drop fpregs lock before inheriting FPU permissions(CVE-2022-49783)

 fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds(CVE-2025-40304)

 net: phy: mscc: Fix memory leak when using one step timestamping(CVE-2025-38148)

 RDMA/hns: Fix double destruction of rsv_qp(CVE-2025-38582)

 mlxsw: spectrum_router: Fix neighbour use-after-free(CVE-2025-68801)

 net_sched: sch_sfq: reject invalid perturb period(CVE-2025-38193)

 iavf: fix off-by-one issues in iavf_config_rss_reg()(CVE-2025-71087)

 RDMA/rxe: Fix incomplete state save in rxe_requester(CVE-2023-53539)

 net: drop UFO packets in udp_rcv_segment()(CVE-2025-38622)

 A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.(CVE-2024-36357)

 x86/mce: Work around an erratum on fast string copy instructions(CVE-2022-49124)

 scsi: qla2xxx: Implement ref count for SRB(CVE-2022-49159)

 rcu: Fix rcu_read_unlock() deadloop due to IRQ work(CVE-2025-39744)

 jbd2: prevent softlockup in jbd2_log_do_checkpoint()(CVE-2025-39782)

 drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED(CVE-2022-50390)

 crypto: essiv - Check ssize for decryption and in-place encryption(CVE-2025-40019)

 media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar(CVE-2025-38693)

 rcu: Protect -defer_qs_iw_pending from data race(CVE-2025-39749)

 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit(CVE-2025-38685)

 media: rc: fix races with imon_disconnect()(CVE-2025-39993)

 mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()(CVE-2023-53401)

 scsi: lpfc: Use memcpy() for BIOS version(CVE-2025-38332)

 usb: core: config: Prevent OOB read in SS endpoint companion parsing(CVE-2025-39760)

 scsi: qla2xxx: Fix premature hw access after PCI error(CVE-2022-49157)

 fbcon: fix integer overflow in fbcon_do_set_font(CVE-2025-39967)

 scsi: target: iscsi: Fix a race condition between login_work and the login thread(CVE-2022-50350)

 mm: fix uprobe pte be overwritten when expanding vma(CVE-2025-38207)

 scsi: qla2xxx: Fix crash when I/O abort times out(CVE-2022-50493)

 media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format()(CVE-2025-38680)

 scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()(CVE-2023-53530)

 fs/buffer: fix use-after-free when call bh_read() helper(CVE-2025-39691)

 HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras(CVE-2025-38540)

 mmc: rtsx_pci: fix return value check of mmc_add_host()(CVE-2022-50267)

 RDMA/mlx5: Initialize obj_event-obj_sub_list before xa_insert(CVE-2025-38387)

 i40e: fix validation of VF state in get resources(CVE-2025-39969)

 vxlan: Fix NPD when refreshing an FDB entry with a nexthop object(CVE-2025-39851)

 tracing: Limit access to parser-buffer when trace_get_user failed(CVE-2025-39683)

 firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle(CVE-2023-53250)

 perf: arm_spe: Prevent overflow in PERF_IDX2OFF()(CVE-2025-40081)

 ARM: rockchip: fix kernel hang during smp initialization(CVE-2025-39752)

 x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper(CVE-2025-39681)

 i40e: Fix potential invalid access when MAC list is empty(CVE-2025-39853)

 drm/dp_mst: Fix MST sideband message body length check(CVE-2024-56616)

 vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint(CVE-2025-22083)

 bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT(CVE-2025-38439)

 tracing: Fix race condition in kprobe initialization causing NULL pointer dereference(CVE-2025-40042)

 PCI/ASPM: Fix link state exit during switch upstream function removal(CVE-2024-58093)

 ext4: detect invalid INLINE_DATA + EXTENTS flag combination(CVE-2025-40167)

 scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()(CVE-2023-53696)

 qed: Don't collect too many protection override GRC elements(CVE-2025-39949)

 partitions: mac: fix handling of bogus partition table(CVE-2025-21772)

 usb: xhci: Apply the link chain quirk on NEC isoc endpoints(CVE-2025-22022)

 start_kernel: Add __no_stack_protector function attribute(CVE-2023-53491)

 isofs: Prevent the use of too small fid(CVE-2025-37780)

 crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg(CVE-2025-39964)

 acpi: nfit: fix narrowing conversion in acpi_nfit_ctl(CVE-2025-22044)

 KVM: x86: Reset IRTE to host control if *new* route isn't postable(CVE-2025-37885)

 i40e: fix MMIO write access to an invalid page in i40e_clear_hw(CVE-2025-38200)

 net/sched: sch_qfq: Fix null-deref in agg_dequeue(CVE-2025-40083)

 net/sched: sch_qfq: Fix race condition on qfq_aggregate(CVE-2025-38477)

 KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O(CVE-2025-40026)

 fs: udf: fix OOB read in lengthAllocDescs handling(CVE-2025-40044)

 x86/vmscape: Add conditional IBPB mitigation(CVE-2025-40300)

 ppp: fix memory leak in pad_compress_skb(CVE-2025-39847)

 benet: fix BUG when creating VFs(CVE-2025-38569)

 uio_hv_generic: Let userspace take care of interrupt mask(CVE-2025-40048)

 HID: ignore non-functional sensor in HP 5MP Camera(CVE-2025-21992)

 Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of privilege local access(CVE-2024-21823)

 cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

 usb: net: sierra: check for no status endpoint(CVE-2025-38474)

 NFSD: Define a proc_layoutcommit for the FlexFiles layout type(CVE-2025-40087)

 vfs: Don't leak disconnected dentries on umount(CVE-2025-40105)

 netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX(CVE-2025-38201)

 firewire: net: fix use after free in fwnet_finish_incoming_packet()(CVE-2023-53432)

 serial: 8250: fix panic due to PSLVERR(CVE-2025-39724)

 HID: core: Harden s32ton() against conversion to 0 bits(CVE-2025-38556)

 tracing: dynevent: Add a missing lockdown check on dynevent(CVE-2025-40021)

 NFS: Fix the setting of capabilities when automounting a new filesystem(CVE-2025-39798)

 RDMA/core: Fix 'KASAN: slab-use-after-free Read in ib_register_device' problem(CVE-2025-38022)

 hv_netvsc: Fix panic during namespace deletion with VF(CVE-2025-38683)

 mm/slub: avoid accessing metadata when pointer is invalid in object_err()(CVE-2025-39902)

 calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().(CVE-2025-38181)

 crypto: rng - Ensure set_ent is always present(CVE-2025-40109)

 ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr(CVE-2025-38701)

 RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()(CVE-2025-39742)

 ice: Fix a null pointer dereference in ice_copy_and_init_pkg()(CVE-2025-38664)

 netfilter: nf_tables: reject duplicate device on updates(CVE-2025-38678)

 ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

 vsock: Do not allow binding to VMADDR_PORT_ANY(CVE-2025-38618)

 efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

 blk-mq: avoid double -queue_rq() because of early timeout(CVE-2022-50554)

 i40e: add max boundary check for VF filters(CVE-2025-39968)

 net/packet: fix a race in packet_set_ring() and packet_notifier()(CVE-2025-38617)

 xfrm: Duplicate SPI Handling(CVE-2025-39797)

 loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

 scsi: target: Fix WRITE_SAME No Data Buffer crash(CVE-2022-21546)

 ftrace: Fix potential warning in trace_printk_seq during ftrace_dump(CVE-2025-39813)

 cgroup: split cgroup_destroy_wq into 3 workqueues(CVE-2025-39953)

 ext4: fix potential out of bound read in ext4_fc_replay_scan()(CVE-2022-50306)

 padata: Fix pd UAF once and for all(CVE-2025-38584)

 i40e: add validation for ring_len param(CVE-2025-39973)

 mm: fix zswap writeback race condition(CVE-2023-53178)

 bnxt: avoid overflow in bnxt_get_nvram_directory()(CVE-2023-53661)

 tracing: Fix reading strings from synthetic events(CVE-2022-50255)

 trace/fgraph: Fix the warning caused by missing unregister notifier(CVE-2025-39829)

 tee: fix NULL pointer dereference in tee_shm_put(CVE-2025-39865)

 scsi: qla2xxx: Fix warning message due to adisc being flushed(CVE-2022-49158)

 thunderbolt: Do not double dequeue a configuration request(CVE-2025-38174)

 pNFS: Fix uninited ptr deref in block/scsi layout(CVE-2025-38691)

 i40e: fix idx validation in config queues msg(CVE-2025-39971)

 ftrace: Also allocate and copy hash for reading of filter files(CVE-2025-39689)

 net/sched: Restrict conditions for adding duplicating netems to qdisc tree(CVE-2025-38553)

 bpf: Fix oob access in cgroup local storage(CVE-2025-38502)

 vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects(CVE-2025-39850)

 cnic: Fix use-after-free bugs in cnic_delete_task(CVE-2025-39945)

 i40e: fix input validation logic for action_meta(CVE-2025-39970)

 drm/sched: Increment job count before swapping tail spsc queue(CVE-2025-38515)

 tracing: Add down_write(trace_event_sem) when adding trace event(CVE-2025-38539)

 tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer(CVE-2025-38184)

 pinmux: fix r ...

 Please note that the description has been truncated due to length. Please refer to vendor advisory for the full description.

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel packages.

Read more at https://www.tenable.com/plugins/nessus/302684

]]> <![CDATA[EulerOS Virtualization 2.12.0 : avahi (EulerOS-SA-2026-1473)]]> https://www.tenable.com/plugins/nessus/302683 https://www.tenable.com/plugins/nessus/302683 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302683 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the avahi package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.(CVE-2024-52615)

 A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.(CVE-2024-52616)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization avahi security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected avahi packages.

Read more at https://www.tenable.com/plugins/nessus/302683

]]> <![CDATA[EulerOS Virtualization 2.12.1 : protobuf (EulerOS-SA-2026-1454)]]> https://www.tenable.com/plugins/nessus/302682 https://www.tenable.com/plugins/nessus/302682 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302682 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the protobuf packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Any project that uses Protobuf Pure-Python backendto parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUPtags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =6.31.1 or beyond commit17838beda2943d08b8a9d4df5b68f5f04f26d901(CVE-2025-4565)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization protobuf security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected protobuf packages.

Read more at https://www.tenable.com/plugins/nessus/302682

]]> <![CDATA[EulerOS Virtualization 2.12.0 : httpd (EulerOS-SA-2026-1487)]]> https://www.tenable.com/plugins/nessus/302681 https://www.tenable.com/plugins/nessus/302681 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302681 with Critical Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd='...' directives.This issue affects Apache HTTP Server before 2.4.66.Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-58098)

 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.Users are recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

 mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-66200)

 HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.
 This vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue. Users are recommended to upgrade to version 2.4.64, which fixes this issue.(CVE-2024-42516)

 In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.Only configurations using 'SSLEngine optional' to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.(CVE-2025-49812)

 In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.(CVE-2025-23048)

 Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.In a logging configuration where CustomLog is used with '%{varname}x' or '%{varname}c' to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.(CVE-2024-47252)

 SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.(CVE-2024-43204)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected httpd packages.

Read more at https://www.tenable.com/plugins/nessus/302681

]]> <![CDATA[EulerOS Virtualization 2.12.1 : sudo (EulerOS-SA-2026-1465)]]> https://www.tenable.com/plugins/nessus/302680 https://www.tenable.com/plugins/nessus/302680 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302680 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.(CVE-2025-32462)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization sudo security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected sudo packages.

Read more at https://www.tenable.com/plugins/nessus/302680

]]> <![CDATA[EulerOS Virtualization 2.12.1 : expat (EulerOS-SA-2026-1423)]]> https://www.tenable.com/plugins/nessus/302679 https://www.tenable.com/plugins/nessus/302679 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302679 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.(CVE-2025-59375)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization expat security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected expat packages.

Read more at https://www.tenable.com/plugins/nessus/302679

]]> <![CDATA[EulerOS Virtualization 2.10.0 : libarchive (EulerOS-SA-2026-1558)]]> https://www.tenable.com/plugins/nessus/302678 https://www.tenable.com/plugins/nessus/302678 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302678 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libarchive security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libarchive packages.

Read more at https://www.tenable.com/plugins/nessus/302678

]]> <![CDATA[EulerOS Virtualization 2.12.0 : bind (EulerOS-SA-2026-1474)]]> https://www.tenable.com/plugins/nessus/302677 https://www.tenable.com/plugins/nessus/302677 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302677 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.

 This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.(CVE-2025-40780)

 Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.(CVE-2025-40778)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization bind security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected bind packages.

Read more at https://www.tenable.com/plugins/nessus/302677

]]> <![CDATA[EulerOS Virtualization 2.12.0 : expat (EulerOS-SA-2026-1480)]]> https://www.tenable.com/plugins/nessus/302676 https://www.tenable.com/plugins/nessus/302676 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302676 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.(CVE-2025-59375)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization expat security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected expat packages.

Read more at https://www.tenable.com/plugins/nessus/302676

]]> <![CDATA[EulerOS Virtualization 2.12.0 : libarchive (EulerOS-SA-2026-1492)]]> https://www.tenable.com/plugins/nessus/302675 https://www.tenable.com/plugins/nessus/302675 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302675 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)

 A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation.(CVE-2025-5917)

 A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.(CVE-2025-5914)

 A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive.(CVE-2025-5916)

 A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of- bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.(CVE-2025-5918)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libarchive security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libarchive packages.

Read more at https://www.tenable.com/plugins/nessus/302675

]]> <![CDATA[EulerOS Virtualization 2.12.1 : coreutils (EulerOS-SA-2026-1420)]]> https://www.tenable.com/plugins/nessus/302674 https://www.tenable.com/plugins/nessus/302674 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302674 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the coreutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.(CVE-2025-5278)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization coreutils security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected coreutils packages.

Read more at https://www.tenable.com/plugins/nessus/302674

]]> <![CDATA[EulerOS Virtualization 2.12.1 : dhcp (EulerOS-SA-2026-1422)]]> https://www.tenable.com/plugins/nessus/302673 https://www.tenable.com/plugins/nessus/302673 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302673 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the dhcp package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.
 This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.(CVE-2025-40778)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization dhcp security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected dhcp packages.

Read more at https://www.tenable.com/plugins/nessus/302673

]]> <![CDATA[EulerOS Virtualization 2.12.0 : grub2 (EulerOS-SA-2026-1486)]]> https://www.tenable.com/plugins/nessus/302672 https://www.tenable.com/plugins/nessus/302672 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302672 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.(CVE-2025-61662)

 A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.(CVE-2025-61664)

 A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.(CVE-2025-54771)

 A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.(CVE-2025-61663)

 A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited.(CVE-2025-61661)

 GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.(CVE-2024-56738)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization grub2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected grub2 packages.

Read more at https://www.tenable.com/plugins/nessus/302672

]]> <![CDATA[EulerOS Virtualization 2.10.0 : libpng (EulerOS-SA-2026-1559)]]> https://www.tenable.com/plugins/nessus/302671 https://www.tenable.com/plugins/nessus/302671 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302671 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libpng package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.(CVE-2025-64506)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of- bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component alpha 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.(CVE-2025-64720)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
 Upgrade to libpng 1.6.52 or later.(CVE-2025-66293)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libpng packages.

Read more at https://www.tenable.com/plugins/nessus/302671

]]> <![CDATA[EulerOS Virtualization 2.12.1 : util-linux (EulerOS-SA-2026-1468)]]> https://www.tenable.com/plugins/nessus/302670 https://www.tenable.com/plugins/nessus/302670 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302670 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the util-linux packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.(CVE-2025-14104)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization util-linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected util-linux packages.

Read more at https://www.tenable.com/plugins/nessus/302670

]]> <![CDATA[EulerOS Virtualization 2.12.1 : avahi (EulerOS-SA-2026-1416)]]> https://www.tenable.com/plugins/nessus/302669 https://www.tenable.com/plugins/nessus/302669 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302669 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the avahi package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.(CVE-2024-52615)

 A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.(CVE-2024-52616)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization avahi security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected avahi packages.

Read more at https://www.tenable.com/plugins/nessus/302669

]]> <![CDATA[EulerOS Virtualization 2.12.0 : iputils (EulerOS-SA-2026-1489)]]> https://www.tenable.com/plugins/nessus/302668 https://www.tenable.com/plugins/nessus/302668 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302668 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the iputils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE:
 this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero).(CVE-2025-48964)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization iputils security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected iputils packages.

Read more at https://www.tenable.com/plugins/nessus/302668

]]> <![CDATA[EulerOS Virtualization 2.12.1 : brotli (EulerOS-SA-2026-1419)]]> https://www.tenable.com/plugins/nessus/302667 https://www.tenable.com/plugins/nessus/302667 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302667 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the brotli package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.(CVE-2025-6176)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization brotli security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected brotli packages.

Read more at https://www.tenable.com/plugins/nessus/302667

]]> <![CDATA[EulerOS Virtualization 2.10.0 : util-linux (EulerOS-SA-2026-1568)]]> https://www.tenable.com/plugins/nessus/302666 https://www.tenable.com/plugins/nessus/302666 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302666 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the util-linux packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.(CVE-2025-14104)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization util-linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected util-linux packages.

Read more at https://www.tenable.com/plugins/nessus/302666

]]> <![CDATA[EulerOS Virtualization 2.12.1 : iputils (EulerOS-SA-2026-1432)]]> https://www.tenable.com/plugins/nessus/302665 https://www.tenable.com/plugins/nessus/302665 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302665 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the iputils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE:
 this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero).(CVE-2025-48964)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization iputils security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected iputils packages.

Read more at https://www.tenable.com/plugins/nessus/302665

]]> <![CDATA[EulerOS Virtualization 2.12.1 : openssl (EulerOS-SA-2026-1450)]]> https://www.tenable.com/plugins/nessus/302664 https://www.tenable.com/plugins/nessus/302664 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302664 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code.
 Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.(CVE-2025-9230)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization openssl security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected openssl packages.

Read more at https://www.tenable.com/plugins/nessus/302664

]]> <![CDATA[EulerOS Virtualization 2.12.1 : libtiff (EulerOS-SA-2026-1441)]]> https://www.tenable.com/plugins/nessus/302663 https://www.tenable.com/plugins/nessus/302663 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302663 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that '[t]his error only occurs if DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. 'rD') option is used.'(CVE-2025-8534)

 A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue.(CVE-2024-13978)

 A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue.(CVE-2025-8851)

 A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It is recommended to apply a patch to fix this issue. This vulnerability only affects products that are no longer supported by the maintainer.(CVE-2025-8177)

 A flaw has been found in LibTIFF 4.7.0. This affects the function
 _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The exploit has been published and may be used. There is ongoing doubt regarding the real existence of this vulnerability. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue. A researcher disputes the security impact of this issue, because 'this is a memory leak on a command line tool that is about to exit anyway'. In the reply the project maintainer declares this issue as 'a simple 'bug' when leaving the command line tool and (...) not a security issue at all'.(CVE-2025-9165)

 A flaw was found in Libtiff. This vulnerability is a 'write-what-where' condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user.(CVE-2025-9900)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libtiff security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libtiff packages.

Read more at https://www.tenable.com/plugins/nessus/302663

]]> <![CDATA[EulerOS Virtualization 2.12.1 : grub2 (EulerOS-SA-2026-1429)]]> https://www.tenable.com/plugins/nessus/302662 https://www.tenable.com/plugins/nessus/302662 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302662 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.(CVE-2025-61662)

 A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.(CVE-2025-61664)

 A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.(CVE-2025-54771)

 A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.(CVE-2025-61663)

 A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited.(CVE-2025-61661)

 GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks.(CVE-2024-56738)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization grub2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected grub2 packages.

Read more at https://www.tenable.com/plugins/nessus/302662

]]> <![CDATA[EulerOS Virtualization 2.12.0 : polkit (EulerOS-SA-2026-1510)]]> https://www.tenable.com/plugins/nessus/302661 https://www.tenable.com/plugins/nessus/302661 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302661 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the polkit packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly.(CVE-2025-7519)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization polkit security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected polkit packages.

Read more at https://www.tenable.com/plugins/nessus/302661

]]> <![CDATA[EulerOS Virtualization 2.12.1 : libarchive (EulerOS-SA-2026-1435)]]> https://www.tenable.com/plugins/nessus/302660 https://www.tenable.com/plugins/nessus/302660 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302660 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)

 A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation.(CVE-2025-5917)

 A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.(CVE-2025-5914)

 A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive.(CVE-2025-5916)

 A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of- bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.(CVE-2025-5918)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libarchive security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libarchive packages.

Read more at https://www.tenable.com/plugins/nessus/302660

]]> <![CDATA[EulerOS Virtualization 2.12.1 : libxslt (EulerOS-SA-2026-1443)]]> https://www.tenable.com/plugins/nessus/302659 https://www.tenable.com/plugins/nessus/302659 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302659 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libxslt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.(CVE-2025-10911)

 A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.(CVE-2025-7424)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libxslt security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libxslt packages.

Read more at https://www.tenable.com/plugins/nessus/302659

]]> <![CDATA[EulerOS Virtualization 2.10.1 : samba (EulerOS-SA-2026-1547)]]> https://www.tenable.com/plugins/nessus/302658 https://www.tenable.com/plugins/nessus/302658 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302658 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization samba security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected samba packages.

Read more at https://www.tenable.com/plugins/nessus/302658

]]> <![CDATA[EulerOS Virtualization 2.12.1 : systemd (EulerOS-SA-2026-1466)]]> https://www.tenable.com/plugins/nessus/302657 https://www.tenable.com/plugins/nessus/302657 Tue, 17 Mar 2026 00:00:00 GMT Nessus Plugin ID 302657 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.

 A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd- coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.(CVE-2025-4598)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization systemd security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected systemd packages.

Read more at https://www.tenable.com/plugins/nessus/302657

]]> <![CDATA[EulerOS 2.0 SP11 : aide (EulerOS-SA-2026-1597)]]> https://www.tenable.com/plugins/nessus/302656 https://www.tenable.com/plugins/nessus/302656 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302656 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the aide package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized. This issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to stderr to a regular file.(CVE-2025-54389)

 AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.(CVE-2025-54409)

Tenable has extracted the preceding description block directly from the EulerOS aide security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected aide packages.

Read more at https://www.tenable.com/plugins/nessus/302656

]]> <![CDATA[EulerOS 2.0 SP11 : golang (EulerOS-SA-2026-1606)]]> https://www.tenable.com/plugins/nessus/302655 https://www.tenable.com/plugins/nessus/302655 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302655 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.(CVE-2025-58185)

 When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.(CVE-2025-58189)

 Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.(CVE-2025-61729)

 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non- linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.(CVE-2025-58187)

Tenable has extracted the preceding description block directly from the EulerOS golang security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected golang packages.

Read more at https://www.tenable.com/plugins/nessus/302655

]]> <![CDATA[EulerOS 2.0 SP11 : golang (EulerOS-SA-2026-1578)]]> https://www.tenable.com/plugins/nessus/302654 https://www.tenable.com/plugins/nessus/302654 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302654 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.(CVE-2025-58185)

 When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.(CVE-2025-58189)

 Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.(CVE-2025-61729)

 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non- linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.(CVE-2025-58187)

Tenable has extracted the preceding description block directly from the EulerOS golang security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected golang packages.

Read more at https://www.tenable.com/plugins/nessus/302654

]]> <![CDATA[EulerOS Virtualization 2.12.0 : vim (EulerOS-SA-2026-1526)]]> https://www.tenable.com/plugins/nessus/302653 https://www.tenable.com/plugins/nessus/302653 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302653 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the vim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vims tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1552 contains a patch for the vulnerability.(CVE-2025-53905)



 Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vims zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1551 contains a patch for the vulnerability.(CVE-2025-53906)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization vim security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected vim packages.

Read more at https://www.tenable.com/plugins/nessus/302653

]]> <![CDATA[EulerOS 2.0 SP11 : unbound (EulerOS-SA-2026-1595)]]> https://www.tenable.com/plugins/nessus/302652 https://www.tenable.com/plugins/nessus/302652 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302652 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks.
 Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and non-referral nodata replies, further mitigating the possible poison effect.(CVE-2025-11411)

Tenable has extracted the preceding description block directly from the EulerOS unbound security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected unbound packages.

Read more at https://www.tenable.com/plugins/nessus/302652

]]> <![CDATA[EulerOS 2.0 SP11 : curl (EulerOS-SA-2026-1602)]]> https://www.tenable.com/plugins/nessus/302651 https://www.tenable.com/plugins/nessus/302651 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302651 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.This prevents curl from detecting MITM attackers and more.(CVE-2025-10966)

Tenable has extracted the preceding description block directly from the EulerOS curl security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected curl packages.

Read more at https://www.tenable.com/plugins/nessus/302651

]]> <![CDATA[EulerOS Virtualization 2.10.1 : libtasn1 (EulerOS-SA-2026-1540)]]> https://www.tenable.com/plugins/nessus/302650 https://www.tenable.com/plugins/nessus/302650 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302650 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the libtasn1 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.(CVE-2025-13151)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libtasn1 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libtasn1 packages.

Read more at https://www.tenable.com/plugins/nessus/302650

]]> <![CDATA[EulerOS Virtualization 2.12.0 : gnutls (EulerOS-SA-2026-1485)]]> https://www.tenable.com/plugins/nessus/302649 https://www.tenable.com/plugins/nessus/302649 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302649 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the gnutls packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.(CVE-2025-9820)

 A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure.This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.(CVE-2025-32988)

 A NULL pointer dereference flaw was found in the GnuTLS software in
 _gnutls_figure_common_ciphersuite().(CVE-2025-6395)

 A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.(CVE-2025-32990)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization gnutls security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected gnutls packages.

Read more at https://www.tenable.com/plugins/nessus/302649

]]> <![CDATA[EulerOS Virtualization 2.12.1 : mod_http2 (EulerOS-SA-2026-1444)]]> https://www.tenable.com/plugins/nessus/302648 https://www.tenable.com/plugins/nessus/302648 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302648 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the mod_http2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 In certain proxy configurations, a denial of service attack againstApache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2.Configurations affected are a reverse proxy is configured for an HTTP/2 backend, with ProxyPreserveHost set to 'on'.(CVE-2025-49630)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization mod_http2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected mod_http2 packages.

Read more at https://www.tenable.com/plugins/nessus/302648

]]> <![CDATA[EulerOS 2.0 SP11 : proftpd (EulerOS-SA-2026-1615)]]> https://www.tenable.com/plugins/nessus/302647 https://www.tenable.com/plugins/nessus/302647 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302647 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.(CVE-2024-48651)

Tenable has extracted the preceding description block directly from the EulerOS proftpd security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected proftpd packages.

Read more at https://www.tenable.com/plugins/nessus/302647

]]> <![CDATA[EulerOS 2.0 SP11 : brotli (EulerOS-SA-2026-1599)]]> https://www.tenable.com/plugins/nessus/302646 https://www.tenable.com/plugins/nessus/302646 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302646 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the brotli package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.(CVE-2025-6176)

Tenable has extracted the preceding description block directly from the EulerOS brotli security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected brotli packages.

Read more at https://www.tenable.com/plugins/nessus/302646

]]> <![CDATA[EulerOS Virtualization 2.10.1 : gnupg2 (EulerOS-SA-2026-1534)]]> https://www.tenable.com/plugins/nessus/302645 https://www.tenable.com/plugins/nessus/302645 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302645 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the gnupg2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)(CVE-2025-68973)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization gnupg2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gnupg2 packages.

Read more at https://www.tenable.com/plugins/nessus/302645

]]> <![CDATA[EulerOS 2.0 SP11 : ruby (EulerOS-SA-2026-1621)]]> https://www.tenable.com/plugins/nessus/302644 https://www.tenable.com/plugins/nessus/302644 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302644 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.(CVE-2025-61594)

Tenable has extracted the preceding description block directly from the EulerOS ruby security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected ruby packages.

Read more at https://www.tenable.com/plugins/nessus/302644

]]> <![CDATA[EulerOS 2.0 SP11 : rsync (EulerOS-SA-2026-1592)]]> https://www.tenable.com/plugins/nessus/302643 https://www.tenable.com/plugins/nessus/302643 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302643 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the rsync package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)

Tenable has extracted the preceding description block directly from the EulerOS rsync security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected rsync packages.

Read more at https://www.tenable.com/plugins/nessus/302643

]]> <![CDATA[EulerOS 2.0 SP11 : curl (EulerOS-SA-2026-1574)]]> https://www.tenable.com/plugins/nessus/302642 https://www.tenable.com/plugins/nessus/302642 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302642 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.This prevents curl from detecting MITM attackers and more.(CVE-2025-10966)

Tenable has extracted the preceding description block directly from the EulerOS curl security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected curl packages.

Read more at https://www.tenable.com/plugins/nessus/302642

]]> <![CDATA[EulerOS Virtualization 2.12.0 : python-requests (EulerOS-SA-2026-1515)]]> https://www.tenable.com/plugins/nessus/302641 https://www.tenable.com/plugins/nessus/302641 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302641 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the python-requests package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.(CVE-2024-47081)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-requests security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-requests packages.

Read more at https://www.tenable.com/plugins/nessus/302641

]]> <![CDATA[EulerOS Virtualization 2.12.1 : python-urllib3 (EulerOS-SA-2026-1459)]]> https://www.tenable.com/plugins/nessus/302640 https://www.tenable.com/plugins/nessus/302640 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302640 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.(CVE-2025-66418)

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
 The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.(CVE-2025-66471)

 urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content- Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.(CVE-2026-21441)

 urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.(CVE-2025-50181)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-urllib3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-urllib3 packages.

Read more at https://www.tenable.com/plugins/nessus/302640

]]> <![CDATA[EulerOS Virtualization 2.12.0 : unbound (EulerOS-SA-2026-1524)]]> https://www.tenable.com/plugins/nessus/302639 https://www.tenable.com/plugins/nessus/302639 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302639 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the unbound packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks.
 Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and non-referral nodata replies, further mitigating the possible poison effect.(CVE-2025-11411)

 A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that support EDNS Client Subnet (ECS). Unbound is also vulnerable when compiled with ECS support, i.e., '--enable-subnet', AND configured to send ECS information along with queries to upstream name servers, i.e., at least one of the 'send-client-subnet', 'client-subnet-zone' or 'client-subnet- always-forward' options is used. Resolvers supporting ECS need to segregate outgoing queries to accommodate for different outgoing ECS information. This re-opens up resolvers to a birthday paradox attack (Rebirthday Attack) that tries to match the DNS transaction ID in order to cache non-ECS poisonous replies.(CVE-2025-5994)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization unbound security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected unbound packages.

Read more at https://www.tenable.com/plugins/nessus/302639

]]> <![CDATA[EulerOS 2.0 SP11 : python3 (EulerOS-SA-2026-1588)]]> https://www.tenable.com/plugins/nessus/302638 https://www.tenable.com/plugins/nessus/302638 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302638 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 The 'zipfile' module would not check the validity of the ZIP64 End ofCentral Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP rchive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.(CVE-2025-8291)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3 packages.

Read more at https://www.tenable.com/plugins/nessus/302638

]]> <![CDATA[EulerOS 2.0 SP11 : cups (EulerOS-SA-2026-1601)]]> https://www.tenable.com/plugins/nessus/302637 https://www.tenable.com/plugins/nessus/302637 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302637 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the cups package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.(CVE-2025-58436)

 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of- bound write. This issue has been patched in version 2.4.15.(CVE-2025-61915)

Tenable has extracted the preceding description block directly from the EulerOS cups security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected cups packages.

Read more at https://www.tenable.com/plugins/nessus/302637

]]> <![CDATA[EulerOS Virtualization 2.10.1 : httpd (EulerOS-SA-2026-1536)]]> https://www.tenable.com/plugins/nessus/302636 https://www.tenable.com/plugins/nessus/302636 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302636 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-66200)

 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.Users are recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

 Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd='...' directives.This issue affects Apache HTTP Server before 2.4.66.Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-58098)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected httpd packages.

Read more at https://www.tenable.com/plugins/nessus/302636

]]> <![CDATA[EulerOS Virtualization 2.10.0 : net-snmp (EulerOS-SA-2026-1561)]]> https://www.tenable.com/plugins/nessus/302635 https://www.tenable.com/plugins/nessus/302635 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302635 with Critical Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the net-snmp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash. This issue has been patched in versions 5.9.5 and 5.10.pre2.(CVE-2025-68615)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization net-snmp security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected net-snmp packages.

Read more at https://www.tenable.com/plugins/nessus/302635

]]> <![CDATA[EulerOS Virtualization 2.10.1 : libarchive (EulerOS-SA-2026-1538)]]> https://www.tenable.com/plugins/nessus/302634 https://www.tenable.com/plugins/nessus/302634 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302634 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libarchive security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libarchive packages.

Read more at https://www.tenable.com/plugins/nessus/302634

]]> <![CDATA[EulerOS 2.0 SP11 : ruby (EulerOS-SA-2026-1593)]]> https://www.tenable.com/plugins/nessus/302633 https://www.tenable.com/plugins/nessus/302633 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302633 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.(CVE-2025-61594)

Tenable has extracted the preceding description block directly from the EulerOS ruby security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected ruby packages.

Read more at https://www.tenable.com/plugins/nessus/302633

]]> <![CDATA[EulerOS Virtualization 2.12.0 : sqlite (EulerOS-SA-2026-1520)]]> https://www.tenable.com/plugins/nessus/302632 https://www.tenable.com/plugins/nessus/302632 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302632 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the sqlite package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.(CVE-2025-29088)

 There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.(CVE-2025-6965)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization sqlite security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected sqlite packages.

Read more at https://www.tenable.com/plugins/nessus/302632

]]> <![CDATA[EulerOS 2.0 SP11 : python-pip (EulerOS-SA-2026-1590)]]> https://www.tenable.com/plugins/nessus/302631 https://www.tenable.com/plugins/nessus/302631 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302631 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.Note that upgrading pip to a 'fixed' version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the 'vulnerable' fallback code.Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python =3.9.17, =3.10.12, =3.11.4, or =3.12),applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.(CVE-2025-8869)

Tenable has extracted the preceding description block directly from the EulerOS python-pip security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-pip packages.

Read more at https://www.tenable.com/plugins/nessus/302631

]]> <![CDATA[EulerOS Virtualization 2.10.1 : curl (EulerOS-SA-2026-1532)]]> https://www.tenable.com/plugins/nessus/302630 https://www.tenable.com/plugins/nessus/302630 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302630 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP,POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

 When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.(CVE-2025-15079)

 When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

 When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,changing TLS options in one thread would inadvertently change them globallyand therefore possibly also affect other concurrently setup transfers.Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.(CVE-2025-14017)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected curl packages.

Read more at https://www.tenable.com/plugins/nessus/302630

]]> <![CDATA[EulerOS Virtualization 2.10.1 : python3 (EulerOS-SA-2026-1542)]]> https://www.tenable.com/plugins/nessus/302629 https://www.tenable.com/plugins/nessus/302629 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302629 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.(CVE-2025-8291)

 When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.(CVE-2025-12084)

 When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.(CVE-2025-13836)

 When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues(CVE-2025-13837)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3 packages.

Read more at https://www.tenable.com/plugins/nessus/302629

]]> <![CDATA[EulerOS Virtualization 2.12.0 : python-pip (EulerOS-SA-2026-1514)]]> https://www.tenable.com/plugins/nessus/302628 https://www.tenable.com/plugins/nessus/302628 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302628 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.(CVE-2025-50181)

 Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.(CVE-2023-32681)

 When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.Note that upgrading pip to a 'fixed' version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the 'vulnerable' fallback code.Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python =3.9.17, =3.10.12, =3.11.4, or =3.12),applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.(CVE-2025-8869)

 Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.(CVE-2024-47081)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-pip security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-pip packages.

Read more at https://www.tenable.com/plugins/nessus/302628

]]> <![CDATA[EulerOS Virtualization 2.10.0 : avahi (EulerOS-SA-2026-1549)]]> https://www.tenable.com/plugins/nessus/302627 https://www.tenable.com/plugins/nessus/302627 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302627 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the avahi package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.(CVE-2024-52616)

 A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.(CVE-2024-52615)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization avahi security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected avahi packages.

Read more at https://www.tenable.com/plugins/nessus/302627

]]> <![CDATA[EulerOS Virtualization 2.10.0 : gnupg2 (EulerOS-SA-2026-1554)]]> https://www.tenable.com/plugins/nessus/302626 https://www.tenable.com/plugins/nessus/302626 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302626 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the gnupg2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)(CVE-2025-68973)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization gnupg2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gnupg2 packages.

Read more at https://www.tenable.com/plugins/nessus/302626

]]> <![CDATA[EulerOS 2.0 SP11 : haproxy (EulerOS-SA-2026-1608)]]> https://www.tenable.com/plugins/nessus/302625 https://www.tenable.com/plugins/nessus/302625 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302625 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.(CVE-2025-11230)

Tenable has extracted the preceding description block directly from the EulerOS haproxy security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected haproxy packages.

Read more at https://www.tenable.com/plugins/nessus/302625

]]> <![CDATA[EulerOS Virtualization 2.12.0 : libpcap (EulerOS-SA-2026-1493)]]> https://www.tenable.com/plugins/nessus/302624 https://www.tenable.com/plugins/nessus/302624 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302624 with Low Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the libpcap package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.(CVE-2025-11961)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libpcap security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libpcap packages.

Read more at https://www.tenable.com/plugins/nessus/302624

]]> <![CDATA[EulerOS Virtualization 2.12.0 : krb5 (EulerOS-SA-2026-1491)]]> https://www.tenable.com/plugins/nessus/302623 https://www.tenable.com/plugins/nessus/302623 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302623 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the krb5 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.(CVE-2025-3576)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization krb5 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected krb5 packages.

Read more at https://www.tenable.com/plugins/nessus/302623

]]> <![CDATA[EulerOS Virtualization 2.12.0 : edk2 (EulerOS-SA-2026-1528)]]> https://www.tenable.com/plugins/nessus/302622 https://www.tenable.com/plugins/nessus/302622 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302622 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the edk2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2024-38805)

 EDK2 contains a vulnerability in BIOS where an attacker may cause 'Protection Mechanism Failure' by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.(CVE-2025-3770)

 EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability.(CVE-2024-38797)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization edk2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected edk2 packages.

Read more at https://www.tenable.com/plugins/nessus/302622

]]> <![CDATA[EulerOS Virtualization 2.10.0 : grub2 (EulerOS-SA-2026-1555)]]> https://www.tenable.com/plugins/nessus/302621 https://www.tenable.com/plugins/nessus/302621 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302621 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.(CVE-2025-61662)

 A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.(CVE-2025-61664)

 A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.(CVE-2025-61663)

 A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited.(CVE-2025-61661)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization grub2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected grub2 packages.

Read more at https://www.tenable.com/plugins/nessus/302621

]]> <![CDATA[EulerOS Virtualization 2.12.0 : net-snmp (EulerOS-SA-2026-1503)]]> https://www.tenable.com/plugins/nessus/302620 https://www.tenable.com/plugins/nessus/302620 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302620 with Critical Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the net-snmp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash. This issue has been patched in versions 5.9.5 and 5.10.pre2.(CVE-2025-68615)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization net-snmp security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected net-snmp packages.

Read more at https://www.tenable.com/plugins/nessus/302620

]]> <![CDATA[EulerOS Virtualization 2.12.1 : nss (EulerOS-SA-2026-1447)]]> https://www.tenable.com/plugins/nessus/302619 https://www.tenable.com/plugins/nessus/302619 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302619 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the nss packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. This vulnerability affects Firefox ESR 91.5, Firefox 96, and Thunderbird 91.5.(CVE-2022-22747)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization nss security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected nss packages.

Read more at https://www.tenable.com/plugins/nessus/302619

]]> <![CDATA[EulerOS Virtualization 2.12.0 : protobuf (EulerOS-SA-2026-1511)]]> https://www.tenable.com/plugins/nessus/302618 https://www.tenable.com/plugins/nessus/302618 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302618 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the protobuf packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Any project that uses Protobuf Pure-Python backendto parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUPtags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =6.31.1 or beyond commit17838beda2943d08b8a9d4df5b68f5f04f26d901(CVE-2025-4565)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization protobuf security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected protobuf packages.

Read more at https://www.tenable.com/plugins/nessus/302618

]]> <![CDATA[EulerOS 2.0 SP11 : libwebsockets (EulerOS-SA-2026-1613)]]> https://www.tenable.com/plugins/nessus/302617 https://www.tenable.com/plugins/nessus/302617 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302617 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the libwebsockets package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Use After Free vulnerability exists in the WebSocket server implementation in lws_handshake_server in warmcat libwebsockets. In specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, an attacker may achieve denial of service.(CVE-2025-11677)

 Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.(CVE-2025-11678)

Tenable has extracted the preceding description block directly from the EulerOS libwebsockets security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libwebsockets packages.

Read more at https://www.tenable.com/plugins/nessus/302617

]]> <![CDATA[EulerOS Virtualization 2.12.0 : openjpeg2 (EulerOS-SA-2026-1505)]]> https://www.tenable.com/plugins/nessus/302616 https://www.tenable.com/plugins/nessus/302616 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302616 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the openjpeg2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c.(CVE-2025-50952)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization openjpeg2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected openjpeg2 packages.

Read more at https://www.tenable.com/plugins/nessus/302616

]]> <![CDATA[EulerOS Virtualization 2.10.0 : glib2 (EulerOS-SA-2026-1553)]]> https://www.tenable.com/plugins/nessus/302615 https://www.tenable.com/plugins/nessus/302615 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302615 with Critical Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the glib2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.(CVE-2025-14087)

 A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.(CVE-2025-13601)

 A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.(CVE-2025-14512)

 A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).(CVE-2026-0988)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization glib2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected glib2 packages.

Read more at https://www.tenable.com/plugins/nessus/302615

]]> <![CDATA[EulerOS Virtualization 2.12.1 : perl (EulerOS-SA-2026-1452)]]> https://www.tenable.com/plugins/nessus/302614 https://www.tenable.com/plugins/nessus/302614 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302614 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Perl threads have a working directory race condition where file operations may target unintended paths.If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clonethat handle for the new thread, which is visible from any third (ormore) thread already running. This may lead to unintended operationssuch as loading code or accessing files from unexpected locations,which a local attacker may be able to exploit.(CVE-2025-40909)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization perl security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected perl packages.

Read more at https://www.tenable.com/plugins/nessus/302614

]]> <![CDATA[EulerOS Virtualization 2.10.1 : avahi (EulerOS-SA-2026-1529)]]> https://www.tenable.com/plugins/nessus/302613 https://www.tenable.com/plugins/nessus/302613 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302613 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the avahi package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.(CVE-2024-52616)

 A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.(CVE-2024-52615)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization avahi security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected avahi packages.

Read more at https://www.tenable.com/plugins/nessus/302613

]]> <![CDATA[EulerOS 2.0 SP11 : openssh (EulerOS-SA-2026-1614)]]> https://www.tenable.com/plugins/nessus/302612 https://www.tenable.com/plugins/nessus/302612 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302612 with Low Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)(CVE-2025-61984)

 ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.(CVE-2025-61985)

Tenable has extracted the preceding description block directly from the EulerOS openssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected openssh packages.

Read more at https://www.tenable.com/plugins/nessus/302612

]]> <![CDATA[EulerOS 2.0 SP11 : docker-runc (EulerOS-SA-2026-1575)]]> https://www.tenable.com/plugins/nessus/302611 https://www.tenable.com/plugins/nessus/302611 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302611 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively).
 This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.(CVE-2025-52565)

 runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.(CVE-2025-31133)

 runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.(CVE-2025-52881)

Tenable has extracted the preceding description block directly from the EulerOS docker-runc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected docker-runc packages.

Read more at https://www.tenable.com/plugins/nessus/302611

]]> <![CDATA[EulerOS Virtualization 2.12.0 : python-urllib3 (EulerOS-SA-2026-1516)]]> https://www.tenable.com/plugins/nessus/302610 https://www.tenable.com/plugins/nessus/302610 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302610 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.(CVE-2025-66418)

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
 The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.(CVE-2025-66471)

 urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content- Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.(CVE-2026-21441)

 urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.(CVE-2025-50181)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-urllib3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-urllib3 packages.

Read more at https://www.tenable.com/plugins/nessus/302610

]]> <![CDATA[EulerOS 2.0 SP11 : util-linux (EulerOS-SA-2026-1624)]]> https://www.tenable.com/plugins/nessus/302609 https://www.tenable.com/plugins/nessus/302609 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302609 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.(CVE-2025-14104)

Tenable has extracted the preceding description block directly from the EulerOS util-linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected util-linux packages.

Read more at https://www.tenable.com/plugins/nessus/302609

]]> <![CDATA[EulerOS Virtualization 2.12.0 : libsodium (EulerOS-SA-2026-1495)]]> https://www.tenable.com/plugins/nessus/302608 https://www.tenable.com/plugins/nessus/302608 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302608 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the libsodium package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.(CVE-2025-69277)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libsodium security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libsodium packages.

Read more at https://www.tenable.com/plugins/nessus/302608

]]> <![CDATA[EulerOS Virtualization 2.10.1 : kernel (EulerOS-SA-2026-1537)]]> https://www.tenable.com/plugins/nessus/302607 https://www.tenable.com/plugins/nessus/302607 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302607 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 media: v4l2-mem2mem: add lock to protect parameter num_rdy(CVE-2023-53519)

 md: Replace snprintf with scnprintf(CVE-2022-50299)

 mm/vmscan: don't try to reclaim hwpoison folio(CVE-2025-37834)

 ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()(CVE-2023-53271)

 md/raid10: fix wrong setting of max_corr_read_errors(CVE-2023-53313)

 scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

 loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

 mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

 scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

 NFS: Fix a race when updating an existing write(CVE-2025-39697)

 scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses(CVE-2023-7324)

 efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

 dm raid: fix address sanitizer warning in raid_resume(CVE-2022-50085)

 usb-storage: alauda: Fix uninit-value in alauda_check_media()(CVE-2023-53847)

 mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list(CVE-2025-39725)

 md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request(CVE-2023-53380)

 md/raid10: check slab-out-of-bounds in md_bitmap_get_counter(CVE-2023-53357)

 net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode(CVE-2023-53733)

 fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

 partitions: mac: fix handling of bogus partition table(CVE-2025-21772)

 HID: hidraw: fix memory leak in hidraw_release()(CVE-2022-49981)

 pid: Add a judgment for ns null in pid_nr_ns(CVE-2025-40178)

 libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

 watchdog: Fix kmemleak in watchdog_cdev_register(CVE-2023-53234)

 drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()(CVE-2022-50402)

 PNP: fix name memory leak in pnp_alloc_dev()(CVE-2022-50278)

 ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

 nbd: Fix hung when signal interrupts nbd_start_device_ioctl()(CVE-2022-50314)

 igb: Do not free q_vector unless new one was allocated(CVE-2022-50252)

 ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed(CVE-2023-53481)

 cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

 scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

 scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()(CVE-2023-53676)

 NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid(CVE-2025-68349)

 net: hns: fix possible memory leak in hnae_ae_register()(CVE-2022-50352)

 md: call __md_stop_writes in md_stop(CVE-2022-49987)

 net/packet: fix a race in packet_set_ring() and packet_notifier()(CVE-2025-38617)

 regulator: of: Fix refcount leak bug in of_get_regulation_constraints()(CVE-2022-50191)

 ubi: Fix use-after-free when volume resizing failed(CVE-2023-53800)

 HID: multitouch: Correct devm device reference for hidinput input_dev name(CVE-2023-53454)

 ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

 md/raid10: fix leak of 'r10bio-remaining' for recovery(CVE-2023-53299)

 scsi: qla2xxx: Wait for io return on terminate rport(CVE-2023-53322)

 udf: Detect system inodes linked into directory hierarchy(CVE-2023-53695)

 igb: Fix igb_down hung on surprise removal(CVE-2023-53148)

 cifs: Fix warning and UAF when destroy the MR list(CVE-2023-53427)

 scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()(CVE-2023-53803)

 ubi: ensure that VID header offset + VID header size = alloc, size(CVE-2023-53265)

 fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

 firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails(CVE-2022-50087)

 md-raid10: fix KASAN warning(CVE-2022-50211)

 scsi: ses: Fix possible desc_ptr out-of-bounds accesses(CVE-2023-53675)

 mmc: core: Fix kernel panic when remove non-standard SDIO card(CVE-2022-50640)

 nfs: handle failure of nfs_get_lock_context in unlock path(CVE-2025-38023)

 udf: Do not update file length for failed writes to inline files(CVE-2023-53295)

 RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug(CVE-2025-38024)

 sctp: check send stream number after wait_for_sndbuf(CVE-2023-53296)

 net/sched: sch_qfq: Fix race condition on qfq_aggregate(CVE-2025-38477)

 RDMA/rxe: Fix 'kernel NULL pointer dereference' error(CVE-2022-50671)

 i40e: add validation for ring_len param(CVE-2025-39973)

 md/raid1: Fix stack memory use after return in raid1_reshape(CVE-2025-38445)

 Squashfs: check return result of sb_min_blocksize(CVE-2025-38415)

 net/tunnel: wait until all sk_user_data reader finish before releasing the sock(CVE-2022-50405)

 ip6_vti: fix slab-use-after-free in decode_session6(CVE-2023-53821)

 af_unix: Fix data-races around user-unix_inflight.(CVE-2023-53204)

 RDMA/rxe: Fix error unwind in rxe_create_qp()(CVE-2022-50127)

 __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock(CVE-2025-38058)

 NFSD: Protect against send buffer overflow in NFSv2 READ(CVE-2022-50410)

 scsi: hpsa: Fix possible memory leak in hpsa_init_one()(CVE-2022-50646)

 sctp: handle the error returned from sctp_auth_asoc_init_active_key(CVE-2022-50243)

 vsock: Do not allow binding to VMADDR_PORT_ANY(CVE-2025-38618)

 smb: client: Fix use-after-free in cifs_fill_dirent(CVE-2025-38051)

 scsi: libiscsi: Initialize iscsi_conn-dd_data only if memory is allocated(CVE-2025-38700)

 sctp: fix a potential overflow in sctp_ifwdtsn_skip(CVE-2023-53372)

 pstore/ram: Check start of empty przs during init(CVE-2023-53331)

 clk: samsung: Fix memory leak in _samsung_clk_register_pll()(CVE-2022-50449)

 md/raid10: prevent soft lockup while flush writes(CVE-2023-53151)

 nfsd: call op_release, even when op_func returns an error(CVE-2023-53241)

 cifs: Release folio lock on fscache read hit.(CVE-2023-53593)

 net: bridge: fix soft lockup in br_multicast_query_expired()(CVE-2025-39773)

 cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

 dm raid: fix address sanitizer warning in raid_status(CVE-2022-50084)

 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()(CVE-2025-38724)

 scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()(CVE-2023-54014)

 block: fix resource leak in blk_register_queue() error path(CVE-2025-37980)

 drm/client: Fix memory leak in drm_client_target_cloned(CVE-2023-54091)

 dm flakey: fix a crash with invalid table line(CVE-2023-53786)

 crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()(CVE-2023-53817)

 hwrng: virtio - Fix race on data_avail and actual data(CVE-2023-53998)

 sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

 ppp: associate skb with a device at tx(CVE-2022-50655)

 fbdev: bitblit: bound-check glyph index in bit_putcs*(CVE-2025-40322)

 acct: fix potential integer overflow in encode_comp_t()(CVE-2022-50749)

 udf: Avoid double brelse() in udf_rename()(CVE-2022-50755)

 tee: add overflow check in register_shm_helper()(CVE-2022-50080)

 drm: Prevent drm_copy_field() to attempt copying a NULL pointer(CVE-2022-50884)

 crypto: api - Use work queue in crypto_destroy_instance(CVE-2023-53799)

 mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()(CVE-2023-53623)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel packages.

Read more at https://www.tenable.com/plugins/nessus/302607

]]> <![CDATA[EulerOS Virtualization 2.12.0 : libxml2 (EulerOS-SA-2026-1499)]]> https://www.tenable.com/plugins/nessus/302606 https://www.tenable.com/plugins/nessus/302606 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302606 with Low Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files.
 When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.(CVE-2025-6170)

 A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.(CVE-2025-6021)

 A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the sch:name path='...'/ schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.(CVE-2025-49794)

 A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.(CVE-2025-49796)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libxml2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libxml2 packages.

Read more at https://www.tenable.com/plugins/nessus/302606

]]> <![CDATA[EulerOS 2.0 SP11 : grub2 (EulerOS-SA-2026-1607)]]> https://www.tenable.com/plugins/nessus/302605 https://www.tenable.com/plugins/nessus/302605 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302605 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.(CVE-2025-61663)

 A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.(CVE-2025-61664)

Tenable has extracted the preceding description block directly from the EulerOS grub2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected grub2 packages.

Read more at https://www.tenable.com/plugins/nessus/302605

]]> <![CDATA[EulerOS 2.0 SP11 : python-urllib3 (EulerOS-SA-2026-1591)]]> https://www.tenable.com/plugins/nessus/302604 https://www.tenable.com/plugins/nessus/302604 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302604 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.(CVE-2025-66418)

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
 The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.(CVE-2025-66471)

Tenable has extracted the preceding description block directly from the EulerOS python-urllib3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-urllib3 packages.

Read more at https://www.tenable.com/plugins/nessus/302604

]]> <![CDATA[EulerOS 2.0 SP11 : glib2 (EulerOS-SA-2026-1605)]]> https://www.tenable.com/plugins/nessus/302603 https://www.tenable.com/plugins/nessus/302603 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302603 with Critical Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the glib2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.(CVE-2025-13601)

 A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.(CVE-2025-14087)

Tenable has extracted the preceding description block directly from the EulerOS glib2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected glib2 packages.

Read more at https://www.tenable.com/plugins/nessus/302603

]]> <![CDATA[EulerOS Virtualization 2.10.0 : binutils (EulerOS-SA-2026-1550)]]> https://www.tenable.com/plugins/nessus/302602 https://www.tenable.com/plugins/nessus/302602 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302602 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
 The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.(CVE-2025-11412)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization binutils security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected binutils packages.

Read more at https://www.tenable.com/plugins/nessus/302602

]]> <![CDATA[EulerOS Virtualization 2.12.0 : curl (EulerOS-SA-2026-1478)]]> https://www.tenable.com/plugins/nessus/302601 https://www.tenable.com/plugins/nessus/302601 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302601 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers.Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.(CVE-2025-14017)

 When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP,POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

 When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

 When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.(CVE-2025-15079)

 curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.This prevents curl from detecting MITM attackers and more.(CVE-2025-10966)

 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3.
 The same cookie name is set - but with just a slash as path (`path=\'/\',`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.(CVE-2025-9086)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected curl packages.

Read more at https://www.tenable.com/plugins/nessus/302601

]]> <![CDATA[EulerOS 2.0 SP11 : samba (EulerOS-SA-2026-1622)]]> https://www.tenable.com/plugins/nessus/302600 https://www.tenable.com/plugins/nessus/302600 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302600 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Tenable has extracted the preceding description block directly from the EulerOS samba security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected samba packages.

Read more at https://www.tenable.com/plugins/nessus/302600

]]> <![CDATA[EulerOS Virtualization 2.12.0 : sssd (EulerOS-SA-2026-1521)]]> https://www.tenable.com/plugins/nessus/302599 https://www.tenable.com/plugins/nessus/302599 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302599 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the sssd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.(CVE-2025-11561)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization sssd security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected sssd packages.

Read more at https://www.tenable.com/plugins/nessus/302599

]]> <![CDATA[EulerOS Virtualization 2.10.0 : curl (EulerOS-SA-2026-1552)]]> https://www.tenable.com/plugins/nessus/302598 https://www.tenable.com/plugins/nessus/302598 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302598 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP,POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

 When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.(CVE-2025-15079)

 When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

 When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,changing TLS options in one thread would inadvertently change them globallyand therefore possibly also affect other concurrently setup transfers.Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.(CVE-2025-14017)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected curl packages.

Read more at https://www.tenable.com/plugins/nessus/302598

]]> <![CDATA[EulerOS 2.0 SP11 : bind (EulerOS-SA-2026-1570)]]> https://www.tenable.com/plugins/nessus/302597 https://www.tenable.com/plugins/nessus/302597 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302597 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.(CVE-2025-40780)

 Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.(CVE-2025-40778)

Tenable has extracted the preceding description block directly from the EulerOS bind security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected bind packages.

Read more at https://www.tenable.com/plugins/nessus/302597

]]> <![CDATA[EulerOS Virtualization 2.10.1 : grub2 (EulerOS-SA-2026-1535)]]> https://www.tenable.com/plugins/nessus/302596 https://www.tenable.com/plugins/nessus/302596 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302596 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.(CVE-2025-61662)

 A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.(CVE-2025-61664)

 A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.(CVE-2025-61663)

 A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited.(CVE-2025-61661)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization grub2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected grub2 packages.

Read more at https://www.tenable.com/plugins/nessus/302596

]]> <![CDATA[EulerOS 2.0 SP11 : docker-runc (EulerOS-SA-2026-1603)]]> https://www.tenable.com/plugins/nessus/302595 https://www.tenable.com/plugins/nessus/302595 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302595 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively).
 This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.(CVE-2025-52565)

 runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.(CVE-2025-31133)

 runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.(CVE-2025-52881)

Tenable has extracted the preceding description block directly from the EulerOS docker-runc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected docker-runc packages.

Read more at https://www.tenable.com/plugins/nessus/302595

]]> <![CDATA[EulerOS Virtualization 2.10.1 : libpng (EulerOS-SA-2026-1539)]]> https://www.tenable.com/plugins/nessus/302594 https://www.tenable.com/plugins/nessus/302594 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302594 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libpng package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.(CVE-2025-64506)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of- bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component alpha 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.(CVE-2025-64720)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
 Upgrade to libpng 1.6.52 or later.(CVE-2025-66293)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libpng packages.

Read more at https://www.tenable.com/plugins/nessus/302594

]]> <![CDATA[EulerOS 2.0 SP11 : libpng (EulerOS-SA-2026-1611)]]> https://www.tenable.com/plugins/nessus/302593 https://www.tenable.com/plugins/nessus/302593 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302593 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the libpng package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
 Upgrade to libpng 1.6.52 or later.(CVE-2025-66293)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.(CVE-2025-64506)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component alpha 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.(CVE-2025-64720)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of- bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

Tenable has extracted the preceding description block directly from the EulerOS libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libpng packages.

Read more at https://www.tenable.com/plugins/nessus/302593

]]> <![CDATA[EulerOS Virtualization 2.12.0 : sudo (EulerOS-SA-2026-1522)]]> https://www.tenable.com/plugins/nessus/302592 https://www.tenable.com/plugins/nessus/302592 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302592 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the sudo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.(CVE-2025-32462)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization sudo security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected sudo packages.

Read more at https://www.tenable.com/plugins/nessus/302592

]]> <![CDATA[EulerOS Virtualization 2.12.0 : openssl (EulerOS-SA-2026-1507)]]> https://www.tenable.com/plugins/nessus/302591 https://www.tenable.com/plugins/nessus/302591 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302591 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Issue summary: An application trying to decrypt CMS messages encrypted using

 password based encryption can trigger an out-of-bounds read and write.Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code.Although the consequences of a successful exploit of this vulnerabilitycould be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed asModerate severity according to our Security Policy.



 The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.(CVE-2025-9230)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization openssl security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected openssl packages.

Read more at https://www.tenable.com/plugins/nessus/302591

]]> <![CDATA[EulerOS Virtualization 2.12.1 : libssh (EulerOS-SA-2026-1439)]]> https://www.tenable.com/plugins/nessus/302590 https://www.tenable.com/plugins/nessus/302590 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302590 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libssh package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.(CVE-2025-8277)

 A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for successthe function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.(CVE-2025-5372)

 A flaw was found in the libssh library. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.(CVE-2025-5318)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libssh packages.

Read more at https://www.tenable.com/plugins/nessus/302590

]]> <![CDATA[EulerOS 2.0 SP11 : openssh (EulerOS-SA-2026-1586)]]> https://www.tenable.com/plugins/nessus/302589 https://www.tenable.com/plugins/nessus/302589 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302589 with Low Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)(CVE-2025-61984)

 ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.(CVE-2025-61985)

Tenable has extracted the preceding description block directly from the EulerOS openssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected openssh packages.

Read more at https://www.tenable.com/plugins/nessus/302589

]]> <![CDATA[EulerOS 2.0 SP11 : httpd (EulerOS-SA-2026-1609)]]> https://www.tenable.com/plugins/nessus/302588 https://www.tenable.com/plugins/nessus/302588 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302588 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd='...' directives.This issue affects Apache HTTP Server before 2.4.66.Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-58098)

 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.Users are recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

 mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-66200)

Tenable has extracted the preceding description block directly from the EulerOS httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected httpd packages.

Read more at https://www.tenable.com/plugins/nessus/302588

]]> <![CDATA[EulerOS 2.0 SP11 : proftpd (EulerOS-SA-2026-1587)]]> https://www.tenable.com/plugins/nessus/302587 https://www.tenable.com/plugins/nessus/302587 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302587 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from mod_sql.(CVE-2024-48651)

Tenable has extracted the preceding description block directly from the EulerOS proftpd security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected proftpd packages.

Read more at https://www.tenable.com/plugins/nessus/302587

]]> <![CDATA[EulerOS 2.0 SP11 : gdb (EulerOS-SA-2026-1576)]]> https://www.tenable.com/plugins/nessus/302586 https://www.tenable.com/plugins/nessus/302586 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302586 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the gdb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
 The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with '[f]ixed for 2.46'.(CVE-2025-11083)

Tenable has extracted the preceding description block directly from the EulerOS gdb security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gdb packages.

Read more at https://www.tenable.com/plugins/nessus/302586

]]> <![CDATA[EulerOS Virtualization 2.12.0 : nss (EulerOS-SA-2026-1504)]]> https://www.tenable.com/plugins/nessus/302585 https://www.tenable.com/plugins/nessus/302585 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302585 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the nss packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. This vulnerability affects Firefox ESR 91.5, Firefox 96, and Thunderbird 91.5.(CVE-2022-22747)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization nss security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected nss packages.

Read more at https://www.tenable.com/plugins/nessus/302585

]]> <![CDATA[EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-1610)]]> https://www.tenable.com/plugins/nessus/302584 https://www.tenable.com/plugins/nessus/302584 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302584 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.(CVE-2024-36357)

 bpf: Fix oob access in cgroup local storage(CVE-2025-38502)

 vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects(CVE-2025-39850)

 tracing: Fix reading strings from synthetic events(CVE-2022-50255)

 x86/mce: Work around an erratum on fast string copy instructions(CVE-2022-49124)

 serial: 8250: fix panic due to PSLVERR(CVE-2025-39724)

 fbcon: fix integer overflow in fbcon_do_set_font(CVE-2025-39967)

 i40e: add max boundary check for VF filters(CVE-2025-39968)

 scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()(CVE-2023-53530)

 scsi: qla2xxx: Fix premature hw access after PCI error(CVE-2022-49157)

 vxlan: Fix NPD when refreshing an FDB entry with a nexthop object(CVE-2025-39851)

 bpf, cpumap: Make sure kthread is running before map update returns(CVE-2023-53577)

 scsi: qla4xxx: Add length check when parsing nlattrs(CVE-2023-53456)

 bnxt: avoid overflow in bnxt_get_nvram_directory()(CVE-2023-53661)

 scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()(CVE-2023-53521)

 pNFS: Fix uninited ptr deref in block/scsi layout(CVE-2025-38691)

 udf: Fix uninitialized array access for some pathnames(CVE-2023-53165)

 scsi: qla2xxx: Pointer may be dereferenced(CVE-2023-53150)

 firewire: net: fix use after free in fwnet_finish_incoming_packet()(CVE-2023-53432)

 i40e: fix MMIO write access to an invalid page in i40e_clear_hw(CVE-2025-38200)

 RDMA/mlx5: Initialize obj_event-obj_sub_list before xa_insert(CVE-2025-38387)

 usb: net: sierra: check for no status endpoint(CVE-2025-38474)

 hv_netvsc: Fix panic during namespace deletion with VF(CVE-2025-38683)

 ext4: improve error handling from ext4_dirhash()(CVE-2023-53473)

 benet: fix BUG when creating VFs(CVE-2025-38569)

 mm/slub: avoid accessing metadata when pointer is invalid in object_err()(CVE-2025-39902)

 xfrm: Duplicate SPI Handling(CVE-2025-39797)

 i40e: fix validation of VF state in get resources(CVE-2025-39969)

 i40e: fix input validation logic for action_meta(CVE-2025-39970)

 cnic: Fix use-after-free bugs in cnic_delete_task(CVE-2025-39945)

 net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb(CVE-2023-53548)

 bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT(CVE-2025-38439)

 blk-mq: avoid double -queue_rq() because of early timeout(CVE-2022-50554)

 NFSD: Define a proc_layoutcommit for the FlexFiles layout type(CVE-2025-40087)

 tracing: dynevent: Add a missing lockdown check on dynevent(CVE-2025-40021)

 ppp: fix memory leak in pad_compress_skb(CVE-2025-39847)

 i40e: Fix potential invalid access when MAC list is empty(CVE-2025-39853)

 IB/hfi1: Fix possible panic during hotplug remove(CVE-2023-53488)

 vfs: Don't leak disconnected dentries on umount(CVE-2025-40105)

 In kernel/trace/trace_kprobe.c at line 1308, the kprobe_perf_func function attempts to access the call- perf_events pointer, but due to the race condition, this pointer may not have been properly initialized.(CVE-2025-40042)

 perf: arm_spe: Prevent overflow in PERF_IDX2OFF()(CVE-2025-40081)

 crypto: essiv - Check ssize for decryption and in-place encryption(CVE-2025-40019)

 loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

 usb: xhci: Apply the link chain quirk on NEC isoc endpoints(CVE-2025-22022)

 nfsd: put dl_stid if fail to queue dl_recall(CVE-2025-22025)

 PCI/ASPM: Fix link state exit during switch upstream function removal(CVE-2024-58093)

 KVM: arm64: Prevent access to vCPU events before init(CVE-2025-40102)

 HID: ignore non-functional sensor in HP 5MP Camera(CVE-2025-21992)

 partitions: mac: fix handling of bogus partition table(CVE-2025-21772)

 fs: udf: fix OOB read in lengthAllocDescs handling(CVE-2025-40044)

 acpi: nfit: fix narrowing conversion in acpi_nfit_ctl(CVE-2025-22044)

 crypto: rng - Ensure set_ent is always present(CVE-2025-40109)

 scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()(CVE-2023-53696)

 drm/hisilicon/hibmc: fix the hibmc loaded failed bug(CVE-2025-39772)

 uio_hv_generic: Let userspace take care of interrupt mask(CVE-2025-40048)

 KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O(CVE-2025-40026)

 ext4: detect invalid INLINE_DATA + EXTENTS flag combination(CVE-2025-40167)

 scsi: ses: Fix possible desc_ptr out-of-bounds accesses(CVE-2023-53675)

 fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

 crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg(CVE-2025-39964)

 mtd: core: fix possible resource leak in init_mtd()(CVE-2022-50304)

 RDMA/mlx5: Return the firmware result upon destroying QP/RQ(CVE-2023-53286)

 bnxt_en: Fix memory corruption when FW resources change during ifdown(CVE-2025-39810)

 RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()(CVE-2023-53335)

 fs: dlm: fix invalid derefence of sb_lvbptr(CVE-2022-50516)

 scsi: mpt3sas: Fix a memory leak(CVE-2023-53512)

 ext4: fix off-by-one errors in fast-commit block filling(CVE-2022-50428)

 KVM: x86: Reset IRTE to host control if *new* route isn't postable(CVE-2025-37885)

 PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type(CVE-2025-23161)

 scsi: st: Fix array overflow in st_setup()(CVE-2025-37857)

 isofs: Prevent the use of too small fid(CVE-2025-37780)

 md/raid1,raid10: don't ignore IO flags(CVE-2025-22125)

 virtiofs: add filesystem context source name check(CVE-2025-37773)

 vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint(CVE-2025-22083)

 crypto: af_alg - Set merge to zero early in af_alg_sendmsg(CVE-2025-39931)

 modpost: fix off by one in is_executable_section()(CVE-2023-53397)

 scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

 net: bridge: fix soft lockup in br_multicast_query_expired()(CVE-2025-39773)

 arm64: csum: Fix OoB access in IP checksum code for negative lengths(CVE-2023-53726)

 x86/MCE: Always save CS register on AMD Zen IF Poison errors(CVE-2023-53438)

 PCI: Fix reference leak in pci_register_host_bridge()(CVE-2025-37836)

 cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

 NFS: Fix the setting of capabilities when automounting a new filesystem(CVE-2025-39798)

 Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of privilege local access(CVE-2024-21823)

 mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

 virtio_net: Fix error unwinding of XDP initialization(CVE-2023-53499)

 RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device(CVE-2023-53393)

 gfs2: No more self recovery(CVE-2025-38659)

 scsi: target: Fix WRITE_SAME No Data Buffer crash(CVE-2022-21546)

 cifs: Fix connections leak when tlink setup failed(CVE-2022-49822)

 cifs: avoid NULL pointer dereference in dbg call(CVE-2025-37844)

 smb3: fix for slab out of bounds on mount to ksmbd(CVE-2025-38728)

 ceph: fix race condition validating r_parent before applying state(CVE-2025-39927)

 cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

 NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()(CVE-2025-39730)

 smb: client: fix use-after-free in cifs_oplock_break(CVE-2025-38527)

 scsi: qla2xxx: Fix potential NULL pointer dereference(CVE-2023-53451)

 objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()(CVE-2025-37937)

 scsi: libiscsi: Initialize iscsi_conn-dd_data only if memory is allocated(CVE-2025-38700)

 block: fix resource leak in blk_register_queue() error path(CVE-2025-37980)

 scsi: target: Fix multiple LUN_RESET handling(CVE-2023-53586)

 md/raid1: Fix stack memory use after return in raid1_reshape(CVE-2025-38445)

 blk-mq: fix NULL dereference on q-elevator in blk_mq_elv_switch_none(CVE-2023-53292)

 scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses(CVE-2023-7324)

 nbd: restrict sockets to TCP and UDP(CVE-2025-40080)

 scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()(CVE-2023-53676)

 mm: hugetlb: avoid soft lockup when mprotect to large memory area(CVE-2025-40153)

 fbdev: fix potential buffer overflow in do_register_framebuffer()(CVE-2025-38702)

 net: ena: fix shift-out-of-bounds in exponential backoff(CVE-2023-53272)

 software node: Correct a OOB check in software_node_get_reference_args()(CVE-2025-38342)

 virtio: break and reset virtio devices on device_shutdown()(CVE-2025-38064)

 net/sched: sch_qfq: Fix race condition on qfq_aggregate(CVE-2025-38477)

 netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX(CVE-2025-38201)

 qed: allow sleep in qed_mcp_trace_dump()(CVE-2023-53509)

 vsock: Fix transport_* TOCTOU(CVE-2025-38461)

 ice: Fix a null pointer dereference in ice_copy_and_init_pkg()(CVE-2025-38664)

 tcp_metrics: use dst_dev_net_rcu()(CVE-2025-40075)

 netfilter: nf_tables: reject duplicate device on updates(CVE-2025-38678)

 ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

 net/packet: fix a race in packet_set_ring() and packet_notifier()(CVE-2025-38617)

 xfrm: Zero padding when dumping algos and encap(CVE-2023-53684)

 ipv4: start using dst_dev_rcu()(CVE-2025-40074)

 IB/mad: Don't call to function that might sleep while in atomic context(CVE-2022-50472)

 iavf: Fix reset error handling(CVE-2022-50053)

 RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug(CVE-2025-38024)

 RDMA/bnxt_re: wraparound mbox producer index(CVE-2023-53201)

 net/mlx5e: Check for NOT_READY flag state after locking(CVE-2023-53581)

 i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path(CVE-2025-39911)

 RDMA/rxe: Fix incomplete state save in rxe_requester(CVE-2023-53539)

 net_sched: sch_sfq: reject invalid perturb period(CVE-2025-38193)

 netfilter: conntrack: fix wrong ct-timeout value(CVE-2023-53635)

 net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree(CVE-2025-38468)

 vsock: Fix transport_{g2h,h2g} TOCTOU(CVE-2025-38462)

 media: tuner: xc5000: Fix use-after-free in xc5000_release(CVE-2025-39994)

 mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race(CVE-2025-38085)

 media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()(CVE-2025-38694)

 cifs: prevent NULL pointer dereference in UTF16 conversion(CVE-2025-39838)

 sctp: linearize cloned gso packets in sctp_rcv(CVE-2025-38718)

 mm/vmscan: don't try to reclaim hwpoison folio(CVE-2025-37834)

 tun: Fix memory leak for detached NAPI queue.(CVE-2023-53685)

 iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()(CVE-2023-53476)

 smb: client: fix race with concurrent opens in rename(2)(CVE-2025-39825)

 Squashfs: check return result of sb_min_blocksize(CVE-2025-38415)

 HID: multitouch: Correct devm device reference for hidinput input_dev name(CVE-2023-53454)

 genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie(CVE-2025-38062)

 pinctrl: check the return value of pinmux_ops::get_function_name()(CVE-2025-40030)

 dm-stripe: fix a possible integer overflow(CVE-2025-39940)

 scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write(CVE-2023-53282)

 drm/vmwgfx: Fix a null-ptr access in the cursor snooper(CVE-2025-40110)

 fs: Prevent file descriptor table allocations exceeding INT_MAX(CVE-2025-39756)

 ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()(CVE-2025-40198)

 tty: n_gsm: fix deadlock and link starvation in outgoing data path(CVE-2022-50116)

 sctp: Fix MAC comparison to be constant-time(CVE-2025-40204)

 tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().(CVE-2025-40186)

 scsi: storvsc: Fix handling of virtual Fibre Channel timeouts(CVE-2023-53245)

 media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()(CVE-2025-39713)

 media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove(CVE-2025-39996)

 nubus: Partially revert proc_create_single_data() conversion(CVE-2023-53217)

 scsi: qla2xxx: Fix deletion race condition(CVE-2023-53615)

 Squashfs: fix uninit-value in squashfs_get_parent(CVE-2025-40049)

 RDMA/hns: Fix double destruction of rsv_qp(CVE-2025-38582)

 cifs: parse_dfs_referrals: prevent oob on malformed input(CVE-2025-40099)

 net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error(CVE-2025-21924)

 net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer(CVE-2025-39937)

 bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls(CVE-2025-38608)

 ACPI: CPPC: Make rmw_lock a raw_spin_lock(CVE-2024-50249)

 ACPI: video: Fix use-after-free in acpi_video_switch_brightness()(CVE-2025-40211)

 smb: client: Fix refcount leak for cifs_sb_tlink(CVE-2025-40103)

 nfsd: decrease sc_count directly if fail to queue dl_recall(CVE-2025-37871)

 iommu/amd: Avoid stack buffer overflow from kernel cmdline(CVE-2025-38676)

 crypto: hisilicon/qm - set NULL to qm-debug.qm_diff_regs(CVE-2025-40062)

 dma-buf: insert memory barrier before updating num_fences(CVE-2025-38095)

 mm/hugetlb: fix folio is still mapped when deleted(CVE-2025-40006)

 ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered(CVE-2025-39763)

 crypto: hisilicon/qm - request reserved interrupt for virtual function(CVE-2025-40136)

 gfs2: Fix possible data races in gfs2_show_options()(CVE-2023-53622)

 mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list(CVE-2025-39725)

 fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

 powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()(CVE-2022-50635)

 be2net: pass wrb_params in case of OS2BMC be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site.(CVE-2025-40264)

 fuse: fix livelock in synchronous file put from fuseblk workers(CVE-2025-40220)

 sctp: avoid NULL dereference when chunk data buffer is missing(CVE-2025-40240)

 tipc: Fix use-after-free in tipc_mon_reinit_self().(CVE-2025-40280)

 sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto(CVE-2025-40281)

 scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()(CVE-2025-68229)

 libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

 RDMA/core: Fix 'KASAN: slab-use-after-free Read in ib_register_device' problem(CVE-2025-38022)

 usbnet: Fix using smp_processor_id() in preemptible code warnings(CVE-2025-40164)

 scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT(CVE-2022-49534)

 NFSD: fix race between nfsd registration and exports_proc(CVE-2025-38232)

 scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()(CVE-2025-38724)

 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request(CVE-2025-38430)

 HID: core: Harden s32ton() against conversion to 0 bits(CVE-2025-38556)

 iavf: Fix out-of-bounds when setting channels on remove(CVE-2023-53659)

 start_kernel: Add __no_stack_protector function attribute(CVE-2023-53491)

 efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

 drm/scheduler: fix fence ref counting(CVE-2022-49829)

 scsi: qla2xxx: Wait for io return on terminate rport(CVE-2023-53322)

 scsi: lpfc: Fix buffer free/clear order in deferred receive path(CVE-2025-39841)

 tcp: Clear tcp_sk(sk)-fastopen_rsk in tcp_disconnect().(CVE-2025-39955)

 icmp6: Fix null-ptr-deref of ip6_null_entry-rt6i_idev in icmp6_dev().(CVE-2023-53343)

 cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()(CVE-2025-40194)

 i40e: remove read access to debugfs files(CVE-2025-39901)

 nexthop: Forbid FDB status change while nexthop is in a group(CVE-2025-39980)

 netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed(CVE-2022-50500)

 nfsd: call op_release, even when op_func returns an error(CVE-2023-53241)

 media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID(CVE-2025-40016)

 igb: Fix igb_down hung on surprise removal(CVE-2023-53148)

 __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock(CVE-2025-38058)

 ext4: guard against EA inode refcount underflow in xattr update(CVE-2025-40190)

 ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

 scsi: core: Fix possible memory leak if device_add() fails(CVE-2023-53174)

 md/raid10: fix wrong setting of max_corr_read_errors(CVE-2023-53313)

 lwt: Fix return values of BPF xmit ops(CVE-2023-53338)

 netfilter: ctnetlink: fix refcount leak on table dump(CVE-2025-38721)

 netfilter: ctnetlink: remove refcounting in expectation dumpers(CVE-2025-39764)

 netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm(CVE-2025-39894)

 blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx(CVE-2025-40125)

 cifs: Release folio lock on fscache read hit.(CVE-2023-53593)

 io_uring: wait interruptibly for request completions on exit(CVE-2023-53461)

 net: dlink: handle copy_thresh allocation failure(CVE-2025-40053)

 net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast(CVE-2025-40140)

 i40e: fix idx validation in i40e_validate_queue_map(CVE-2025-39972)

 net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM(CVE-2025-39770)

 ipv6: use RCU in ip6_xmit()(CVE-2025-40135)

 pstore/ram: Check start of empty przs during init(CVE-2023-53331)

 ipv6: use RCU in ip6_output()(CVE-2025-40158)

 net: use dst_dev_rcu() in sk_setup_caps()(CVE-2025-40170)

 KVM: x86: use array_index_nospec with indices that come from guest(CVE-2025-39823)

 vxlan: Annotate FDB data races(CVE-2025-38037)

 drm/vmwgfx: Fix Use-after-free in validation(CVE-2025-40111)

 cifs: fix mid leak during reconnection after timeout threshold(CVE-2023-53597)

 xfs: do not propagate ENODATA disk errors into xattr code(CVE-2025-39835)

 of: check previous kernel's ima-kexec-buffer against memory bounds(CVE-2022-50159)

 Squashfs: reject negative file sizes in squashfs_read_inode()(CVE-2025-40200)

 skmsg: Fix wrong last sg check in sk_msg_recvmsg()(CVE-2022-49973)

 mm/smaps: fix race between smaps_hugetlb_range and migration(CVE-2025-39754)

 Drivers: hv: vmbus: Don't dereference ACPI root object handle(CVE-2023-53647)

 scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel packages.

Read more at https://www.tenable.com/plugins/nessus/302584

]]> <![CDATA[EulerOS 2.0 SP11 : containerd (EulerOS-SA-2026-1600)]]> https://www.tenable.com/plugins/nessus/302583 https://www.tenable.com/plugins/nessus/302583 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302583 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the containerd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions.
 This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.(CVE-2024-25621)

Tenable has extracted the preceding description block directly from the EulerOS containerd security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected containerd packages.

Read more at https://www.tenable.com/plugins/nessus/302583

]]> <![CDATA[EulerOS Virtualization 2.10.0 : rsync (EulerOS-SA-2026-1566)]]> https://www.tenable.com/plugins/nessus/302582 https://www.tenable.com/plugins/nessus/302582 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302582 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the rsync package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization rsync security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected rsync packages.

Read more at https://www.tenable.com/plugins/nessus/302582

]]> <![CDATA[EulerOS Virtualization 2.10.1 : binutils (EulerOS-SA-2026-1530)]]> https://www.tenable.com/plugins/nessus/302581 https://www.tenable.com/plugins/nessus/302581 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302581 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
 The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.(CVE-2025-11412)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization binutils security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected binutils packages.

Read more at https://www.tenable.com/plugins/nessus/302581

]]> <![CDATA[EulerOS Virtualization 2.12.0 : systemd (EulerOS-SA-2026-1523)]]> https://www.tenable.com/plugins/nessus/302580 https://www.tenable.com/plugins/nessus/302580 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302580 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.

 A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd- coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.(CVE-2025-4598)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization systemd security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected systemd packages.

Read more at https://www.tenable.com/plugins/nessus/302580

]]> <![CDATA[EulerOS 2.0 SP11 : libpng (EulerOS-SA-2026-1583)]]> https://www.tenable.com/plugins/nessus/302579 https://www.tenable.com/plugins/nessus/302579 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302579 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the libpng package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
 Upgrade to libpng 1.6.52 or later.(CVE-2025-66293)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.(CVE-2025-64506)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component alpha 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.(CVE-2025-64720)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of- bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

Tenable has extracted the preceding description block directly from the EulerOS libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libpng packages.

Read more at https://www.tenable.com/plugins/nessus/302579

]]> <![CDATA[EulerOS Virtualization 2.12.0 : libssh (EulerOS-SA-2026-1496)]]> https://www.tenable.com/plugins/nessus/302578 https://www.tenable.com/plugins/nessus/302578 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302578 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libssh package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.(CVE-2025-8277)

 A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for successthe function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.(CVE-2025-5372)

 A flaw was found in the libssh library. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.(CVE-2025-5318)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libssh security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libssh packages.

Read more at https://www.tenable.com/plugins/nessus/302578

]]> <![CDATA[EulerOS 2.0 SP11 : rsync (EulerOS-SA-2026-1620)]]> https://www.tenable.com/plugins/nessus/302577 https://www.tenable.com/plugins/nessus/302577 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302577 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the rsync package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)

Tenable has extracted the preceding description block directly from the EulerOS rsync security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected rsync packages.

Read more at https://www.tenable.com/plugins/nessus/302577

]]> <![CDATA[EulerOS Virtualization 2.10.1 : cups (EulerOS-SA-2026-1531)]]> https://www.tenable.com/plugins/nessus/302576 https://www.tenable.com/plugins/nessus/302576 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302576 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of- bound write. This issue has been patched in version 2.4.15.(CVE-2025-61915)

 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.(CVE-2025-58436)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization cups security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected cups packages.

Read more at https://www.tenable.com/plugins/nessus/302576

]]> <![CDATA[EulerOS Virtualization 2.10.0 : samba (EulerOS-SA-2026-1567)]]> https://www.tenable.com/plugins/nessus/302575 https://www.tenable.com/plugins/nessus/302575 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302575 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization samba security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected samba packages.

Read more at https://www.tenable.com/plugins/nessus/302575

]]> <![CDATA[EulerOS 2.0 SP11 : python-pip (EulerOS-SA-2026-1618)]]> https://www.tenable.com/plugins/nessus/302574 https://www.tenable.com/plugins/nessus/302574 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302574 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.Note that upgrading pip to a 'fixed' version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the 'vulnerable' fallback code.Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python =3.9.17, =3.10.12, =3.11.4, or =3.12),applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.(CVE-2025-8869)

Tenable has extracted the preceding description block directly from the EulerOS python-pip security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-pip packages.

Read more at https://www.tenable.com/plugins/nessus/302574

]]> <![CDATA[EulerOS Virtualization 2.12.0 : libtasn1 (EulerOS-SA-2026-1497)]]> https://www.tenable.com/plugins/nessus/302573 https://www.tenable.com/plugins/nessus/302573 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302573 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the libtasn1 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.(CVE-2025-13151)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libtasn1 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libtasn1 packages.

Read more at https://www.tenable.com/plugins/nessus/302573

]]> <![CDATA[EulerOS Virtualization 2.10.0 : python3 (EulerOS-SA-2026-1562)]]> https://www.tenable.com/plugins/nessus/302572 https://www.tenable.com/plugins/nessus/302572 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302572 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.(CVE-2025-8291)

 When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.(CVE-2025-12084)

 When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.(CVE-2025-13836)

 When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues(CVE-2025-13837)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3 packages.

Read more at https://www.tenable.com/plugins/nessus/302572

]]> <![CDATA[EulerOS 2.0 SP11 : python-ldap (EulerOS-SA-2026-1617)]]> https://www.tenable.com/plugins/nessus/302571 https://www.tenable.com/plugins/nessus/302571 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302571 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the python-ldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.(CVE-2025-61912)

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.(CVE-2025-61911)

Tenable has extracted the preceding description block directly from the EulerOS python-ldap security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-ldap packages.

Read more at https://www.tenable.com/plugins/nessus/302571

]]> <![CDATA[EulerOS Virtualization 2.10.0 : httpd (EulerOS-SA-2026-1556)]]> https://www.tenable.com/plugins/nessus/302570 https://www.tenable.com/plugins/nessus/302570 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302570 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-66200)

 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.Users are recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

 Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd='...' directives.This issue affects Apache HTTP Server before 2.4.66.Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-58098)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected httpd packages.

Read more at https://www.tenable.com/plugins/nessus/302570

]]> <![CDATA[EulerOS Virtualization 2.12.0 : samba (EulerOS-SA-2026-1518)]]> https://www.tenable.com/plugins/nessus/302569 https://www.tenable.com/plugins/nessus/302569 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302569 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization samba security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected samba packages.

Read more at https://www.tenable.com/plugins/nessus/302569

]]> <![CDATA[EulerOS Virtualization 2.12.1 : libpcap (EulerOS-SA-2026-1436)]]> https://www.tenable.com/plugins/nessus/302568 https://www.tenable.com/plugins/nessus/302568 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302568 with Low Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the libpcap package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.(CVE-2025-11961)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libpcap security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libpcap packages.

Read more at https://www.tenable.com/plugins/nessus/302568

]]> <![CDATA[EulerOS 2.0 SP11 : python-ldap (EulerOS-SA-2026-1589)]]> https://www.tenable.com/plugins/nessus/302567 https://www.tenable.com/plugins/nessus/302567 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302567 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the python-ldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.(CVE-2025-61912)

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.(CVE-2025-61911)

Tenable has extracted the preceding description block directly from the EulerOS python-ldap security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-ldap packages.

Read more at https://www.tenable.com/plugins/nessus/302567

]]> <![CDATA[EulerOS 2.0 SP11 : gdb (EulerOS-SA-2026-1604)]]> https://www.tenable.com/plugins/nessus/302566 https://www.tenable.com/plugins/nessus/302566 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302566 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the gdb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
 The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with '[f]ixed for 2.46'.(CVE-2025-11083)

Tenable has extracted the preceding description block directly from the EulerOS gdb security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gdb packages.

Read more at https://www.tenable.com/plugins/nessus/302566

]]> <![CDATA[EulerOS Virtualization 2.10.1 : util-linux (EulerOS-SA-2026-1548)]]> https://www.tenable.com/plugins/nessus/302565 https://www.tenable.com/plugins/nessus/302565 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302565 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the util-linux packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.(CVE-2025-14104)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization util-linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected util-linux packages.

Read more at https://www.tenable.com/plugins/nessus/302565

]]> <![CDATA[EulerOS 2.0 SP11 : util-linux (EulerOS-SA-2026-1596)]]> https://www.tenable.com/plugins/nessus/302564 https://www.tenable.com/plugins/nessus/302564 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302564 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.(CVE-2025-14104)

Tenable has extracted the preceding description block directly from the EulerOS util-linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected util-linux packages.

Read more at https://www.tenable.com/plugins/nessus/302564

]]> <![CDATA[EulerOS Virtualization 2.12.1 : krb5 (EulerOS-SA-2026-1434)]]> https://www.tenable.com/plugins/nessus/302563 https://www.tenable.com/plugins/nessus/302563 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302563 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the krb5 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.(CVE-2025-3576)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization krb5 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected krb5 packages.

Read more at https://www.tenable.com/plugins/nessus/302563

]]> <![CDATA[EulerOS Virtualization 2.10.0 : python-pip (EulerOS-SA-2026-1564)]]> https://www.tenable.com/plugins/nessus/302562 https://www.tenable.com/plugins/nessus/302562 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302562 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.Note that upgrading pip to a 'fixed' version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the 'vulnerable' fallback code.Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python =3.9.17, =3.10.12, =3.11.4, or =3.12),applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.(CVE-2025-8869)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-pip security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-pip packages.

Read more at https://www.tenable.com/plugins/nessus/302562

]]> <![CDATA[EulerOS Virtualization 2.10.1 : python-ldap (EulerOS-SA-2026-1543)]]> https://www.tenable.com/plugins/nessus/302561 https://www.tenable.com/plugins/nessus/302561 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302561 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the python-ldap packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.(CVE-2025-61911)

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.(CVE-2025-61912)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-ldap security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-ldap packages.

Read more at https://www.tenable.com/plugins/nessus/302561

]]> <![CDATA[EulerOS Virtualization 2.10.0 : python-urllib3 (EulerOS-SA-2026-1565)]]> https://www.tenable.com/plugins/nessus/302560 https://www.tenable.com/plugins/nessus/302560 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302560 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content- Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.(CVE-2026-21441)

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
 The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.(CVE-2025-66471)

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.(CVE-2025-66418)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-urllib3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-urllib3 packages.

Read more at https://www.tenable.com/plugins/nessus/302560

]]> <![CDATA[EulerOS Virtualization 2.12.1 : libpng (EulerOS-SA-2026-1437)]]> https://www.tenable.com/plugins/nessus/302559 https://www.tenable.com/plugins/nessus/302559 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302559 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the libpng package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of- bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.(CVE-2025-64506)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
 Upgrade to libpng 1.6.52 or later.(CVE-2025-66293)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018.
 This vulnerability is fixed in 1.6.54.(CVE-2026-22695)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.(CVE-2026-22801)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component alpha 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.(CVE-2025-64720)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libpng packages.

Read more at https://www.tenable.com/plugins/nessus/302559

]]> <![CDATA[EulerOS 2.0 SP11 : unbound (EulerOS-SA-2026-1623)]]> https://www.tenable.com/plugins/nessus/302558 https://www.tenable.com/plugins/nessus/302558 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302558 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks.
 Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and non-referral nodata replies, further mitigating the possible poison effect.(CVE-2025-11411)

Tenable has extracted the preceding description block directly from the EulerOS unbound security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected unbound packages.

Read more at https://www.tenable.com/plugins/nessus/302558

]]> <![CDATA[EulerOS 2.0 SP11 : bind (EulerOS-SA-2026-1598)]]> https://www.tenable.com/plugins/nessus/302557 https://www.tenable.com/plugins/nessus/302557 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302557 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use.This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.(CVE-2025-40780)

 Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.(CVE-2025-40778)

Tenable has extracted the preceding description block directly from the EulerOS bind security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected bind packages.

Read more at https://www.tenable.com/plugins/nessus/302557

]]> <![CDATA[EulerOS 2.0 SP11 : grub2 (EulerOS-SA-2026-1579)]]> https://www.tenable.com/plugins/nessus/302556 https://www.tenable.com/plugins/nessus/302556 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302556 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.(CVE-2025-61663)

 A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.(CVE-2025-61664)

Tenable has extracted the preceding description block directly from the EulerOS grub2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected grub2 packages.

Read more at https://www.tenable.com/plugins/nessus/302556

]]> <![CDATA[EulerOS Virtualization 2.12.0 : perl (EulerOS-SA-2026-1509)]]> https://www.tenable.com/plugins/nessus/302555 https://www.tenable.com/plugins/nessus/302555 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302555 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 Perl threads have a working directory race condition where file operations may target unintended paths.If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clonethat handle for the new thread, which is visible from any third (ormore) thread already running. This may lead to unintended operationssuch as loading code or accessing files from unexpected locations,which a local attacker may be able to exploit.(CVE-2025-40909)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization perl security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected perl packages.

Read more at https://www.tenable.com/plugins/nessus/302555

]]> <![CDATA[EulerOS 2.0 SP11 : python-urllib3 (EulerOS-SA-2026-1619)]]> https://www.tenable.com/plugins/nessus/302554 https://www.tenable.com/plugins/nessus/302554 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302554 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.(CVE-2025-66418)

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
 The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.(CVE-2025-66471)

Tenable has extracted the preceding description block directly from the EulerOS python-urllib3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-urllib3 packages.

Read more at https://www.tenable.com/plugins/nessus/302554

]]> <![CDATA[EulerOS Virtualization 2.10.1 : python-urllib3 (EulerOS-SA-2026-1545)]]> https://www.tenable.com/plugins/nessus/302553 https://www.tenable.com/plugins/nessus/302553 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302553 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content- Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.(CVE-2026-21441)

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
 The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.(CVE-2025-66471)

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.(CVE-2025-66418)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization python-urllib3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-urllib3 packages.

Read more at https://www.tenable.com/plugins/nessus/302553

]]> <![CDATA[EulerOS Virtualization 2.10.1 : net-snmp (EulerOS-SA-2026-1541)]]> https://www.tenable.com/plugins/nessus/302552 https://www.tenable.com/plugins/nessus/302552 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302552 with Critical Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the net-snmp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash. This issue has been patched in versions 5.9.5 and 5.10.pre2.(CVE-2025-68615)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization net-snmp security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected net-snmp packages.

Read more at https://www.tenable.com/plugins/nessus/302552

]]> <![CDATA[EulerOS 2.0 SP11 : python3 (EulerOS-SA-2026-1616)]]> https://www.tenable.com/plugins/nessus/302551 https://www.tenable.com/plugins/nessus/302551 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302551 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 The 'zipfile' module would not check the validity of the ZIP64 End ofCentral Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP rchive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.(CVE-2025-8291)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3 packages.

Read more at https://www.tenable.com/plugins/nessus/302551

]]> <![CDATA[EulerOS Virtualization 2.12.1 : samba (EulerOS-SA-2026-1461)]]> https://www.tenable.com/plugins/nessus/302550 https://www.tenable.com/plugins/nessus/302550 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302550 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization samba security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected samba packages.

Read more at https://www.tenable.com/plugins/nessus/302550

]]> <![CDATA[EulerOS 2.0 SP11 : libsoup (EulerOS-SA-2026-1584)]]> https://www.tenable.com/plugins/nessus/302549 https://www.tenable.com/plugins/nessus/302549 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302549 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw in libsoup's HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.(CVE-2025-14523)

Tenable has extracted the preceding description block directly from the EulerOS libsoup security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libsoup packages.

Read more at https://www.tenable.com/plugins/nessus/302549

]]> <![CDATA[EulerOS 2.0 SP11 : libwebsockets (EulerOS-SA-2026-1585)]]> https://www.tenable.com/plugins/nessus/302548 https://www.tenable.com/plugins/nessus/302548 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302548 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the libwebsockets package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Use After Free vulnerability exists in the WebSocket server implementation in lws_handshake_server in warmcat libwebsockets. In specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, an attacker may achieve denial of service.(CVE-2025-11677)

 Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.(CVE-2025-11678)

Tenable has extracted the preceding description block directly from the EulerOS libwebsockets security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libwebsockets packages.

Read more at https://www.tenable.com/plugins/nessus/302548

]]> <![CDATA[EulerOS Virtualization 2.12.0 : util-linux (EulerOS-SA-2026-1525)]]> https://www.tenable.com/plugins/nessus/302547 https://www.tenable.com/plugins/nessus/302547 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302547 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the util-linux packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.(CVE-2025-14104)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization util-linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected util-linux packages.

Read more at https://www.tenable.com/plugins/nessus/302547

]]> <![CDATA[EulerOS Virtualization 2.12.1 : sqlite (EulerOS-SA-2026-1463)]]> https://www.tenable.com/plugins/nessus/302546 https://www.tenable.com/plugins/nessus/302546 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302546 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the sqlite package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*nBig multiplication is not cast to a 64-bit integer, and consequently some memory allocations may be incorrect.(CVE-2025-29088)

 There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.(CVE-2025-6965)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization sqlite security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected sqlite packages.

Read more at https://www.tenable.com/plugins/nessus/302546

]]> <![CDATA[EulerOS Virtualization 2.10.1 : rsync (EulerOS-SA-2026-1546)]]> https://www.tenable.com/plugins/nessus/302545 https://www.tenable.com/plugins/nessus/302545 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302545 with Medium Severity

Synopsis

The remote EulerOS Virtualization host is missing a security update.

Description

According to the versions of the rsync package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization rsync security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected rsync packages.

Read more at https://www.tenable.com/plugins/nessus/302545

]]> <![CDATA[EulerOS 2.0 SP11 : libsoup (EulerOS-SA-2026-1612)]]> https://www.tenable.com/plugins/nessus/302544 https://www.tenable.com/plugins/nessus/302544 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302544 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw in libsoup's HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.(CVE-2025-14523)

Tenable has extracted the preceding description block directly from the EulerOS libsoup security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libsoup packages.

Read more at https://www.tenable.com/plugins/nessus/302544

]]> <![CDATA[EulerOS Virtualization 2.10.0 : kernel (EulerOS-SA-2026-1557)]]> https://www.tenable.com/plugins/nessus/302543 https://www.tenable.com/plugins/nessus/302543 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302543 with High Severity

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 media: v4l2-mem2mem: add lock to protect parameter num_rdy(CVE-2023-53519)

 md: Replace snprintf with scnprintf(CVE-2022-50299)

 mm/vmscan: don't try to reclaim hwpoison folio(CVE-2025-37834)

 ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()(CVE-2023-53271)

 md/raid10: fix wrong setting of max_corr_read_errors(CVE-2023-53313)

 scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

 loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

 mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

 scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

 NFS: Fix a race when updating an existing write(CVE-2025-39697)

 scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses(CVE-2023-7324)

 efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

 dm raid: fix address sanitizer warning in raid_resume(CVE-2022-50085)

 usb-storage: alauda: Fix uninit-value in alauda_check_media()(CVE-2023-53847)

 mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list(CVE-2025-39725)

 md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request(CVE-2023-53380)

 md/raid10: check slab-out-of-bounds in md_bitmap_get_counter(CVE-2023-53357)

 net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode(CVE-2023-53733)

 fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

 partitions: mac: fix handling of bogus partition table(CVE-2025-21772)

 HID: hidraw: fix memory leak in hidraw_release()(CVE-2022-49981)

 pid: Add a judgment for ns null in pid_nr_ns(CVE-2025-40178)

 libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

 watchdog: Fix kmemleak in watchdog_cdev_register(CVE-2023-53234)

 drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()(CVE-2022-50402)

 PNP: fix name memory leak in pnp_alloc_dev()(CVE-2022-50278)

 ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

 nbd: Fix hung when signal interrupts nbd_start_device_ioctl()(CVE-2022-50314)

 igb: Do not free q_vector unless new one was allocated(CVE-2022-50252)

 ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed(CVE-2023-53481)

 cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

 scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

 scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()(CVE-2023-53676)

 NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid(CVE-2025-68349)

 net: hns: fix possible memory leak in hnae_ae_register()(CVE-2022-50352)

 md: call __md_stop_writes in md_stop(CVE-2022-49987)

 net/packet: fix a race in packet_set_ring() and packet_notifier()(CVE-2025-38617)

 regulator: of: Fix refcount leak bug in of_get_regulation_constraints()(CVE-2022-50191)

 ubi: Fix use-after-free when volume resizing failed(CVE-2023-53800)

 HID: multitouch: Correct devm device reference for hidinput input_dev name(CVE-2023-53454)

 ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

 md/raid10: fix leak of 'r10bio-remaining' for recovery(CVE-2023-53299)

 scsi: qla2xxx: Wait for io return on terminate rport(CVE-2023-53322)

 udf: Detect system inodes linked into directory hierarchy(CVE-2023-53695)

 igb: Fix igb_down hung on surprise removal(CVE-2023-53148)

 cifs: Fix warning and UAF when destroy the MR list(CVE-2023-53427)

 scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()(CVE-2023-53803)

 ubi: ensure that VID header offset + VID header size = alloc, size(CVE-2023-53265)

 fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

 firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails(CVE-2022-50087)

 md-raid10: fix KASAN warning(CVE-2022-50211)

 scsi: ses: Fix possible desc_ptr out-of-bounds accesses(CVE-2023-53675)

 mmc: core: Fix kernel panic when remove non-standard SDIO card(CVE-2022-50640)

 nfs: handle failure of nfs_get_lock_context in unlock path(CVE-2025-38023)

 udf: Do not update file length for failed writes to inline files(CVE-2023-53295)

 RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug(CVE-2025-38024)

 sctp: check send stream number after wait_for_sndbuf(CVE-2023-53296)

 net/sched: sch_qfq: Fix race condition on qfq_aggregate(CVE-2025-38477)

 RDMA/rxe: Fix 'kernel NULL pointer dereference' error(CVE-2022-50671)

 i40e: add validation for ring_len param(CVE-2025-39973)

 md/raid1: Fix stack memory use after return in raid1_reshape(CVE-2025-38445)

 Squashfs: check return result of sb_min_blocksize(CVE-2025-38415)

 net/tunnel: wait until all sk_user_data reader finish before releasing the sock(CVE-2022-50405)

 ip6_vti: fix slab-use-after-free in decode_session6(CVE-2023-53821)

 af_unix: Fix data-races around user-unix_inflight.(CVE-2023-53204)

 RDMA/rxe: Fix error unwind in rxe_create_qp()(CVE-2022-50127)

 __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock(CVE-2025-38058)

 NFSD: Protect against send buffer overflow in NFSv2 READ(CVE-2022-50410)

 scsi: hpsa: Fix possible memory leak in hpsa_init_one()(CVE-2022-50646)

 sctp: handle the error returned from sctp_auth_asoc_init_active_key(CVE-2022-50243)

 vsock: Do not allow binding to VMADDR_PORT_ANY(CVE-2025-38618)

 smb: client: Fix use-after-free in cifs_fill_dirent(CVE-2025-38051)

 scsi: libiscsi: Initialize iscsi_conn-dd_data only if memory is allocated(CVE-2025-38700)

 sctp: fix a potential overflow in sctp_ifwdtsn_skip(CVE-2023-53372)

 pstore/ram: Check start of empty przs during init(CVE-2023-53331)

 clk: samsung: Fix memory leak in _samsung_clk_register_pll()(CVE-2022-50449)

 md/raid10: prevent soft lockup while flush writes(CVE-2023-53151)

 nfsd: call op_release, even when op_func returns an error(CVE-2023-53241)

 cifs: Release folio lock on fscache read hit.(CVE-2023-53593)

 net: bridge: fix soft lockup in br_multicast_query_expired()(CVE-2025-39773)

 cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

 dm raid: fix address sanitizer warning in raid_status(CVE-2022-50084)

 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()(CVE-2025-38724)

 scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()(CVE-2023-54014)

 block: fix resource leak in blk_register_queue() error path(CVE-2025-37980)

 drm/client: Fix memory leak in drm_client_target_cloned(CVE-2023-54091)

 dm flakey: fix a crash with invalid table line(CVE-2023-53786)

 crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()(CVE-2023-53817)

 hwrng: virtio - Fix race on data_avail and actual data(CVE-2023-53998)

 sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

 ppp: associate skb with a device at tx(CVE-2022-50655)

 fbdev: bitblit: bound-check glyph index in bit_putcs*(CVE-2025-40322)

 acct: fix potential integer overflow in encode_comp_t()(CVE-2022-50749)

 udf: Avoid double brelse() in udf_rename()(CVE-2022-50755)

 tee: add overflow check in register_shm_helper()(CVE-2022-50080)

 drm: Prevent drm_copy_field() to attempt copying a NULL pointer(CVE-2022-50884)

 crypto: api - Use work queue in crypto_destroy_instance(CVE-2023-53799)

 mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()(CVE-2023-53623)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel packages.

Read more at https://www.tenable.com/plugins/nessus/302543

]]> <![CDATA[EulerOS 2.0 SP11 : brotli (EulerOS-SA-2026-1571)]]> https://www.tenable.com/plugins/nessus/302542 https://www.tenable.com/plugins/nessus/302542 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302542 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the brotli package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression.(CVE-2025-6176)

Tenable has extracted the preceding description block directly from the EulerOS brotli security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected brotli packages.

Read more at https://www.tenable.com/plugins/nessus/302542

]]> <![CDATA[EulerOS 2.0 SP11 : samba (EulerOS-SA-2026-1594)]]> https://www.tenable.com/plugins/nessus/302541 https://www.tenable.com/plugins/nessus/302541 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302541 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Tenable has extracted the preceding description block directly from the EulerOS samba security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected samba packages.

Read more at https://www.tenable.com/plugins/nessus/302541

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-28490]]> https://www.tenable.com/plugins/nessus/302540 https://www.tenable.com/plugins/nessus/302540 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302540 with High Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a cryptographic padding oracle vulnerability was identified in the Authlib Python library concerning the implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib registers RSA1_5 in its default algorithm registry without requiring explicit opt-in, and actively destroys the constant- time Bleichenbacher mitigation that the underlying cryptography library implements correctly. This issue has been patched in version 1.6.9. (CVE-2026-28490)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302540

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-30405]]> https://www.tenable.com/plugins/nessus/302539 https://www.tenable.com/plugins/nessus/302539 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302539 with Critical Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute (CVE-2026-30405)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302539

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-4185]]> https://www.tenable.com/plugins/nessus/302538 https://www.tenable.com/plugins/nessus/302538 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302538 with High Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - A vulnerability was found in GPAC up to 2.5-DEV-rev2167-gcc9d617c0-master. This vulnerability affects the function swf_def_bits_jpeg of the file src/scene_manager/swf_parse.c of the component MP4Box. The manipulation of the argument szName results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The patch is identified as 8961c74f87ae3fe2d3352e622f7730ca96d50cf1. A patch should be applied to remediate this issue.
 (CVE-2026-4185)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302538

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-28498]]> https://www.tenable.com/plugins/nessus/302537 https://www.tenable.com/plugins/nessus/302537 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302537 with High Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a library-level vulnerability was identified in the Authlib Python library concerning the validation of OpenID Connect (OIDC) ID Tokens. Specifically, the internal hash verification logic (_verify_hash) responsible for validating the at_hash (Access Token Hash) and c_hash (Authorization Code Hash) claims exhibits a fail-open behavior when encountering an unsupported or unknown cryptographic algorithm. This flaw allows an attacker to bypass mandatory integrity protections by supplying a forged ID Token with a deliberately unrecognized alg header parameter. The library intercepts the unsupported state and silently returns True (validation passed), inherently violating fundamental cryptographic design principles and direct OIDC specifications. This issue has been patched in version 1.6.9. (CVE-2026-28498)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302537

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-4177]]> https://www.tenable.com/plugins/nessus/302536 https://www.tenable.com/plugins/nessus/302536 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302536 with Critical Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high- severity heap buffer overflow in the YAML emitter. The heap overflow occurs when class names exceed the initial 512-byte allocation. The base64 decoder could read past the buffer end on trailing newlines.
 strtok mutated n->type_id in place, corrupting shared node data. A memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return. (CVE-2026-4177)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302536

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-4224]]> https://www.tenable.com/plugins/nessus/302535 https://www.tenable.com/plugins/nessus/302535 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302535 with Medium Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. (CVE-2026-4224)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302535

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-28384]]> https://www.tenable.com/plugins/nessus/302534 https://www.tenable.com/plugins/nessus/302534 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302534 with Critical Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - An improper sanitization of the compression_algorithm parameter in Canonical LXD allows an authenticated, unprivileged user to execute commands as the LXD daemon on the LXD server via API calls to the image and backup endpoints. This issue affected LXD from 4.12 through 6.6 and was fixed in the snap versions 5.0.6-e49d9f4 (channel 5.0/stable), 5.21.4-1374f39 (channel 5.21/stable), and 6.7-1f11451 (channel 6.0 stable). The channel 4.0/stable is not affected as it contains version 4.0.10. (CVE-2026-28384)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302534

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-27962]]> https://www.tenable.com/plugins/nessus/302533 https://www.tenable.com/plugins/nessus/302533 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302533 with Critical Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid bypassing authentication and authorization entirely. This issue has been patched in version 1.6.9. (CVE-2026-27962)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302533

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-3644]]> https://www.tenable.com/plugins/nessus/302532 https://www.tenable.com/plugins/nessus/302532 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302532 with Medium Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output(). (CVE-2026-3644)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302532

]]> <![CDATA[Fedora 44 : mingw-openexr (2026-4656ccedf8)]]> https://www.tenable.com/plugins/nessus/302531 https://www.tenable.com/plugins/nessus/302531 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302531 with High Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4656ccedf8 advisory.

 Update to openexr-3.4.6 resp 3.3.8.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected mingw-openexr package.

Read more at https://www.tenable.com/plugins/nessus/302531

]]> <![CDATA[Fedora 43 : vim (2026-7eaf665007)]]> https://www.tenable.com/plugins/nessus/302530 https://www.tenable.com/plugins/nessus/302530 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302530 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7eaf665007 advisory.

 patchlevel 148

 Security fix for CVE-2026-32249

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected 2:vim package.

Read more at https://www.tenable.com/plugins/nessus/302530

]]> <![CDATA[Fedora 44 : yarnpkg (2026-db0c5d039c)]]> https://www.tenable.com/plugins/nessus/302529 https://www.tenable.com/plugins/nessus/302529 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302529 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-db0c5d039c advisory.

 Update vendor bundle.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected yarnpkg package.

Read more at https://www.tenable.com/plugins/nessus/302529

]]> <![CDATA[Fedora 43 : mingw-openexr (2026-f958585e24)]]> https://www.tenable.com/plugins/nessus/302528 https://www.tenable.com/plugins/nessus/302528 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302528 with High Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f958585e24 advisory.

 Update to openexr-3.4.6 resp 3.3.8.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected mingw-openexr package.

Read more at https://www.tenable.com/plugins/nessus/302528

]]> <![CDATA[RHEL 8 : grub2 (RHSA-2026:4654)]]> https://www.tenable.com/plugins/nessus/302527 https://www.tenable.com/plugins/nessus/302527 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302527 with High Severity

Synopsis

The remote Red Hat host is missing a security update for grub2.

Description

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:4654 advisory.

 The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.

 Security Fix(es):

 * grub2: Missing unregister call for gettext command may lead to use-after-free (CVE-2025-61662)

 For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the RHEL grub2 package based on the guidance in RHSA-2026:4654.

Read more at https://www.tenable.com/plugins/nessus/302527

]]> <![CDATA[RHEL 10 : grub2 (RHSA-2026:4652)]]> https://www.tenable.com/plugins/nessus/302526 https://www.tenable.com/plugins/nessus/302526 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302526 with High Severity

Synopsis

The remote Red Hat host is missing a security update for grub2.

Description

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:4652 advisory.

 The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.

 Security Fix(es):

 * grub2: Missing unregister call for gettext command may lead to use-after-free (CVE-2025-61662)

 For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the RHEL grub2 package based on the guidance in RHSA-2026:4652.

Read more at https://www.tenable.com/plugins/nessus/302526

]]> <![CDATA[RHEL 8 : grub2 (RHSA-2026:4648)]]> https://www.tenable.com/plugins/nessus/302525 https://www.tenable.com/plugins/nessus/302525 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302525 with High Severity

Synopsis

The remote Red Hat host is missing a security update for grub2.

Description

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:4648 advisory.

 The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.

 Security Fix(es):

 * grub2: Missing unregister call for gettext command may lead to use-after-free (CVE-2025-61662)

 For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the RHEL grub2 package based on the guidance in RHSA-2026:4648.

Read more at https://www.tenable.com/plugins/nessus/302525

]]> <![CDATA[RHEL 10 : grub2 (RHSA-2026:4649)]]> https://www.tenable.com/plugins/nessus/302524 https://www.tenable.com/plugins/nessus/302524 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302524 with High Severity

Synopsis

The remote Red Hat host is missing a security update for grub2.

Description

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:4649 advisory.

 The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.

 Security Fix(es):

 * grub2: Missing unregister call for gettext command may lead to use-after-free (CVE-2025-61662)

 For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the RHEL grub2 package based on the guidance in RHSA-2026:4649.

Read more at https://www.tenable.com/plugins/nessus/302524

]]> <![CDATA[RHEL 8 : grub2 (RHSA-2026:4653)]]> https://www.tenable.com/plugins/nessus/302523 https://www.tenable.com/plugins/nessus/302523 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302523 with High Severity

Synopsis

The remote Red Hat host is missing a security update for grub2.

Description

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:4653 advisory.

 The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices.

 Security Fix(es):

 * grub2: Missing unregister call for gettext command may lead to use-after-free (CVE-2025-61662)

 For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the RHEL grub2 package based on the guidance in RHSA-2026:4653.

Read more at https://www.tenable.com/plugins/nessus/302523

]]> <![CDATA[TencentOS Server 2: python3 (TSSA-2026:0176)]]> https://www.tenable.com/plugins/nessus/302522 https://www.tenable.com/plugins/nessus/302522 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302522 with Medium Severity

Synopsis

The remote TencentOS Server 2 host is missing one or more security updates.

Description

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0176 advisory.

 Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

 CVE-2025-12084:
 When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302522

]]> <![CDATA[TencentOS Server 4: grafana (TSSA-2026:0168)]]> https://www.tenable.com/plugins/nessus/302521 https://www.tenable.com/plugins/nessus/302521 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302521 with Critical Severity

Synopsis

The remote TencentOS Server 4 host is missing one or more security updates.

Description

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0168 advisory.

 Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

 CVE-2026-27606:
 Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host filesystem that the build process has permissions for. This can lead to persistent Remote Code Execution (RCE) by overwriting critical system or user configuration files. Versions 2.80.0, 3.30.0, and 4.59.0 contain a patch for the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302521

]]> <![CDATA[TencentOS Server 3: idm:DL1 (TSSA-2025:1008)]]> https://www.tenable.com/plugins/nessus/302520 https://www.tenable.com/plugins/nessus/302520 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302520 with Critical Severity

Synopsis

The remote TencentOS Server 3 host is missing one or more security updates.

Description

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:1008 advisory.

 Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

 CVE-2025-7493:
 A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate the root@REALM canonical name, which can also be used as the realm administrator's name. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302520

]]> <![CDATA[TencentOS Server 4: qemu (TSSA-2026:0167)]]> https://www.tenable.com/plugins/nessus/302519 https://www.tenable.com/plugins/nessus/302519 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302519 with High Severity

Synopsis

The remote TencentOS Server 4 host is missing one or more security updates.

Description

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0167 advisory.

 Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

 CVE-2026-3195:
 A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `virtio_snd_pcm_in_cb` function did not check whether the iov could fit the data buffer, potentially leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for CVE-2024-7730.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302519

]]> <![CDATA[TencentOS Server 3: idm:DL1 (TSSA-2025:1009)]]> https://www.tenable.com/plugins/nessus/302518 https://www.tenable.com/plugins/nessus/302518 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302518 with High Severity

Synopsis

The remote TencentOS Server 3 host is missing one or more security updates.

Description

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:1009 advisory.

 Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

 CVE-2025-59088:
 If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name.
 This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where the use_dns setting is explicitly set to false are not affected.

 CVE-2025-59089:
 If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copies the entire buffered stream into a new buffer on each recv() call, even when the transfer is incomplete, causing excessive memory allocation and CPU usage. Additionally, kdcproxy accepts incoming response chunks as long as the received data length is not exactly equal to the length indicated in the response header, even when individual chunks or the total buffer exceed the maximum length of a Kerberos message.
 This allows an attacker to send unbounded data until the connection timeout is reached (approximately 12 seconds), exhausting server memory or CPU resources. Multiple concurrent requests can cause accept queue overflow, denying service to legitimate clients.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302518

]]> <![CDATA[CentOS 9 : nfs-utils-2.5.4-42.el9]]> https://www.tenable.com/plugins/nessus/302517 https://www.tenable.com/plugins/nessus/302517 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302517 with Medium Severity

Synopsis

The remote CentOS host is missing a security update for libnfsidmap.

Description

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the nfs- utils-2.5.4-42.el9 build changelog.

 - A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /etc/exports file at mount time. In particular, it allows the client to access any subdirectory or subtree of an exported directory, regardless of the set file permissions, and regardless of any 'root_squash' or 'all_squash' attributes that would normally be expected to apply to that client. (CVE-2025-12801)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the CentOS 9 Stream libnfsidmap package.

Read more at https://www.tenable.com/plugins/nessus/302517

]]> <![CDATA[Microsoft Edge (Chromium) < 146.0.3856.62 (CVE-2026-3909)]]> https://www.tenable.com/plugins/nessus/302516 https://www.tenable.com/plugins/nessus/302516 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302516 with High Severity

Synopsis

The remote host has an web browser installed that is affected by a vulnerability.

Description

The version of Microsoft Edge installed on the remote Windows host is prior to 146.0.3856.62. It is, therefore, affected by a vulnerability as referenced in the March 16, 2026 advisory.

 - Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) (CVE-2026-3909)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Microsoft Edge version 146.0.3856.62 or later.

Read more at https://www.tenable.com/plugins/nessus/302516

]]> <![CDATA[Fedora 45 : containernetworking-plugins (2026-38d944f97d)]]> https://www.tenable.com/plugins/nessus/302515 https://www.tenable.com/plugins/nessus/302515 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302515 with High Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-38d944f97d advisory.

 Automatic update for containernetworking-plugins-1.9.1-1.fc45.

 ##### **Changelog**

 ```
 * Mon Mar 16 2026 Bradley G Smith - 1.9.1-1
 - Update to release v1.9.1
 - Resolves: rhbz#2448053, rhbz#2423997, rhbz#2424031
 - Upstream fixes

 ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected containernetworking-plugins package.

Read more at https://www.tenable.com/plugins/nessus/302515

]]> <![CDATA[RHEL 10 : libvpx (RHSA-2026:4629)]]> https://www.tenable.com/plugins/nessus/302514 https://www.tenable.com/plugins/nessus/302514 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302514 with High Severity

Synopsis

The remote Red Hat host is missing a security update for libvpx.

Description

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:4629 advisory.

 The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.

 Security Fix(es):

 * libvpx: Heap buffer overflow in libvpx (CVE-2026-2447)

 For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the RHEL libvpx package based on the guidance in RHSA-2026:4629.

Read more at https://www.tenable.com/plugins/nessus/302514

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-32775]]> https://www.tenable.com/plugins/nessus/302513 https://www.tenable.com/plugins/nessus/302513 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302513 with High Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.
 (CVE-2026-32775)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302513

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-32778]]> https://www.tenable.com/plugins/nessus/302512 https://www.tenable.com/plugins/nessus/302512 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302512 with Low Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. (CVE-2026-32778)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302512

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-32776]]> https://www.tenable.com/plugins/nessus/302511 https://www.tenable.com/plugins/nessus/302511 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302511 with Medium Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
 (CVE-2026-32776)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302511

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-32635]]> https://www.tenable.com/plugins/nessus/302510 https://www.tenable.com/plugins/nessus/302510 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302510 with High Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross- Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding i18n- name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. This vulnerability is fixed in 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20. (CVE-2026-32635)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302510

]]> <![CDATA[Oracle Linux 7 : freerdp (ELSA-2026-2714)]]> https://www.tenable.com/plugins/nessus/302509 https://www.tenable.com/plugins/nessus/302509 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302509 with High Severity

Synopsis

The remote Oracle Linux host is missing one or more security updates.

Description

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-2714 advisory.

 [2:2.2.0-5.0.1]
 - fixed CVE-2026-23530 CVE-2026-23531 CVE-2026-23532 CVE-2026-23533 CVE-2026-23884 [Orabug: 38971897]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302509

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-32777]]> https://www.tenable.com/plugins/nessus/302508 https://www.tenable.com/plugins/nessus/302508 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302508 with Medium Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - libexpat before 2.7.5 allows an infinite loop while parsing DTD content. (CVE-2026-32777)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302508

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2025-71264]]> https://www.tenable.com/plugins/nessus/302507 https://www.tenable.com/plugins/nessus/302507 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302507 with Critical Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service (client crash). (CVE-2025-71264)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302507

]]> <![CDATA[MiracleLinux 9 : gimp-3.0.4-1.el9_7.4 (AXSA:2026-311:03)]]> https://www.tenable.com/plugins/nessus/302506 https://www.tenable.com/plugins/nessus/302506 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302506 with High Severity

Synopsis

The remote MiracleLinux host is missing one or more security updates.

Description

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-311:03 advisory.

 * gimp: GIMP: Remote code execution via heap-based buffer overflow in ICNS file parsing (CVE-2026-2047)
 * gimp: GIMP: Remote Code Execution via uninitialized memory in PGM file parsing (CVE-2026-2044)
 * gimp: GIMP: Remote Code Execution via out-of-bounds write in XWD file parsing (CVE-2026-2045)
 * gimp: GIMP: Remote Code Execution via ICO File Parsing Vulnerability (CVE-2026-0797)
 * gimp: GIMP: Remote Code Execution via XWD file parsing vulnerability (CVE-2026-2048)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected gimp and / or gimp-libs packages.

Read more at https://www.tenable.com/plugins/nessus/302506

]]> <![CDATA[MiracleLinux 9 : compat-openssl11-1.1.1k-5.el9_7.1 (AXSA:2026-313:01)]]> https://www.tenable.com/plugins/nessus/302505 https://www.tenable.com/plugins/nessus/302505 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302505 with High Severity

Synopsis

The remote MiracleLinux host is missing a security update.

Description

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-313:01 advisory.

 * openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing (CVE-2025-69419)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected compat-openssl11 package.

Read more at https://www.tenable.com/plugins/nessus/302505

]]> <![CDATA[MiracleLinux 8 : python3.11-3.11.13-5.el8_10 (AXSA:2026-312:06)]]> https://www.tenable.com/plugins/nessus/302504 https://www.tenable.com/plugins/nessus/302504 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302504 with Medium Severity

Synopsis

The remote MiracleLinux host is missing one or more security updates.

Description

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-312:06 advisory.

 * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)
 * cpython: IMAP command injection in user-controlled commands (CVE-2025-15366)
 * cpython: POP3 command injection in user-controlled commands (CVE-2025-15367)
 * cpython: email header injection due to unquoted newlines (CVE-2026-1299)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302504

]]> <![CDATA[MiracleLinux 8 : kernel-4.18.0-553.111.1.el8_10 (AXSA:2026-310:19)]]> https://www.tenable.com/plugins/nessus/302503 https://www.tenable.com/plugins/nessus/302503 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302503 with High Severity

Synopsis

The remote MiracleLinux host is missing one or more security updates.

Description

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-310:19 advisory.

 * kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085)
 * kernel: macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302503

]]> <![CDATA[Fedora 45 : freerdp (2026-bf4c5bb9c5)]]> https://www.tenable.com/plugins/nessus/302502 https://www.tenable.com/plugins/nessus/302502 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302502 with Critical Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bf4c5bb9c5 advisory.

 Automatic update for freerdp-3.24.0-1.fc45.

 ##### **Changelog**

 ```
 * Mon Mar 16 2026 Ondrej Holy - 2:3.24.0-1
 - Update to 3.24.0 (CVE-2026-29774, CVE-2026-29775, CVE-2026-29776, CVE-2026-31806, CVE-2026-31883, CVE-2026-31884, CVE-2026-31885, CVE-2026-31897) Resolves: rhbz#2447295, rhbz#2447393, rhbz#2447412, rhbz#2447415 Resolves: rhbz#2447417, rhbz#2447419, rhbz#2447423, rhbz#2447428 Resolves: rhbz#2447431

 ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected 2:freerdp package.

Read more at https://www.tenable.com/plugins/nessus/302502

]]> <![CDATA[OpenSSL 3.6.0 < 3.6.2 Vulnerability]]> https://www.tenable.com/plugins/nessus/302501 https://www.tenable.com/plugins/nessus/302501 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302501 with Critical Severity

Synopsis

The remote service is affected by a vulnerability.

Description

The version of OpenSSL installed on the remote host is prior to 3.6.2. It is, therefore, affected by a vulnerability as referenced in the 3.6.2 advisory.

 - Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post- quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction).
 OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary.
 OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue. (CVE-2026-2673)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to OpenSSL version 3.6.2 or later.

Read more at https://www.tenable.com/plugins/nessus/302501

]]> <![CDATA[OpenSSL 3.5.0 < 3.5.6 Vulnerability]]> https://www.tenable.com/plugins/nessus/302500 https://www.tenable.com/plugins/nessus/302500 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302500 with Critical Severity

Synopsis

The remote service is affected by a vulnerability.

Description

The version of OpenSSL installed on the remote host is prior to 3.5.6. It is, therefore, affected by a vulnerability as referenced in the 3.5.6 advisory.

 - Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post- quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction).
 OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary.
 OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue. Fixed in OpenSSL 3.5.6 (Affected since 3.5.0).
 (CVE-2026-2673)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to OpenSSL version 3.5.6 or later.

Read more at https://www.tenable.com/plugins/nessus/302500

]]> <![CDATA[RHEL 10 : vsftpd (RHSA-2026:4553)]]> https://www.tenable.com/plugins/nessus/302499 https://www.tenable.com/plugins/nessus/302499 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302499 with Medium Severity

Synopsis

The remote Red Hat host is missing a security update for vsftpd.

Description

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:4553 advisory.

 The vsftpd packages include a Very Secure File Transfer Protocol (FTP) daemon, which is used to serve files over a network.

 Security Fix(es):

 * vsftpd: vsftpd: Denial of service via integer overflow in ls command parameter parsing (CVE-2025-14242)

 For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the RHEL vsftpd package based on the guidance in RHSA-2026:4553.

Read more at https://www.tenable.com/plugins/nessus/302499

]]> <![CDATA[RHEL 8 : vsftpd (RHSA-2026:4554)]]> https://www.tenable.com/plugins/nessus/302498 https://www.tenable.com/plugins/nessus/302498 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302498 with Medium Severity

Synopsis

The remote Red Hat host is missing a security update for vsftpd.

Description

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:4554 advisory.

 The vsftpd packages include a Very Secure File Transfer Protocol (FTP) daemon, which is used to serve files over a network.

 Security Fix(es):

 * vsftpd: vsftpd: Denial of service via integer overflow in ls command parameter parsing (CVE-2025-14242)

 For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the RHEL vsftpd package based on the guidance in RHSA-2026:4554.

Read more at https://www.tenable.com/plugins/nessus/302498

]]> <![CDATA[Debian dsa-6165 : chromium - security update]]> https://www.tenable.com/plugins/nessus/302497 https://www.tenable.com/plugins/nessus/302497 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302497 with High Severity

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6165 advisory.

 - ------------------------------------------------------------------------- Debian Security Advisory DSA-6165-1 security@debian.org https://www.debian.org/security/ Andres Salomon March 16, 2026 https://www.debian.org/security/faq
 - -------------------------------------------------------------------------

 Package : chromium CVE ID : CVE-2026-3909 CVE-2026-3910

 Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. Google is aware that exploits for both CVEs exist in the wild.

 For the oldstable distribution (bookworm), these problems have been fixed in version 146.0.7680.80-1~deb12u1.

 For the stable distribution (trixie), these problems have been fixed in version 146.0.7680.80-1~deb13u1.

 We recommend that you upgrade your chromium packages.

 For the detailed security status of chromium please refer to its security tracker page at:
 https://security-tracker.debian.org/tracker/chromium

 Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

 Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the chromium packages.

Read more at https://www.tenable.com/plugins/nessus/302497

]]> <![CDATA[Fedora 42 : qgis (2026-cd6e404295)]]> https://www.tenable.com/plugins/nessus/302496 https://www.tenable.com/plugins/nessus/302496 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302496 with High Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cd6e404295 advisory.

 Update to qgis-3.44.8.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected qgis package.

Read more at https://www.tenable.com/plugins/nessus/302496

]]> <![CDATA[Fedora 43 : qgis (2026-b84eea4f2a)]]> https://www.tenable.com/plugins/nessus/302495 https://www.tenable.com/plugins/nessus/302495 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302495 with High Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b84eea4f2a advisory.

 Update to qgis-3.44.8.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected qgis package.

Read more at https://www.tenable.com/plugins/nessus/302495

]]> <![CDATA[Fedora 43 : alertmanager (2026-efbceeec2f)]]> https://www.tenable.com/plugins/nessus/302494 https://www.tenable.com/plugins/nessus/302494 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302494 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-efbceeec2f advisory.

 Initial build after rename and update to 0.31.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected alertmanager package.

Read more at https://www.tenable.com/plugins/nessus/302494

]]> <![CDATA[Fedora 43 : python3.6 (2026-8ba3403ff7)]]> https://www.tenable.com/plugins/nessus/302493 https://www.tenable.com/plugins/nessus/302493 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302493 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8ba3403ff7 advisory.

 Security fix for CVE-2025-12084


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3.6 package.

Read more at https://www.tenable.com/plugins/nessus/302493

]]> <![CDATA[Fedora 42 : python3.6 (2026-dd37d41d7f)]]> https://www.tenable.com/plugins/nessus/302492 https://www.tenable.com/plugins/nessus/302492 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302492 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-dd37d41d7f advisory.

 Security fix for CVE-2025-12084


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3.6 package.

Read more at https://www.tenable.com/plugins/nessus/302492

]]> <![CDATA[Fedora 43 : pgadmin4 (2026-bef5344f9f)]]> https://www.tenable.com/plugins/nessus/302491 https://www.tenable.com/plugins/nessus/302491 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302491 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bef5344f9f advisory.

 Update to pgadmin4-9.13.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected pgadmin4 package.

Read more at https://www.tenable.com/plugins/nessus/302491

]]> <![CDATA[Fedora 42 : chromium (2026-e71e71d1fe)]]> https://www.tenable.com/plugins/nessus/302490 https://www.tenable.com/plugins/nessus/302490 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302490 with Critical Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e71e71d1fe advisory.

 Update to 146.0.7680.71

 * CVE-2026-3913: Heap buffer overflow in WebML
 * CVE-2026-3914: Integer overflow in WebML
 * CVE-2026-3915: Heap buffer overflow in WebML
 * CVE-2026-3916: Out of bounds read in Web Speech
 * CVE-2026-3917: Use after free in Agents
 * CVE-2026-3918: Use after free in WebMCP
 * CVE-2026-3919: Use after free in Extensions
 * CVE-2026-3920: Out of bounds memory access in WebML
 * CVE-2026-3921: Use after free in TextEncoding
 * CVE-2026-3922: Use after free in MediaStream
 * CVE-2026-3923: Use after free in WebMIDI
 * CVE-2026-3924: Use after free in WindowDialog
 * CVE-2026-3925: Incorrect security UI in LookalikeChecks
 * CVE-2026-3926: Out of bounds read in V8
 * CVE-2026-3927: Incorrect security UI in PictureInPicture
 * CVE-2026-3928: Insufficient policy enforcement in Extensions
 * CVE-2026-3929: Side-channel information leakage in ResourceTiming
 * CVE-2026-3930: Unsafe navigation in Navigation
 * CVE-2026-3931: Heap buffer overflow in Skia
 * CVE-2026-3932: Insufficient policy enforcement in PDF
 * CVE-2026-3934: Insufficient policy enforcement in ChromeDriver
 * CVE-2026-3935: Incorrect security UI in WebAppInstalls
 * CVE-2026-3936: Use after free in WebView
 * CVE-2026-3937: Incorrect security UI in Downloads
 * CVE-2026-3938: Insufficient policy enforcement in Clipboard
 * CVE-2026-3939: Insufficient policy enforcement in PDF
 * CVE-2026-3940: Insufficient policy enforcement in DevTools
 * CVE-2026-3941: Insufficient policy enforcement in DevTools
 * CVE-2026-3942: Incorrect security UI in PictureInPicture


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected chromium package.

Read more at https://www.tenable.com/plugins/nessus/302490

]]> <![CDATA[Fedora 42 : pgadmin4 (2026-416a89747f)]]> https://www.tenable.com/plugins/nessus/302489 https://www.tenable.com/plugins/nessus/302489 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302489 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-416a89747f advisory.

 Update to pgadmin4-9.13.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected pgadmin4 package.

Read more at https://www.tenable.com/plugins/nessus/302489

]]> <![CDATA[MiracleLinux 8 : python3.12-3.12.12-3.el8_10 (AXSA:2026-308:09)]]> https://www.tenable.com/plugins/nessus/302488 https://www.tenable.com/plugins/nessus/302488 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302488 with Medium Severity

Synopsis

The remote MiracleLinux host is missing one or more security updates.

Description

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-308:09 advisory.

 * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)
 * cpython: IMAP command injection in user-controlled commands (CVE-2025-15366)
 * cpython: POP3 command injection in user-controlled commands (CVE-2025-15367)
 * cpython: email header injection due to unquoted newlines (CVE-2026-1299)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302488

]]> <![CDATA[MiracleLinux 8 : mingw-libpng-1.6.34-2.el8_10 (AXSA:2026-307:02)]]> https://www.tenable.com/plugins/nessus/302487 https://www.tenable.com/plugins/nessus/302487 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302487 with High Severity

Synopsis

The remote MiracleLinux host is missing one or more security updates.

Description

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-307:02 advisory.

 * libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API (CVE-2026-22801)
 * libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read (CVE-2026-22695)
 * libpng: LIBPNG has a heap buffer overflow in png_set_quantize (CVE-2026-25646)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302487

]]> <![CDATA[MiracleLinux 8 : vim-8.0.1763-22.el8_10 (AXSA:2026-306:01)]]> https://www.tenable.com/plugins/nessus/302486 https://www.tenable.com/plugins/nessus/302486 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302486 with Medium Severity

Synopsis

The remote MiracleLinux host is missing a security update.

Description

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-306:01 advisory.

 * vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302486

]]> <![CDATA[EulerOS 2.0 SP12 : ruby (EulerOS-SA-2026-1411)]]> https://www.tenable.com/plugins/nessus/302485 https://www.tenable.com/plugins/nessus/302485 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302485 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.(CVE-2025-61594)

Tenable has extracted the preceding description block directly from the EulerOS ruby security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected ruby packages.

Read more at https://www.tenable.com/plugins/nessus/302485

]]> <![CDATA[EulerOS 2.0 SP12 : rsync (EulerOS-SA-2026-1410)]]> https://www.tenable.com/plugins/nessus/302484 https://www.tenable.com/plugins/nessus/302484 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302484 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the rsync package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The

 malicious

 rsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)

Tenable has extracted the preceding description block directly from the EulerOS rsync security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected rsync packages.

Read more at https://www.tenable.com/plugins/nessus/302484

]]> <![CDATA[EulerOS 2.0 SP12 : golang (EulerOS-SA-2026-1363)]]> https://www.tenable.com/plugins/nessus/302483 https://www.tenable.com/plugins/nessus/302483 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302483 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.(CVE-2025-61724)

 Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.(CVE-2025-58185)

 tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.(CVE-2025-58183)

 Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as 'a=;', an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.(CVE-2025-58186)

 The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: 'http://[::1]/'. IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.(CVE-2025-47912)

 Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.(CVE-2025-61729)

 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non- linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.(CVE-2025-58187)

 The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.(CVE-2025-61723)

 When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.(CVE-2025-58189)

 An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.(CVE-2025-61727)

Tenable has extracted the preceding description block directly from the EulerOS golang security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected golang packages.

Read more at https://www.tenable.com/plugins/nessus/302483

]]> <![CDATA[EulerOS 2.0 SP12 : libsoup (EulerOS-SA-2026-1371)]]> https://www.tenable.com/plugins/nessus/302482 https://www.tenable.com/plugins/nessus/302482 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302482 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw in libsoup's HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.(CVE-2025-14523)

 A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk.(CVE-2026-0719)

Tenable has extracted the preceding description block directly from the EulerOS libsoup security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libsoup packages.

Read more at https://www.tenable.com/plugins/nessus/302482

]]> <![CDATA[EulerOS 2.0 SP10 : util-linux (EulerOS-SA-2026-1352)]]> https://www.tenable.com/plugins/nessus/302481 https://www.tenable.com/plugins/nessus/302481 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302481 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.(CVE-2025-14104)

Tenable has extracted the preceding description block directly from the EulerOS util-linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected util-linux packages.

Read more at https://www.tenable.com/plugins/nessus/302481

]]> <![CDATA[EulerOS 2.0 SP12 : docker-runc (EulerOS-SA-2026-1357)]]> https://www.tenable.com/plugins/nessus/302480 https://www.tenable.com/plugins/nessus/302480 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302480 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.(CVE-2025-52881)

Tenable has extracted the preceding description block directly from the EulerOS docker-runc security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected docker-runc packages.

Read more at https://www.tenable.com/plugins/nessus/302480

]]> <![CDATA[EulerOS 2.0 SP12 : libsodium (EulerOS-SA-2026-1370)]]> https://www.tenable.com/plugins/nessus/302479 https://www.tenable.com/plugins/nessus/302479 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302479 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libsodium package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.(CVE-2025-69277)

Tenable has extracted the preceding description block directly from the EulerOS libsodium security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libsodium packages.

Read more at https://www.tenable.com/plugins/nessus/302479

]]> <![CDATA[EulerOS 2.0 SP12 : cups (EulerOS-SA-2026-1354)]]> https://www.tenable.com/plugins/nessus/302478 https://www.tenable.com/plugins/nessus/302478 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302478 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the cups package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.(CVE-2025-58436)

 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of- bound write. This issue has been patched in version 2.4.15.(CVE-2025-61915)

Tenable has extracted the preceding description block directly from the EulerOS cups security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected cups packages.

Read more at https://www.tenable.com/plugins/nessus/302478

]]> <![CDATA[EulerOS 2.0 SP10 : grub2 (EulerOS-SA-2026-1337)]]> https://www.tenable.com/plugins/nessus/302477 https://www.tenable.com/plugins/nessus/302477 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302477 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.(CVE-2025-61662)

 A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.(CVE-2025-61664)

 A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.(CVE-2025-61663)

 A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited.(CVE-2025-61661)

Tenable has extracted the preceding description block directly from the EulerOS grub2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected grub2 packages.

Read more at https://www.tenable.com/plugins/nessus/302477

]]> <![CDATA[EulerOS 2.0 SP10 : glib2 (EulerOS-SA-2026-1308)]]> https://www.tenable.com/plugins/nessus/302476 https://www.tenable.com/plugins/nessus/302476 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302476 with Critical Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the glib2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.(CVE-2025-14087)

 A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.(CVE-2025-13601)

 A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.(CVE-2025-14512)

 A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).(CVE-2026-0988)

Tenable has extracted the preceding description block directly from the EulerOS glib2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected glib2 packages.

Read more at https://www.tenable.com/plugins/nessus/302476

]]> <![CDATA[EulerOS 2.0 SP12 : python-urllib3 (EulerOS-SA-2026-1409)]]> https://www.tenable.com/plugins/nessus/302475 https://www.tenable.com/plugins/nessus/302475 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302475 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.(CVE-2025-66418)

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
 The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.(CVE-2025-66471)

 urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content- Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.(CVE-2026-21441)

Tenable has extracted the preceding description block directly from the EulerOS python-urllib3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-urllib3 packages.

Read more at https://www.tenable.com/plugins/nessus/302475

]]> <![CDATA[EulerOS 2.0 SP12 : gdb (EulerOS-SA-2026-1358)]]> https://www.tenable.com/plugins/nessus/302474 https://www.tenable.com/plugins/nessus/302474 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302474 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the gdb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c.(CVE-2021-32256)

 A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow.
 The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with '[f]ixed for 2.46'.(CVE-2025-11082)

 A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
 The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.(CVE-2025-11412)

 A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue.(CVE-2025-11494)

 A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be exploited. This patch is called 16357. It is best practice to apply a patch to resolve this issue.(CVE-2025-11840)

 A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
 The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with '[f]ixed for 2.46'.(CVE-2025-11083)

Tenable has extracted the preceding description block directly from the EulerOS gdb security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected gdb packages.

Read more at https://www.tenable.com/plugins/nessus/302474

]]> <![CDATA[EulerOS 2.0 SP10 : python-pip (EulerOS-SA-2026-1321)]]> https://www.tenable.com/plugins/nessus/302473 https://www.tenable.com/plugins/nessus/302473 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302473 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.
 Note that upgrading pip to a 'fixed' version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.

 Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the 'vulnerable' fallback code.

 Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python =3.9.17, =3.10.12, =3.11.4, or =3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.(CVE-2025-8869)

Tenable has extracted the preceding description block directly from the EulerOS python-pip security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-pip packages.

Read more at https://www.tenable.com/plugins/nessus/302473

]]> <![CDATA[EulerOS 2.0 SP12 : glibc (EulerOS-SA-2026-1360)]]> https://www.tenable.com/plugins/nessus/302472 https://www.tenable.com/plugins/nessus/302472 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302472 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.

 Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [162+ 1, 163] and exactly 163 for posix_memalign and aligned_alloc.

 Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.(CVE-2026-0861)

 Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.(CVE-2025-15281)

Tenable has extracted the preceding description block directly from the EulerOS glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected glibc packages.

Read more at https://www.tenable.com/plugins/nessus/302472

]]> <![CDATA[EulerOS 2.0 SP10 : gnupg2 (EulerOS-SA-2026-1335)]]> https://www.tenable.com/plugins/nessus/302471 https://www.tenable.com/plugins/nessus/302471 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302471 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the gnupg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)(CVE-2025-68973)

Tenable has extracted the preceding description block directly from the EulerOS gnupg2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gnupg2 packages.

Read more at https://www.tenable.com/plugins/nessus/302471

]]> <![CDATA[EulerOS 2.0 SP12 : glib2 (EulerOS-SA-2026-1359)]]> https://www.tenable.com/plugins/nessus/302470 https://www.tenable.com/plugins/nessus/302470 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302470 with Critical Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the glib2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).(CVE-2026-0988)

 A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.(CVE-2025-14512)

 A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.(CVE-2025-13601)

 A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.(CVE-2025-14087)

Tenable has extracted the preceding description block directly from the EulerOS glib2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected glib2 packages.

Read more at https://www.tenable.com/plugins/nessus/302470

]]> <![CDATA[EulerOS 2.0 SP10 : libarchive (EulerOS-SA-2026-1340)]]> https://www.tenable.com/plugins/nessus/302469 https://www.tenable.com/plugins/nessus/302469 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302469 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)

Tenable has extracted the preceding description block directly from the EulerOS libarchive security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libarchive packages.

Read more at https://www.tenable.com/plugins/nessus/302469

]]> <![CDATA[EulerOS 2.0 SP10 : containerd (EulerOS-SA-2026-1303)]]> https://www.tenable.com/plugins/nessus/302468 https://www.tenable.com/plugins/nessus/302468 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302468 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the containerd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.(CVE-2025-64329)

 containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions.
 This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.(CVE-2024-25621)

Tenable has extracted the preceding description block directly from the EulerOS containerd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected containerd packages.

Read more at https://www.tenable.com/plugins/nessus/302468

]]> <![CDATA[EulerOS 2.0 SP12 : util-linux (EulerOS-SA-2026-1414)]]> https://www.tenable.com/plugins/nessus/302467 https://www.tenable.com/plugins/nessus/302467 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302467 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.(CVE-2025-14104)

Tenable has extracted the preceding description block directly from the EulerOS util-linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected util-linux packages.

Read more at https://www.tenable.com/plugins/nessus/302467

]]> <![CDATA[EulerOS 2.0 SP12 : grub2 (EulerOS-SA-2026-1364)]]> https://www.tenable.com/plugins/nessus/302466 https://www.tenable.com/plugins/nessus/302466 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302466 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.(CVE-2025-61662)

 A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.(CVE-2025-61664)

 A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.(CVE-2025-54771)

 A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.(CVE-2025-61663)

 A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited.(CVE-2025-61661)

Tenable has extracted the preceding description block directly from the EulerOS grub2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected grub2 packages.

Read more at https://www.tenable.com/plugins/nessus/302466

]]> <![CDATA[EulerOS 2.0 SP10 : python-pip (EulerOS-SA-2026-1347)]]> https://www.tenable.com/plugins/nessus/302465 https://www.tenable.com/plugins/nessus/302465 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302465 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.
 Note that upgrading pip to a 'fixed' version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.

 Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the 'vulnerable' fallback code.

 Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python =3.9.17, =3.10.12, =3.11.4, or =3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.(CVE-2025-8869)

Tenable has extracted the preceding description block directly from the EulerOS python-pip security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-pip packages.

Read more at https://www.tenable.com/plugins/nessus/302465

]]> <![CDATA[EulerOS 2.0 SP12 : python-ldap (EulerOS-SA-2026-1377)]]> https://www.tenable.com/plugins/nessus/302464 https://www.tenable.com/plugins/nessus/302464 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302464 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the python-ldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.(CVE-2025-61911)

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.(CVE-2025-61912)

Tenable has extracted the preceding description block directly from the EulerOS python-ldap security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-ldap packages.

Read more at https://www.tenable.com/plugins/nessus/302464

]]> <![CDATA[EulerOS 2.0 SP12 : gdb (EulerOS-SA-2026-1389)]]> https://www.tenable.com/plugins/nessus/302463 https://www.tenable.com/plugins/nessus/302463 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302463 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the gdb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c.(CVE-2021-32256)

 A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow.
 The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with '[f]ixed for 2.46'.(CVE-2025-11082)

 A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
 The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.(CVE-2025-11412)

 A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue.(CVE-2025-11494)

 A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be exploited. This patch is called 16357. It is best practice to apply a patch to resolve this issue.(CVE-2025-11840)

 A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
 The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with '[f]ixed for 2.46'.(CVE-2025-11083)

Tenable has extracted the preceding description block directly from the EulerOS gdb security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected gdb packages.

Read more at https://www.tenable.com/plugins/nessus/302463

]]> <![CDATA[EulerOS 2.0 SP12 : python3 (EulerOS-SA-2026-1407)]]> https://www.tenable.com/plugins/nessus/302462 https://www.tenable.com/plugins/nessus/302462 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302462 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.(CVE-2025-12084)

 The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.


 Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.(CVE-2025-8291)

 CPython 3.9 and earlier doesn't disallow configuring an empty list ('[]') for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).(CVE-2024-5642)

 When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.(CVE-2025-13836)

 When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues(CVE-2025-13837)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3 packages.

Read more at https://www.tenable.com/plugins/nessus/302462

]]> <![CDATA[EulerOS 2.0 SP12 : python3 (EulerOS-SA-2026-1376)]]> https://www.tenable.com/plugins/nessus/302461 https://www.tenable.com/plugins/nessus/302461 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302461 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.(CVE-2025-12084)

 The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.


 Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.(CVE-2025-8291)

 CPython 3.9 and earlier doesn't disallow configuring an empty list ('[]') for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).(CVE-2024-5642)

 When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.(CVE-2025-13836)

 When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues(CVE-2025-13837)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3 packages.

Read more at https://www.tenable.com/plugins/nessus/302461

]]> <![CDATA[EulerOS 2.0 SP12 : containerd (EulerOS-SA-2026-1384)]]> https://www.tenable.com/plugins/nessus/302460 https://www.tenable.com/plugins/nessus/302460 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302460 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the containerd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.(CVE-2025-64329)

 containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions.
 This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.(CVE-2024-25621)

Tenable has extracted the preceding description block directly from the EulerOS containerd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected containerd packages.

Read more at https://www.tenable.com/plugins/nessus/302460

]]> <![CDATA[EulerOS 2.0 SP10 : httpd (EulerOS-SA-2026-1312)]]> https://www.tenable.com/plugins/nessus/302459 https://www.tenable.com/plugins/nessus/302459 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302459 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.

 This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.

 Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-66200)

 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.

 This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

 Users are recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

 Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd='...' directives.

 This issue affects Apache HTTP Server before 2.4.66.

 Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-58098)

Tenable has extracted the preceding description block directly from the EulerOS httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected httpd packages.

Read more at https://www.tenable.com/plugins/nessus/302459

]]> <![CDATA[EulerOS 2.0 SP12 : gnupg2 (EulerOS-SA-2026-1392)]]> https://www.tenable.com/plugins/nessus/302458 https://www.tenable.com/plugins/nessus/302458 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302458 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the gnupg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)(CVE-2025-68973)

Tenable has extracted the preceding description block directly from the EulerOS gnupg2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gnupg2 packages.

Read more at https://www.tenable.com/plugins/nessus/302458

]]> <![CDATA[EulerOS 2.0 SP10 : golang (EulerOS-SA-2026-1310)]]> https://www.tenable.com/plugins/nessus/302457 https://www.tenable.com/plugins/nessus/302457 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302457 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.(CVE-2025-61729)

 Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.(CVE-2025-58185)

 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non- linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.(CVE-2025-58187)

 The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.(CVE-2025-61723)

Tenable has extracted the preceding description block directly from the EulerOS golang security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected golang packages.

Read more at https://www.tenable.com/plugins/nessus/302457

]]> <![CDATA[EulerOS 2.0 SP12 : ruby (EulerOS-SA-2026-1380)]]> https://www.tenable.com/plugins/nessus/302456 https://www.tenable.com/plugins/nessus/302456 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302456 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.(CVE-2025-61594)

Tenable has extracted the preceding description block directly from the EulerOS ruby security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected ruby packages.

Read more at https://www.tenable.com/plugins/nessus/302456

]]> <![CDATA[EulerOS 2.0 SP12 : libwebsockets (EulerOS-SA-2026-1373)]]> https://www.tenable.com/plugins/nessus/302455 https://www.tenable.com/plugins/nessus/302455 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302455 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libwebsockets package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.(CVE-2025-11678)

Tenable has extracted the preceding description block directly from the EulerOS libwebsockets security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libwebsockets packages.

Read more at https://www.tenable.com/plugins/nessus/302455

]]> <![CDATA[EulerOS 2.0 SP12 : dhcp (EulerOS-SA-2026-1387)]]> https://www.tenable.com/plugins/nessus/302454 https://www.tenable.com/plugins/nessus/302454 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302454 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the dhcp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.
 This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.(CVE-2025-40778)

Tenable has extracted the preceding description block directly from the EulerOS dhcp security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected dhcp packages.

Read more at https://www.tenable.com/plugins/nessus/302454

]]> <![CDATA[EulerOS 2.0 SP10 : avahi (EulerOS-SA-2026-1327)]]> https://www.tenable.com/plugins/nessus/302453 https://www.tenable.com/plugins/nessus/302453 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302453 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the avahi package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.(CVE-2024-52616)

 A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.(CVE-2024-52615)

Tenable has extracted the preceding description block directly from the EulerOS avahi security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected avahi packages.

Read more at https://www.tenable.com/plugins/nessus/302453

]]> <![CDATA[EulerOS 2.0 SP12 : rsync (EulerOS-SA-2026-1379)]]> https://www.tenable.com/plugins/nessus/302452 https://www.tenable.com/plugins/nessus/302452 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302452 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the rsync package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The

 malicious

 rsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)

Tenable has extracted the preceding description block directly from the EulerOS rsync security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected rsync packages.

Read more at https://www.tenable.com/plugins/nessus/302452

]]> <![CDATA[EulerOS 2.0 SP10 : python-urllib3 (EulerOS-SA-2026-1348)]]> https://www.tenable.com/plugins/nessus/302451 https://www.tenable.com/plugins/nessus/302451 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302451 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content- Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.(CVE-2026-21441)

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
 The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.(CVE-2025-66471)

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.(CVE-2025-66418)

Tenable has extracted the preceding description block directly from the EulerOS python-urllib3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-urllib3 packages.

Read more at https://www.tenable.com/plugins/nessus/302451

]]> <![CDATA[EulerOS 2.0 SP10 : python-ldap (EulerOS-SA-2026-1346)]]> https://www.tenable.com/plugins/nessus/302450 https://www.tenable.com/plugins/nessus/302450 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302450 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the python-ldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.(CVE-2025-61911)

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.(CVE-2025-61912)

Tenable has extracted the preceding description block directly from the EulerOS python-ldap security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-ldap packages.

Read more at https://www.tenable.com/plugins/nessus/302450

]]> <![CDATA[EulerOS 2.0 SP12 : httpd (EulerOS-SA-2026-1396)]]> https://www.tenable.com/plugins/nessus/302449 https://www.tenable.com/plugins/nessus/302449 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302449 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd='...' directives.

 This issue affects Apache HTTP Server before 2.4.66.

 Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-58098)

 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.

 This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

 Users are recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

 mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.

 This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.

 Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-66200)

Tenable has extracted the preceding description block directly from the EulerOS httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected httpd packages.

Read more at https://www.tenable.com/plugins/nessus/302449

]]> <![CDATA[EulerOS 2.0 SP10 : gnupg2 (EulerOS-SA-2026-1309)]]> https://www.tenable.com/plugins/nessus/302448 https://www.tenable.com/plugins/nessus/302448 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302448 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the gnupg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)(CVE-2025-68973)

Tenable has extracted the preceding description block directly from the EulerOS gnupg2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gnupg2 packages.

Read more at https://www.tenable.com/plugins/nessus/302448

]]> <![CDATA[EulerOS 2.0 SP12 : grub2 (EulerOS-SA-2026-1395)]]> https://www.tenable.com/plugins/nessus/302447 https://www.tenable.com/plugins/nessus/302447 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302447 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.(CVE-2025-61662)

 A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.(CVE-2025-61664)

 A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.(CVE-2025-54771)

 A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.(CVE-2025-61663)

 A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited.(CVE-2025-61661)

Tenable has extracted the preceding description block directly from the EulerOS grub2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected grub2 packages.

Read more at https://www.tenable.com/plugins/nessus/302447

]]> <![CDATA[EulerOS 2.0 SP12 : dhcp (EulerOS-SA-2026-1356)]]> https://www.tenable.com/plugins/nessus/302446 https://www.tenable.com/plugins/nessus/302446 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302446 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the dhcp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache.
 This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1.(CVE-2025-40778)

Tenable has extracted the preceding description block directly from the EulerOS dhcp security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected dhcp packages.

Read more at https://www.tenable.com/plugins/nessus/302446

]]> <![CDATA[EulerOS 2.0 SP10 : gdb (EulerOS-SA-2026-1333)]]> https://www.tenable.com/plugins/nessus/302445 https://www.tenable.com/plugins/nessus/302445 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302445 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the gdb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
 The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with '[f]ixed for 2.46'.(CVE-2025-11083)

 A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue.(CVE-2025-11494)

 A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow.
 The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with '[f]ixed for 2.46'.(CVE-2025-11082)

 A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
 The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.(CVE-2025-11412)

 A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be exploited. This patch is called 16357. It is best practice to apply a patch to resolve this issue.(CVE-2025-11840)

Tenable has extracted the preceding description block directly from the EulerOS gdb security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected gdb packages.

Read more at https://www.tenable.com/plugins/nessus/302445

]]> <![CDATA[EulerOS 2.0 SP10 : docker-runc (EulerOS-SA-2026-1332)]]> https://www.tenable.com/plugins/nessus/302444 https://www.tenable.com/plugins/nessus/302444 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302444 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.(CVE-2025-31133)

 runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively).
 This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.(CVE-2025-52565)

 runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.(CVE-2025-52881)

Tenable has extracted the preceding description block directly from the EulerOS docker-runc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected docker-runc packages.

Read more at https://www.tenable.com/plugins/nessus/302444

]]> <![CDATA[EulerOS 2.0 SP12 : gnutls (EulerOS-SA-2026-1393)]]> https://www.tenable.com/plugins/nessus/302443 https://www.tenable.com/plugins/nessus/302443 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302443 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.(CVE-2025-9820)

Tenable has extracted the preceding description block directly from the EulerOS gnutls security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gnutls packages.

Read more at https://www.tenable.com/plugins/nessus/302443

]]> <![CDATA[EulerOS 2.0 SP10 : grub2 (EulerOS-SA-2026-1311)]]> https://www.tenable.com/plugins/nessus/302442 https://www.tenable.com/plugins/nessus/302442 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302442 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.(CVE-2025-61662)

 A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.(CVE-2025-61664)

 A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.(CVE-2025-61663)

 A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited.(CVE-2025-61661)

Tenable has extracted the preceding description block directly from the EulerOS grub2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected grub2 packages.

Read more at https://www.tenable.com/plugins/nessus/302442

]]> <![CDATA[EulerOS 2.0 SP10 : libpng (EulerOS-SA-2026-1341)]]> https://www.tenable.com/plugins/nessus/302441 https://www.tenable.com/plugins/nessus/302441 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302441 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the libpng package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.(CVE-2025-64506)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of- bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component alpha 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.(CVE-2025-64720)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
 Upgrade to libpng 1.6.52 or later.(CVE-2025-66293)

Tenable has extracted the preceding description block directly from the EulerOS libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libpng packages.

Read more at https://www.tenable.com/plugins/nessus/302441

]]> <![CDATA[EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-1305)]]> https://www.tenable.com/plugins/nessus/302440 https://www.tenable.com/plugins/nessus/302440 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302440 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

 When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts
 *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.(CVE-2025-15079)

 When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

 When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers.

 Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.(CVE-2025-14017)

Tenable has extracted the preceding description block directly from the EulerOS curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected curl packages.

Read more at https://www.tenable.com/plugins/nessus/302440

]]> <![CDATA[EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-1366)]]> https://www.tenable.com/plugins/nessus/302439 https://www.tenable.com/plugins/nessus/302439 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302439 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-cork.(CVE-2025-39913)

 md: fix rcu protection in md_wakeup_thread(CVE-2025-68374)

 usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer(CVE-2025-68331)

 fs: dlm: fix invalid derefence of sb_lvbptr(CVE-2022-50516)

 net: atlantic: fix fragment overflow handling in RX path(CVE-2025-68301)

 netfilter: nf_reject: don't leak dst refcount for loopback packets(CVE-2025-38732)

 net: ipv6: fix field-spanning memcpy warning in AH output(CVE-2025-40363)

 net/mlx5e: Remove skb secpath if xfrm state is not found(CVE-2025-38590)

 fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

 Squashfs: fix uninit-value in squashfs_get_parent(CVE-2025-40049)

 scsi: lpfc: Fix buffer free/clear order in deferred receive path(CVE-2025-39841)

 media: imon: make send_packet() more robust(CVE-2025-68194)

 libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

 pid: Add a judgment for ns null in pid_nr_ns(CVE-2025-40178)

 scsi: qla2xxx: Clear cmds after chip reset(CVE-2025-68745)

 ACPI: video: Fix use-after-free in acpi_video_switch_brightness()(CVE-2025-40211)

 tty: n_gsm: fix deadlock and link starvation in outgoing data path(CVE-2022-50116)

 nexthop: Forbid FDB status change while nexthop is in a group(CVE-2025-39980)

 icmp6: Fix null-ptr-deref of ip6_null_entry-rt6i_idev in icmp6_dev().(CVE-2023-53343)

 i40e: remove read access to debugfs files(CVE-2025-39901)

 raw: Fix NULL deref in raw_get_next().(CVE-2023-53198)

 NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid(CVE-2025-68349)

 sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto(CVE-2025-40281)

 RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device(CVE-2023-53393)

 netfilter: nft_objref: validate objref and objrefmap expressions(CVE-2025-40206)

 cifs: fix session state check in reconnect to avoid use-after-free issue(CVE-2023-53794)

 cifs: parse_dfs_referrals: prevent oob on malformed input(CVE-2025-40099)

 crypto: af_alg - Set merge to zero early in af_alg_sendmsg(CVE-2025-39931)

 nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.(CVE-2025-38400)

 fs: Prevent file descriptor table allocations exceeding INT_MAX(CVE-2025-39756)

 mtd: core: fix possible resource leak in init_mtd()(CVE-2022-50304)

 ipv4: start using dst_dev_rcu()(CVE-2025-40074)

 bpf: Reject narrower access to pointer ctx fields(CVE-2025-38591)

 RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()(CVE-2023-53335)

 bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}(CVE-2025-40183)

 Squashfs: reject negative file sizes in squashfs_read_inode()(CVE-2025-40200)

 nvme-multipath: fix lockdep WARN due to partition scan work(CVE-2025-68218)

 fbdev: fix potential buffer overflow in do_register_framebuffer()(CVE-2025-38702)

 PCI/AER: Fix NULL pointer access by aer_info(CVE-2025-68309)

 x86/apic: Don't disable x2APIC if locked(CVE-2022-50720)

 netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm(CVE-2025-39894)

 fuse: fix livelock in synchronous file put from fuseblk workers(CVE-2025-40220)

 md/raid1: Fix stack memory use after return in raid1_reshape(CVE-2025-38445)

 iommu/amd: Avoid stack buffer overflow from kernel cmdline(CVE-2025-38676)

 ext4: fix off-by-one errors in fast-commit block filling(CVE-2022-50428)

 Squashfs: check return result of sb_min_blocksize(CVE-2025-38415)

 ext4: refresh inline data size before write operations(CVE-2025-68264)

 bpf: Sync pending IRQ work before freeing ring buffer(CVE-2025-40319)

 block: avoid possible overflow for chunk_sectors check in blk_stack_limits()(CVE-2025-39795)

 xfrm: Zero padding when dumping algos and encap(CVE-2023-53684)

 crypto: hisilicon/qm - request reserved interrupt for virtual function(CVE-2025-40136)

 scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()(CVE-2025-68229)

 nbd: defer config unlock in nbd_genl_connect(CVE-2025-68366)

 virtiofs: add filesystem context source name check(CVE-2025-37773)

 net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast(CVE-2025-40140)

 page_pool: always add GFP_NOWARN for ATOMIC allocations(CVE-2025-68321)

 i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path(CVE-2025-39911)

 drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE(CVE-2025-40277)

 qed: allow sleep in qed_mcp_trace_dump()(CVE-2023-53509)

 IB/mad: Don't call to function that might sleep while in atomic context(CVE-2022-50472)

 net: openvswitch: remove never-working support for setting nsh fields(CVE-2025-40254)

 md/raid0, raid10: Don't set discard sectors for request queue(CVE-2022-50583)

 futex: Don't leak robust_list pointer on exec race(CVE-2025-40341)

 x86/MCE: Always save CS register on AMD Zen IF Poison errors(CVE-2023-53438)

 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item(CVE-2025-68211)

 tcp_metrics: use dst_dev_net_rcu()(CVE-2025-40075)

 net/ip6_tunnel: Prevent perpetual tunnel growth(CVE-2025-40173)

 fbdev: bitblit: bound-check glyph index in bit_putcs*(CVE-2025-40322)

 xfs: do not propagate ENODATA disk errors into xattr code(CVE-2025-39835)

 scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write(CVE-2023-53282)

 smb: client: fix race with concurrent opens in rename(2)(CVE-2025-39825)

 PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type(CVE-2025-23161)

 tipc: Fix use-after-free in tipc_mon_reinit_self().(CVE-2025-40280)

 usbnet: Fix using smp_processor_id() in preemptible code warnings(CVE-2025-40164)

 mm/hugetlb: fix folio is still mapped when deleted(CVE-2025-40006)

 binfmt_misc: restore write access before closing files opened by open_exec()(CVE-2025-68239)

 scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT(CVE-2022-49534)

 smb: client: Fix refcount leak for cifs_sb_tlink(CVE-2025-40103)

 KVM: x86: use array_index_nospec with indices that come from guest(CVE-2025-39823)

 bpf: Fix invalid prog-stats access when update_effective_progs fails(CVE-2025-68742)

 of: check previous kernel's ima-kexec-buffer against memory bounds(CVE-2022-50159)

 media: tuner: xc5000: Fix use-after-free in xc5000_release(CVE-2025-39994)

 i40e: fix idx validation in i40e_validate_queue_map(CVE-2025-39972)

 net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()(CVE-2025-40252)

 __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock(CVE-2025-38058)

 ipv6: prevent infinite loop in rt6_nlmsg_size()(CVE-2025-38588)

 vsock: Ignore signal/timeout on connect() if already established(CVE-2025-40248)

 cifs: fix mid leak during reconnection after timeout threshold(CVE-2023-53597)

 ixgbevf: fix mailbox API compatibility by negotiating supported features(CVE-2025-40104)

 iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()(CVE-2023-53476)

 usb: storage: sddr55: Reject out-of-bound new_pba(CVE-2025-40345)

 drm/vmwgfx: Fix Use-after-free in validation(CVE-2025-40111)

 sctp: initialize more fields in sctp_v6_from_sk()(CVE-2025-39812)

 mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race(CVE-2025-38085)

 media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()(CVE-2025-38694)

 crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id(CVE-2025-68724)

 netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed(CVE-2022-50500)

 net: bridge: fix soft lockup in br_multicast_query_expired()(CVE-2025-39773)

 cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

 blk-mq: fix NULL dereference on q-elevator in blk_mq_elv_switch_none(CVE-2023-53292)

 ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

 pinctrl: check the return value of pinmux_ops::get_function_name()(CVE-2025-40030)

 of: overlay: Call of_changeset_init() early(CVE-2023-53856)

 macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse(CVE-2025-68367)

 fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

 ipv6/sit: use DEV_STATS_INC() to avoid data-races(CVE-2022-50764)

 sctp: linearize cloned gso packets in sctp_rcv(CVE-2025-38718)

 timers: Fix NULL function pointer race in timer_shutdown_sync()(CVE-2025-68214)

 ARM: 9317/1: kexec: Make smp stop calls asynchronous(CVE-2023-53712)

 media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()(CVE-2025-39713)

 drm/vmwgfx: Fix a null-ptr access in the cursor snooper(CVE-2025-40110)

 sctp: Fix MAC comparison to be constant-time(CVE-2025-40204)

 scsi: st: Fix array overflow in st_setup()(CVE-2025-37857)

 ceph: fix potential use-after-free bug when trimming caps(CVE-2023-53867)

 sctp: avoid NULL dereference when chunk data buffer is missing(CVE-2025-40240)

 x86/fpu: Ensure XFD state on signal delivery(CVE-2025-68171)

 mm/compaction: fix UBSAN shift-out-of-bounds warning(CVE-2025-21815)

 netfilter: xt_nfacct: don't assume acct name is null-terminated(CVE-2025-38639)

 usb: typec: ucsi: displayport: Fix NULL pointer access(CVE-2025-37994)

 NFSD: free copynotify stateid in nfs4_free_ol_stateid()(CVE-2025-40273)

 RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction(CVE-2025-38161)

 scsi: target: Fix multiple LUN_RESET handling(CVE-2023-53586)

 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr(CVE-2025-68183)

 bpf: Add preempt_count_{sub,add} into btf id deny list(CVE-2023-54086)

 tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().(CVE-2025-40186)

 bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls(CVE-2025-38608)

 smb: client: fix memory leak in cifs_construct_tcon()(CVE-2025-68295)

 bpf: Fix stackmap overflow check in __bpf_get_stackid()(CVE-2025-68378)

 usb: early: xhci-dbc: Fix a potential out-of-bound memory access(CVE-2023-53840)

 scsi: libiscsi: Initialize iscsi_conn-dd_data only if memory is allocated(CVE-2025-38700)

 usbnet: Prevents free active kevent(CVE-2025-68312)

 media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove(CVE-2025-39996)

 xfrm: delete x-tunnel as we delete x(CVE-2025-40215)

 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()(CVE-2025-40346)

 eventpoll: Fix semi-unbounded recursion(CVE-2025-38614)

 smb3: fix for slab out of bounds on mount to ksmbd(CVE-2025-38728)

 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()(CVE-2025-38724)

 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()(CVE-2025-68188)

 software node: Correct a OOB check in software_node_get_reference_args()(CVE-2025-38342)

 jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted(CVE-2025-68337)

 be2net: pass wrb_params in case of OS2BMC be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site.(CVE-2025-40264)

 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request(CVE-2025-38430)

 net: dlink: handle copy_thresh allocation failure(CVE-2025-40053)

 net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer(CVE-2025-39937)

 nfs4_setup_readdir(): insufficient locking for -d_parent-d_inode dereferencing(CVE-2025-68185)

 dm-stripe: fix a possible integer overflow(CVE-2025-39940)

 netfilter: ctnetlink: fix refcount leak on table dump(CVE-2025-38721)

 RDMA/rxe: Fix null deref on srq-rq.queue after resize failure(CVE-2025-68379)

 usb: typec: ucsi: displayport: Fix deadlock(CVE-2025-37967)

 netdevsim: fix memory leak in nsim_bus_dev_new()(CVE-2022-50772)

 ceph: fix race condition validating r_parent before applying state(CVE-2025-39927)

 bnxt_en: Fix memory corruption when FW resources change during ifdown(CVE-2025-39810)

 virtio_net: Fix error unwinding of XDP initialization(CVE-2023-53499)

 virtio: break and reset virtio devices on device_shutdown()(CVE-2025-38064)

 NFS: Fix a race when updating an existing write(CVE-2025-39697)

 nvme-fc: use lock accessing port_state and rport state(CVE-2025-40342)

 net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM(CVE-2025-39770)

 NFSD: fix race between nfsd registration and exports_proc(CVE-2025-38232)

 net: netpoll: fix incorrect refcount handling causing incorrect cleanup(CVE-2025-68245)

 bpf: Fix issue in verifying allow_ptr_leaks(CVE-2023-54181)

 cifs: Fix connections leak when tlink setup failed(CVE-2022-49822)

 cifs: avoid NULL pointer dereference in dbg call(CVE-2025-37844)

 objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()(CVE-2025-37937)

 bpf: Explicitly check accesses to bpf_sock_addr(CVE-2025-40078)

 nvmet-fc: avoid scheduling association deletion twice(CVE-2025-40343)

 md/raid1,raid10: don't ignore IO flags(CVE-2025-22125)

 KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT(CVE-2022-50224)

 vfio/type1: prevent underflow of locked_vm via exec()(CVE-2023-53171)

 RDMA/bnxt_re: Prevent handling any completions after qp destroy(CVE-2023-54048)

 ipv6: fix possible infinite loop in fib6_info_uses_dev()(CVE-2025-38587)

 mm: hugetlb: avoid soft lockup when mprotect to large memory area(CVE-2025-40153)

 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup(CVE-2025-68192)

 tcp: Clear tcp_sk(sk)-fastopen_rsk in tcp_disconnect().(CVE-2025-39955)

 udp_tunnel: use netdev_warn() instead of netdev_WARN()(CVE-2025-68191)

 mm/vmscan: don't try to reclaim hwpoison folio(CVE-2025-37834)

 ima: Handle error code returned by ima_filter_rule_match()(CVE-2025-68740)

 bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log(CVE-2023-54145)

 net/mlx5e: Move representor neigh cleanup to profile cleanup_tx(CVE-2023-54148)

 dma-buf: insert memory barrier before updating num_fences(CVE-2025-38095)

 bpf: Do not let BPF test infra emit invalid GSO types to stack(CVE-2025-68725)

 ext4: guard against EA inode refcount underflow in xattr update(CVE-2025-40190)

 iavf: use internal state to free traffic IRQs(CVE-2023-53850)

 genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie(CVE-2025-38062)

 mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list(CVE-2025-39725)

 nbd: restrict sockets to TCP and UDP(CVE-2025-40080)

 crypto: hisilicon/qm - set NULL to qm-debug.qm_diff_regs(CVE-2025-40062)

 libceph: replace BUG_ON with bounds check for map-max_osd(CVE-2025-68283)

 ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe(CVE-2025-68241)

 net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()(CVE-2025-40187)

 fbcon: Set fb_display[i]-mode to NULL when the mode is released(CVE-2025-40323)

 net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error(CVE-2025-21924)

 HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()(CVE-2025-39808)

 ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()(CVE-2025-68261)

 ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()(CVE-2025-40198)

 scsi: sg: Do not sleep in atomic context(CVE-2025-40259)

 drm/scheduler: fix fence ref counting(CVE-2022-49829)

 nvmet-fc: move lsop put work to nvmet_fc_ls_req_op(CVE-2025-40171)

 PCI: Fix reference leak in pci_register_host_bridge()(CVE-2025-37836)

 scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

 Drivers: hv: vmbus: Don't dereference ACPI root object handle(CVE-2023-53647)

 tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().(CVE-2025-40149)

 NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()(CVE-2025-39730)

 vxlan: Annotate FDB data races(CVE-2025-38037)

 iio: common: st_sensors: Fix use of uninitialize device structs(CVE-2025-38531)

 usb: storage: Fix memory leak in USB bulk transport(CVE-2025-68288)

 cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()(CVE-2025-40194)

 cifs: prevent NULL pointer dereference in UTF16 conversion(CVE-2025-39838)

 scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

 netfilter: nft_ct: add seqadj extension for natted connections(CVE-2025-68206)

 mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

 regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex(CVE-2025-68354)

 bpf: Enforce expected_attach_type for tailcall compatibility(CVE-2025-40123)

 media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID(CVE-2025-40016)

 scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

 block: fix resource leak in blk_register_queue() error path(CVE-2025-37980)

 blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx(CVE-2025-40125)

 NFSD: Fix crash in nfsd4_read_release()(CVE-2025-40324)

 RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug(CVE-2025-38024)

 vsock: Fix transport_* TOCTOU(CVE-2025-38461)

 net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree(CVE-2025-38468)

 e1000: fix OOB in e1000_tbi_should_accept()(CVE-2025-71093)

 mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats(CVE-2025-68800)

 iavf: Fix reset error handling(CVE-2022-50053)

 net/mlx5: Handle pairing of E-switch via uplink un/load APIs(CVE-2023-53347)

 vsock: Fix transport_{g2h,h2g} TOCTOU(CVE-2025-38462)

 x86/fpu: Drop fpregs lock before inheriting FPU permissions(CVE-2022-49783)

 fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds(CVE-2025-40304)

 net: phy: mscc: Fix memory leak when using one step timestamping(CVE-2025-38148)

 RDMA/hns: Fix double destruction of rsv_qp(CVE-2025-38582)

 mlxsw: spectrum_router: Fix neighbour use-after-free(CVE-2025-68801)

 net_sched: sch_sfq: reject invalid perturb period(CVE-2025-38193)

 iavf: fix off-by-one issues in iavf_config_rss_reg()(CVE-2025-71087)

 RDMA/rxe: Fix incomplete state save in rxe_requester(CVE-2023-53539)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel packages.

Read more at https://www.tenable.com/plugins/nessus/302439

]]> <![CDATA[EulerOS 2.0 SP10 : python3 (EulerOS-SA-2026-1345)]]> https://www.tenable.com/plugins/nessus/302438 https://www.tenable.com/plugins/nessus/302438 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302438 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.


 Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.(CVE-2025-8291)

 When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.(CVE-2025-12084)

 When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.(CVE-2025-13836)

 When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues(CVE-2025-13837)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3 packages.

Read more at https://www.tenable.com/plugins/nessus/302438

]]> <![CDATA[EulerOS 2.0 SP10 : libpng (EulerOS-SA-2026-1315)]]> https://www.tenable.com/plugins/nessus/302437 https://www.tenable.com/plugins/nessus/302437 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302437 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the libpng package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.(CVE-2025-64506)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of- bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when processing palette images with PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly applies background compositing during premultiplication, violating the invariant component alpha 257 required by the simplified PNG API. This issue has been patched in version 1.6.51.(CVE-2025-64720)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
 Upgrade to libpng 1.6.52 or later.(CVE-2025-66293)

Tenable has extracted the preceding description block directly from the EulerOS libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libpng packages.

Read more at https://www.tenable.com/plugins/nessus/302437

]]> <![CDATA[EulerOS 2.0 SP10 : binutils (EulerOS-SA-2026-1328)]]> https://www.tenable.com/plugins/nessus/302436 https://www.tenable.com/plugins/nessus/302436 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302436 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the binutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
 The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.(CVE-2025-11412)

Tenable has extracted the preceding description block directly from the EulerOS binutils security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected binutils packages.

Read more at https://www.tenable.com/plugins/nessus/302436

]]> <![CDATA[EulerOS 2.0 SP10 : libarchive (EulerOS-SA-2026-1314)]]> https://www.tenable.com/plugins/nessus/302435 https://www.tenable.com/plugins/nessus/302435 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302435 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)

Tenable has extracted the preceding description block directly from the EulerOS libarchive security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libarchive packages.

Read more at https://www.tenable.com/plugins/nessus/302435

]]> <![CDATA[EulerOS 2.0 SP12 : samba (EulerOS-SA-2026-1412)]]> https://www.tenable.com/plugins/nessus/302434 https://www.tenable.com/plugins/nessus/302434 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302434 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Tenable has extracted the preceding description block directly from the EulerOS samba security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected samba packages.

Read more at https://www.tenable.com/plugins/nessus/302434

]]> <![CDATA[EulerOS 2.0 SP12 : docker-runc (EulerOS-SA-2026-1388)]]> https://www.tenable.com/plugins/nessus/302433 https://www.tenable.com/plugins/nessus/302433 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302433 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.(CVE-2025-52881)

Tenable has extracted the preceding description block directly from the EulerOS docker-runc security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected docker-runc packages.

Read more at https://www.tenable.com/plugins/nessus/302433

]]> <![CDATA[EulerOS 2.0 SP12 : glib2 (EulerOS-SA-2026-1390)]]> https://www.tenable.com/plugins/nessus/302432 https://www.tenable.com/plugins/nessus/302432 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302432 with Critical Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the glib2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).(CVE-2026-0988)

 A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.(CVE-2025-14512)

 A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.(CVE-2025-13601)

 A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.(CVE-2025-14087)

Tenable has extracted the preceding description block directly from the EulerOS glib2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected glib2 packages.

Read more at https://www.tenable.com/plugins/nessus/302432

]]> <![CDATA[EulerOS 2.0 SP12 : sssd (EulerOS-SA-2026-1382)]]> https://www.tenable.com/plugins/nessus/302431 https://www.tenable.com/plugins/nessus/302431 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302431 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.(CVE-2025-11561)

Tenable has extracted the preceding description block directly from the EulerOS sssd security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected sssd packages.

Read more at https://www.tenable.com/plugins/nessus/302431

]]> <![CDATA[EulerOS 2.0 SP10 : net-snmp (EulerOS-SA-2026-1344)]]> https://www.tenable.com/plugins/nessus/302430 https://www.tenable.com/plugins/nessus/302430 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302430 with Critical Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash. This issue has been patched in versions 5.9.5 and 5.10.pre2.(CVE-2025-68615)

Tenable has extracted the preceding description block directly from the EulerOS net-snmp security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected net-snmp packages.

Read more at https://www.tenable.com/plugins/nessus/302430

]]> <![CDATA[EulerOS 2.0 SP10 : libtasn1 (EulerOS-SA-2026-1343)]]> https://www.tenable.com/plugins/nessus/302429 https://www.tenable.com/plugins/nessus/302429 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302429 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libtasn1 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.(CVE-2025-13151)

Tenable has extracted the preceding description block directly from the EulerOS libtasn1 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libtasn1 packages.

Read more at https://www.tenable.com/plugins/nessus/302429

]]> <![CDATA[EulerOS 2.0 SP10 : libtasn1 (EulerOS-SA-2026-1317)]]> https://www.tenable.com/plugins/nessus/302428 https://www.tenable.com/plugins/nessus/302428 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302428 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libtasn1 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.(CVE-2025-13151)

Tenable has extracted the preceding description block directly from the EulerOS libtasn1 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libtasn1 packages.

Read more at https://www.tenable.com/plugins/nessus/302428

]]> <![CDATA[EulerOS 2.0 SP10 : cups (EulerOS-SA-2026-1330)]]> https://www.tenable.com/plugins/nessus/302427 https://www.tenable.com/plugins/nessus/302427 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302427 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the cups package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of- bound write. This issue has been patched in version 2.4.15.(CVE-2025-61915)

 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.(CVE-2025-58436)

Tenable has extracted the preceding description block directly from the EulerOS cups security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected cups packages.

Read more at https://www.tenable.com/plugins/nessus/302427

]]> <![CDATA[EulerOS 2.0 SP10 : docker-runc (EulerOS-SA-2026-1306)]]> https://www.tenable.com/plugins/nessus/302426 https://www.tenable.com/plugins/nessus/302426 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302426 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount (i.e., the container's /dev/null) was actually a real /dev/null inode when using the container's /dev/null to mask. This exposes two methods of attack: an arbitrary mount gadget, leading to host information disclosure, host denial of service, container escape, or a bypassing of maskedPaths. This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.(CVE-2025-31133)

 runc is a CLI tool for spawning and running containers according to the OCI specification. Versions 1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to `/dev/console` as configured for all containers that allocate a console). This happens after `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively).
 This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3.(CVE-2025-52565)

 runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.(CVE-2025-52881)

Tenable has extracted the preceding description block directly from the EulerOS docker-runc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected docker-runc packages.

Read more at https://www.tenable.com/plugins/nessus/302426

]]> <![CDATA[EulerOS 2.0 SP12 : libxslt (EulerOS-SA-2026-1405)]]> https://www.tenable.com/plugins/nessus/302425 https://www.tenable.com/plugins/nessus/302425 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302425 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libxslt package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.(CVE-2025-10911)

Tenable has extracted the preceding description block directly from the EulerOS libxslt security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libxslt packages.

Read more at https://www.tenable.com/plugins/nessus/302425

]]> <![CDATA[EulerOS 2.0 SP10 : gdb (EulerOS-SA-2026-1307)]]> https://www.tenable.com/plugins/nessus/302424 https://www.tenable.com/plugins/nessus/302424 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302424 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the gdb packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
 The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended to deploy a patch. The code maintainer replied with '[f]ixed for 2.46'.(CVE-2025-11083)

 A vulnerability was found in GNU Binutils 2.45. Impacted is the function _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally. The exploit has been made public and could be used. The patch is identified as b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a. A patch should be applied to remediate this issue.(CVE-2025-11494)

 A flaw has been found in GNU Binutils 2.45. Impacted is the function _bfd_elf_parse_eh_frame of the file bfd/elf-eh-frame.c of the component Linker. Executing manipulation can lead to heap-based buffer overflow.
 The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ea1a0737c7692737a644af0486b71e4a392cbca8. A patch should be applied to remediate this issue. The code maintainer replied with '[f]ixed for 2.46'.(CVE-2025-11082)

 A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
 The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.(CVE-2025-11412)

 A weakness has been identified in GNU Binutils 2.45. The affected element is the function vfinfo of the file ldmisc.c. Executing manipulation can lead to out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could be exploited. This patch is called 16357. It is best practice to apply a patch to resolve this issue.(CVE-2025-11840)

Tenable has extracted the preceding description block directly from the EulerOS gdb security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected gdb packages.

Read more at https://www.tenable.com/plugins/nessus/302424

]]> <![CDATA[EulerOS 2.0 SP12 : libtasn1 (EulerOS-SA-2026-1372)]]> https://www.tenable.com/plugins/nessus/302423 https://www.tenable.com/plugins/nessus/302423 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302423 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libtasn1 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.(CVE-2025-13151)

Tenable has extracted the preceding description block directly from the EulerOS libtasn1 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libtasn1 packages.

Read more at https://www.tenable.com/plugins/nessus/302423

]]> <![CDATA[EulerOS 2.0 SP10 : libsoup (EulerOS-SA-2026-1316)]]> https://www.tenable.com/plugins/nessus/302422 https://www.tenable.com/plugins/nessus/302422 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302422 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw in libsoup's HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.(CVE-2025-14523)

Tenable has extracted the preceding description block directly from the EulerOS libsoup security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libsoup packages.

Read more at https://www.tenable.com/plugins/nessus/302422

]]> <![CDATA[EulerOS 2.0 SP10 : python-urllib3 (EulerOS-SA-2026-1322)]]> https://www.tenable.com/plugins/nessus/302421 https://www.tenable.com/plugins/nessus/302421 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302421 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content- Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.(CVE-2026-21441)

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
 The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.(CVE-2025-66471)

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.(CVE-2025-66418)

Tenable has extracted the preceding description block directly from the EulerOS python-urllib3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-urllib3 packages.

Read more at https://www.tenable.com/plugins/nessus/302421

]]> <![CDATA[EulerOS 2.0 SP10 : avahi (EulerOS-SA-2026-1301)]]> https://www.tenable.com/plugins/nessus/302420 https://www.tenable.com/plugins/nessus/302420 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302420 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the avahi package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs.(CVE-2024-52616)

 A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected.(CVE-2024-52615)

Tenable has extracted the preceding description block directly from the EulerOS avahi security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected avahi packages.

Read more at https://www.tenable.com/plugins/nessus/302420

]]> <![CDATA[EulerOS 2.0 SP12 : httpd (EulerOS-SA-2026-1365)]]> https://www.tenable.com/plugins/nessus/302419 https://www.tenable.com/plugins/nessus/302419 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302419 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd='...' directives.

 This issue affects Apache HTTP Server before 2.4.66.

 Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-58098)

 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.

 This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

 Users are recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

 mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.

 This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.

 Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-66200)

Tenable has extracted the preceding description block directly from the EulerOS httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected httpd packages.

Read more at https://www.tenable.com/plugins/nessus/302419

]]> <![CDATA[EulerOS 2.0 SP12 : cups (EulerOS-SA-2026-1385)]]> https://www.tenable.com/plugins/nessus/302418 https://www.tenable.com/plugins/nessus/302418 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302418 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the cups package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.(CVE-2025-58436)

 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of- bound write. This issue has been patched in version 2.4.15.(CVE-2025-61915)

Tenable has extracted the preceding description block directly from the EulerOS cups security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected cups packages.

Read more at https://www.tenable.com/plugins/nessus/302418

]]> <![CDATA[EulerOS 2.0 SP10 : httpd (EulerOS-SA-2026-1338)]]> https://www.tenable.com/plugins/nessus/302417 https://www.tenable.com/plugins/nessus/302417 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302417 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.

 This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.

 Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-66200)

 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.

 This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.

 Users are recommended to upgrade to version 2.4.66 which fixes the issue.(CVE-2025-65082)

 Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd='...' directives.

 This issue affects Apache HTTP Server before 2.4.66.

 Users are recommended to upgrade to version 2.4.66, which fixes the issue.(CVE-2025-58098)

Tenable has extracted the preceding description block directly from the EulerOS httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected httpd packages.

Read more at https://www.tenable.com/plugins/nessus/302417

]]> <![CDATA[EulerOS 2.0 SP12 : libtasn1 (EulerOS-SA-2026-1403)]]> https://www.tenable.com/plugins/nessus/302416 https://www.tenable.com/plugins/nessus/302416 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302416 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libtasn1 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.(CVE-2025-13151)

Tenable has extracted the preceding description block directly from the EulerOS libtasn1 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libtasn1 packages.

Read more at https://www.tenable.com/plugins/nessus/302416

]]> <![CDATA[EulerOS 2.0 SP12 : libarchive (EulerOS-SA-2026-1398)]]> https://www.tenable.com/plugins/nessus/302415 https://www.tenable.com/plugins/nessus/302415 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302415 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)

Tenable has extracted the preceding description block directly from the EulerOS libarchive security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libarchive packages.

Read more at https://www.tenable.com/plugins/nessus/302415

]]> <![CDATA[EulerOS 2.0 SP10 : rsync (EulerOS-SA-2026-1323)]]> https://www.tenable.com/plugins/nessus/302414 https://www.tenable.com/plugins/nessus/302414 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302414 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the rsync package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The

 malicious

 rsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)

Tenable has extracted the preceding description block directly from the EulerOS rsync security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected rsync packages.

Read more at https://www.tenable.com/plugins/nessus/302414

]]> <![CDATA[EulerOS 2.0 SP10 : samba (EulerOS-SA-2026-1351)]]> https://www.tenable.com/plugins/nessus/302413 https://www.tenable.com/plugins/nessus/302413 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302413 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Tenable has extracted the preceding description block directly from the EulerOS samba security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected samba packages.

Read more at https://www.tenable.com/plugins/nessus/302413

]]> <![CDATA[EulerOS 2.0 SP12 : net-snmp (EulerOS-SA-2026-1406)]]> https://www.tenable.com/plugins/nessus/302412 https://www.tenable.com/plugins/nessus/302412 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302412 with Critical Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash. This issue has been patched in versions 5.9.5 and 5.10.pre2.(CVE-2025-68615)

Tenable has extracted the preceding description block directly from the EulerOS net-snmp security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected net-snmp packages.

Read more at https://www.tenable.com/plugins/nessus/302412

]]> <![CDATA[EulerOS 2.0 SP10 : samba (EulerOS-SA-2026-1325)]]> https://www.tenable.com/plugins/nessus/302411 https://www.tenable.com/plugins/nessus/302411 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302411 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Tenable has extracted the preceding description block directly from the EulerOS samba security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected samba packages.

Read more at https://www.tenable.com/plugins/nessus/302411

]]> <![CDATA[EulerOS 2.0 SP10 : libsoup (EulerOS-SA-2026-1342)]]> https://www.tenable.com/plugins/nessus/302410 https://www.tenable.com/plugins/nessus/302410 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302410 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw in libsoup's HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.(CVE-2025-14523)

Tenable has extracted the preceding description block directly from the EulerOS libsoup security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libsoup packages.

Read more at https://www.tenable.com/plugins/nessus/302410

]]> <![CDATA[EulerOS 2.0 SP10 : golang (EulerOS-SA-2026-1336)]]> https://www.tenable.com/plugins/nessus/302409 https://www.tenable.com/plugins/nessus/302409 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302409 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.(CVE-2025-61729)

 Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.(CVE-2025-58185)

 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non- linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.(CVE-2025-58187)

 The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.(CVE-2025-61723)

Tenable has extracted the preceding description block directly from the EulerOS golang security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected golang packages.

Read more at https://www.tenable.com/plugins/nessus/302409

]]> <![CDATA[EulerOS 2.0 SP12 : libpng (EulerOS-SA-2026-1369)]]> https://www.tenable.com/plugins/nessus/302408 https://www.tenable.com/plugins/nessus/302408 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302408 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the libpng package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of- bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.(CVE-2025-64506)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
 Upgrade to libpng 1.6.52 or later.(CVE-2025-66293)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018.
 This vulnerability is fixed in 1.6.54.(CVE-2026-22695)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.(CVE-2026-22801)

Tenable has extracted the preceding description block directly from the EulerOS libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libpng packages.

Read more at https://www.tenable.com/plugins/nessus/302408

]]> <![CDATA[EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-1386)]]> https://www.tenable.com/plugins/nessus/302407 https://www.tenable.com/plugins/nessus/302407 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302407 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers.

 Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.(CVE-2025-14017)

 When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

 When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

 When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts
 *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.(CVE-2025-15079)

Tenable has extracted the preceding description block directly from the EulerOS curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected curl packages.

Read more at https://www.tenable.com/plugins/nessus/302407

]]> <![CDATA[EulerOS 2.0 SP10 : python3 (EulerOS-SA-2026-1319)]]> https://www.tenable.com/plugins/nessus/302406 https://www.tenable.com/plugins/nessus/302406 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302406 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.


 Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.(CVE-2025-8291)

 When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents.(CVE-2025-12084)

 When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS.(CVE-2025-13836)

 When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues(CVE-2025-13837)

Tenable has extracted the preceding description block directly from the EulerOS python3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3 packages.

Read more at https://www.tenable.com/plugins/nessus/302406

]]> <![CDATA[EulerOS 2.0 SP10 : kernel (EulerOS-SA-2026-1313)]]> https://www.tenable.com/plugins/nessus/302405 https://www.tenable.com/plugins/nessus/302405 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302405 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

 scsi: target: Fix WRITE_SAME No Data Buffer crash(CVE-2022-21546)

 NFSD: Fix crash in nfsd4_read_release()(CVE-2025-40324)

 scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

 loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

 media: v4l2-mem2mem: add lock to protect parameter num_rdy(CVE-2023-53519)

 mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()(CVE-2022-50347)

 net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb(CVE-2023-53548)

 platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()(CVE-2022-50521)

 tipc: fix an information leak in tipc_topsrv_kern_subscr(CVE-2022-50531)

 scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()(CVE-2023-54014)

 ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()(CVE-2023-53271)

 dma-buf: insert memory barrier before updating num_fences(CVE-2025-38095)

 md/raid10: fix wrong setting of max_corr_read_errors(CVE-2023-53313)

 scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses(CVE-2023-7324)

 scsi: storvsc: Fix handling of virtual Fibre Channel timeouts(CVE-2023-53245)

 md/raid10: prevent soft lockup while flush writes(CVE-2023-53151)

 clk: samsung: Fix memory leak in _samsung_clk_register_pll()(CVE-2022-50449)

 sctp: fix a potential overflow in sctp_ifwdtsn_skip(CVE-2023-53372)

 crypto: api - Use work queue in crypto_destroy_instance(CVE-2023-53799)

 drm: Prevent drm_copy_field() to attempt copying a NULL pointer(CVE-2022-50884)

 dm raid: fix address sanitizer warning in raid_status(CVE-2022-50084)

 cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

 net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device(CVE-2023-54015)

 ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

 fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

 scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()(CVE-2023-53803)

 macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse(CVE-2025-68367)

 ubi: Fix use-after-free when volume resizing failed(CVE-2023-53800)

 crypto: qat - fix DMA transfer direction(CVE-2022-50774)

 scsi: hpsa: Fix possible memory leak in hpsa_init_one()(CVE-2022-50646)

 mmc: core: Fix kernel panic when remove non-standard SDIO card(CVE-2022-50640)

 usb: host: ohci-ppc-of: Fix refcount leak bug(CVE-2022-50033)

 PNP: fix name memory leak in pnp_alloc_dev()(CVE-2022-50278)

 media: dvb-frontends: fix leak of memory fw(CVE-2022-50664)

 fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

 acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl(CVE-2024-56662)

 scsi: ses: Handle enclosure with just a primary component gracefully(CVE-2023-53431)

 pid: Add a judgment for ns null in pid_nr_ns(CVE-2025-40178)

 NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid(CVE-2025-68349)

 hwrng: virtio - Fix race on data_avail and actual data(CVE-2023-53998)

 usb-storage: alauda: Fix uninit-value in alauda_check_media()(CVE-2023-53847)

 netlink: do not hard code device address lenth in fdb dumps(CVE-2023-53863)

 drm/client: Fix memory leak in drm_client_target_cloned(CVE-2023-54091)

 ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe(CVE-2025-68241)

 md/raid10: fix null-ptr-deref in raid10_sync_request(CVE-2023-53832)

 iommu/amd: Fix pci device refcount leak in ppr_notifier()(CVE-2022-50505)

 net: read sk-sk_family once in sk_mc_loop()(CVE-2023-53831)

 fbdev: bitblit: bound-check glyph index in bit_putcs*(CVE-2025-40322)

 bpf: make sure skb-len != 0 when redirecting to a tunneling device(CVE-2022-50253)

 ppp: associate skb with a device at tx(CVE-2022-50655)

 ip6_vti: fix slab-use-after-free in decode_session6(CVE-2023-53821)

 hwrng: amd - Fix PCI device refcount leak(CVE-2022-50868)

 netlink: annotate accesses to nlk-cb_running(CVE-2023-53853)

 acct: fix potential integer overflow in encode_comp_t()(CVE-2022-50749)

 RDMA/rxe: Fix 'kernel NULL pointer dereference' error(CVE-2022-50671)

 udf: Avoid double brelse() in udf_rename()(CVE-2022-50755)

 dm flakey: fix a crash with invalid table line(CVE-2023-53786)

 libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

 crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()(CVE-2023-53817)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel packages.

Read more at https://www.tenable.com/plugins/nessus/302405

]]> <![CDATA[EulerOS 2.0 SP10 : ruby (EulerOS-SA-2026-1324)]]> https://www.tenable.com/plugins/nessus/302404 https://www.tenable.com/plugins/nessus/302404 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302404 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.(CVE-2025-61594)

 REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.(CVE-2025-58767)

Tenable has extracted the preceding description block directly from the EulerOS ruby security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected ruby packages.

Read more at https://www.tenable.com/plugins/nessus/302404

]]> <![CDATA[EulerOS 2.0 SP12 : libxslt (EulerOS-SA-2026-1374)]]> https://www.tenable.com/plugins/nessus/302403 https://www.tenable.com/plugins/nessus/302403 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302403 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libxslt package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.(CVE-2025-10911)

Tenable has extracted the preceding description block directly from the EulerOS libxslt security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libxslt packages.

Read more at https://www.tenable.com/plugins/nessus/302403

]]> <![CDATA[EulerOS 2.0 SP10 : util-linux (EulerOS-SA-2026-1326)]]> https://www.tenable.com/plugins/nessus/302402 https://www.tenable.com/plugins/nessus/302402 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302402 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.(CVE-2025-14104)

Tenable has extracted the preceding description block directly from the EulerOS util-linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected util-linux packages.

Read more at https://www.tenable.com/plugins/nessus/302402

]]> <![CDATA[EulerOS 2.0 SP10 : ruby (EulerOS-SA-2026-1350)]]> https://www.tenable.com/plugins/nessus/302401 https://www.tenable.com/plugins/nessus/302401 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302401 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 URI is a module providing classes to handle Uniform Resource Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass exists for the fix to CVE-2025-27221 that can expose user credentials. When using the `+` operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. Versions 0.12.5, 0.13.3, and 1.0.4 fix the issue.(CVE-2025-61594)

 REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities.(CVE-2025-58767)

Tenable has extracted the preceding description block directly from the EulerOS ruby security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected ruby packages.

Read more at https://www.tenable.com/plugins/nessus/302401

]]> <![CDATA[EulerOS 2.0 SP12 : containerd (EulerOS-SA-2026-1353)]]> https://www.tenable.com/plugins/nessus/302400 https://www.tenable.com/plugins/nessus/302400 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302400 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the containerd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.(CVE-2025-64329)

 containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions.
 This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.(CVE-2024-25621)

Tenable has extracted the preceding description block directly from the EulerOS containerd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected containerd packages.

Read more at https://www.tenable.com/plugins/nessus/302400

]]> <![CDATA[EulerOS 2.0 SP12 : libwebsockets (EulerOS-SA-2026-1404)]]> https://www.tenable.com/plugins/nessus/302399 https://www.tenable.com/plugins/nessus/302399 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302399 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libwebsockets package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.(CVE-2025-11678)

Tenable has extracted the preceding description block directly from the EulerOS libwebsockets security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libwebsockets packages.

Read more at https://www.tenable.com/plugins/nessus/302399

]]> <![CDATA[EulerOS 2.0 SP10 : glib2 (EulerOS-SA-2026-1334)]]> https://www.tenable.com/plugins/nessus/302398 https://www.tenable.com/plugins/nessus/302398 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302398 with Critical Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the glib2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.(CVE-2025-14087)

 A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.(CVE-2025-13601)

 A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.(CVE-2025-14512)

 A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).(CVE-2026-0988)

Tenable has extracted the preceding description block directly from the EulerOS glib2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected glib2 packages.

Read more at https://www.tenable.com/plugins/nessus/302398

]]> <![CDATA[EulerOS 2.0 SP12 : libsodium (EulerOS-SA-2026-1401)]]> https://www.tenable.com/plugins/nessus/302397 https://www.tenable.com/plugins/nessus/302397 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302397 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libsodium package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.(CVE-2025-69277)

Tenable has extracted the preceding description block directly from the EulerOS libsodium security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libsodium packages.

Read more at https://www.tenable.com/plugins/nessus/302397

]]> <![CDATA[EulerOS 2.0 SP12 : python-ldap (EulerOS-SA-2026-1408)]]> https://www.tenable.com/plugins/nessus/302396 https://www.tenable.com/plugins/nessus/302396 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302396 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the python-ldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.(CVE-2025-61911)

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.(CVE-2025-61912)

Tenable has extracted the preceding description block directly from the EulerOS python-ldap security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-ldap packages.

Read more at https://www.tenable.com/plugins/nessus/302396

]]> <![CDATA[EulerOS 2.0 SP12 : gnutls (EulerOS-SA-2026-1362)]]> https://www.tenable.com/plugins/nessus/302395 https://www.tenable.com/plugins/nessus/302395 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302395 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.(CVE-2025-9820)

Tenable has extracted the preceding description block directly from the EulerOS gnutls security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gnutls packages.

Read more at https://www.tenable.com/plugins/nessus/302395

]]> <![CDATA[EulerOS 2.0 SP10 : cups (EulerOS-SA-2026-1304)]]> https://www.tenable.com/plugins/nessus/302394 https://www.tenable.com/plugins/nessus/302394 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302394 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the cups package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of- bound write. This issue has been patched in version 2.4.15.(CVE-2025-61915)

 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.(CVE-2025-58436)

Tenable has extracted the preceding description block directly from the EulerOS cups security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected cups packages.

Read more at https://www.tenable.com/plugins/nessus/302394

]]> <![CDATA[EulerOS 2.0 SP12 : util-linux (EulerOS-SA-2026-1383)]]> https://www.tenable.com/plugins/nessus/302393 https://www.tenable.com/plugins/nessus/302393 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302393 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the util-linux packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.(CVE-2025-14104)

Tenable has extracted the preceding description block directly from the EulerOS util-linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected util-linux packages.

Read more at https://www.tenable.com/plugins/nessus/302393

]]> <![CDATA[EulerOS 2.0 SP12 : net-snmp (EulerOS-SA-2026-1375)]]> https://www.tenable.com/plugins/nessus/302392 https://www.tenable.com/plugins/nessus/302392 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302392 with Critical Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash. This issue has been patched in versions 5.9.5 and 5.10.pre2.(CVE-2025-68615)

Tenable has extracted the preceding description block directly from the EulerOS net-snmp security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected net-snmp packages.

Read more at https://www.tenable.com/plugins/nessus/302392

]]> <![CDATA[EulerOS 2.0 SP12 : golang (EulerOS-SA-2026-1394)]]> https://www.tenable.com/plugins/nessus/302391 https://www.tenable.com/plugins/nessus/302391 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302391 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.(CVE-2025-61724)

 Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.(CVE-2025-58185)

 tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.(CVE-2025-58183)

 Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as 'a=;', an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.(CVE-2025-58186)

 The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: 'http://[::1]/'. IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.(CVE-2025-47912)

 Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.(CVE-2025-61729)

 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non- linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.(CVE-2025-58187)

 The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.(CVE-2025-61723)

 When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.(CVE-2025-58189)

 An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.(CVE-2025-61727)

Tenable has extracted the preceding description block directly from the EulerOS golang security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected golang packages.

Read more at https://www.tenable.com/plugins/nessus/302391

]]> <![CDATA[EulerOS 2.0 SP12 : python-urllib3 (EulerOS-SA-2026-1378)]]> https://www.tenable.com/plugins/nessus/302390 https://www.tenable.com/plugins/nessus/302390 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302390 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.(CVE-2025-66418)

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
 The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.(CVE-2025-66471)

 urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content- Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.(CVE-2026-21441)

Tenable has extracted the preceding description block directly from the EulerOS python-urllib3 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-urllib3 packages.

Read more at https://www.tenable.com/plugins/nessus/302390

]]> <![CDATA[EulerOS 2.0 SP12 : libpcap (EulerOS-SA-2026-1399)]]> https://www.tenable.com/plugins/nessus/302389 https://www.tenable.com/plugins/nessus/302389 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302389 with Low Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libpcap package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.(CVE-2025-11961)

Tenable has extracted the preceding description block directly from the EulerOS libpcap security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libpcap packages.

Read more at https://www.tenable.com/plugins/nessus/302389

]]> <![CDATA[EulerOS 2.0 SP12 : libsoup (EulerOS-SA-2026-1402)]]> https://www.tenable.com/plugins/nessus/302388 https://www.tenable.com/plugins/nessus/302388 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302388 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw in libsoup's HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers.(CVE-2025-14523)

 A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk.(CVE-2026-0719)

Tenable has extracted the preceding description block directly from the EulerOS libsoup security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libsoup packages.

Read more at https://www.tenable.com/plugins/nessus/302388

]]> <![CDATA[EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-1355)]]> https://www.tenable.com/plugins/nessus/302387 https://www.tenable.com/plugins/nessus/302387 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302387 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers.

 Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.(CVE-2025-14017)

 When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

 When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

 When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts
 *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.(CVE-2025-15079)

Tenable has extracted the preceding description block directly from the EulerOS curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected curl packages.

Read more at https://www.tenable.com/plugins/nessus/302387

]]> <![CDATA[EulerOS 2.0 SP10 : net-snmp (EulerOS-SA-2026-1318)]]> https://www.tenable.com/plugins/nessus/302386 https://www.tenable.com/plugins/nessus/302386 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302386 with Critical Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash. This issue has been patched in versions 5.9.5 and 5.10.pre2.(CVE-2025-68615)

Tenable has extracted the preceding description block directly from the EulerOS net-snmp security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected net-snmp packages.

Read more at https://www.tenable.com/plugins/nessus/302386

]]> <![CDATA[EulerOS 2.0 SP12 : sssd (EulerOS-SA-2026-1413)]]> https://www.tenable.com/plugins/nessus/302385 https://www.tenable.com/plugins/nessus/302385 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302385 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln plugin is possible. This fallback allows an attacker with permission to modify certain AD attributes (such as userPrincipalName or samAccountName) to impersonate privileged users, potentially resulting in unauthorized access or privilege escalation on domain-joined Linux hosts.(CVE-2025-11561)

Tenable has extracted the preceding description block directly from the EulerOS sssd security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected sssd packages.

Read more at https://www.tenable.com/plugins/nessus/302385

]]> <![CDATA[EulerOS 2.0 SP10 : containerd (EulerOS-SA-2026-1329)]]> https://www.tenable.com/plugins/nessus/302384 https://www.tenable.com/plugins/nessus/302384 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302384 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the containerd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.(CVE-2025-64329)

 containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions.
 This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.(CVE-2024-25621)

Tenable has extracted the preceding description block directly from the EulerOS containerd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected containerd packages.

Read more at https://www.tenable.com/plugins/nessus/302384

]]> <![CDATA[EulerOS 2.0 SP10 : binutils (EulerOS-SA-2026-1302)]]> https://www.tenable.com/plugins/nessus/302383 https://www.tenable.com/plugins/nessus/302383 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302383 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the binutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A vulnerability has been found in GNU Binutils 2.45. This impacts the function bfd_elf_gc_record_vtentry of the file bfd/elflink.c of the component Linker. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
 The identifier of the patch is 047435dd988a3975d40c6626a8f739a0b2e154bc. To fix this issue, it is recommended to deploy a patch.(CVE-2025-11412)

Tenable has extracted the preceding description block directly from the EulerOS binutils security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected binutils packages.

Read more at https://www.tenable.com/plugins/nessus/302383

]]> <![CDATA[EulerOS 2.0 SP10 : rsync (EulerOS-SA-2026-1349)]]> https://www.tenable.com/plugins/nessus/302382 https://www.tenable.com/plugins/nessus/302382 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302382 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the rsync package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The

 malicious

 rsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)

Tenable has extracted the preceding description block directly from the EulerOS rsync security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected rsync packages.

Read more at https://www.tenable.com/plugins/nessus/302382

]]> <![CDATA[EulerOS 2.0 SP12 : samba (EulerOS-SA-2026-1381)]]> https://www.tenable.com/plugins/nessus/302381 https://www.tenable.com/plugins/nessus/302381 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302381 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.(CVE-2025-9640)

Tenable has extracted the preceding description block directly from the EulerOS samba security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected samba packages.

Read more at https://www.tenable.com/plugins/nessus/302381

]]> <![CDATA[EulerOS 2.0 SP10 : kernel (EulerOS-SA-2026-1339)]]> https://www.tenable.com/plugins/nessus/302380 https://www.tenable.com/plugins/nessus/302380 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302380 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 media: v4l2-mem2mem: add lock to protect parameter num_rdy(CVE-2023-53519)

 md: Replace snprintf with scnprintf(CVE-2022-50299)

 mm/vmscan: don't try to reclaim hwpoison folio(CVE-2025-37834)

 ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()(CVE-2023-53271)

 md/raid10: fix wrong setting of max_corr_read_errors(CVE-2023-53313)

 scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

 loop: Avoid updating block size under exclusive owner(CVE-2025-38709)

 mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

 scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

 NFS: Fix a race when updating an existing write(CVE-2025-39697)

 scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses(CVE-2023-7324)

 efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare(CVE-2025-39817)

 dm raid: fix address sanitizer warning in raid_resume(CVE-2022-50085)

 usb-storage: alauda: Fix uninit-value in alauda_check_media()(CVE-2023-53847)

 mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list(CVE-2025-39725)

 md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request(CVE-2023-53380)

 md/raid10: check slab-out-of-bounds in md_bitmap_get_counter(CVE-2023-53357)

 net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode(CVE-2023-53733)

 fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

 partitions: mac: fix handling of bogus partition table(CVE-2025-21772)

 HID: hidraw: fix memory leak in hidraw_release()(CVE-2022-49981)

 pid: Add a judgment for ns null in pid_nr_ns(CVE-2025-40178)

 libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

 watchdog: Fix kmemleak in watchdog_cdev_register(CVE-2023-53234)

 drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()(CVE-2022-50402)

 PNP: fix name memory leak in pnp_alloc_dev()(CVE-2022-50278)

 ipvs: Defer ip_vs_ftp unregister during netns cleanup(CVE-2025-40018)

 nbd: Fix hung when signal interrupts nbd_start_device_ioctl()(CVE-2022-50314)

 igb: Do not free q_vector unless new one was allocated(CVE-2022-50252)

 ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed(CVE-2023-53481)

 cacheinfo: Fix shared_cpu_map to handle shared caches at different levels(CVE-2023-53254)

 scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

 scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()(CVE-2023-53676)

 NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid(CVE-2025-68349)

 net: hns: fix possible memory leak in hnae_ae_register()(CVE-2022-50352)

 md: call __md_stop_writes in md_stop(CVE-2022-49987)

 net/packet: fix a race in packet_set_ring() and packet_notifier()(CVE-2025-38617)

 regulator: of: Fix refcount leak bug in of_get_regulation_constraints()(CVE-2022-50191)

 ubi: Fix use-after-free when volume resizing failed(CVE-2023-53800)

 HID: multitouch: Correct devm device reference for hidinput input_dev name(CVE-2023-53454)

 ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

 md/raid10: fix leak of 'r10bio-remaining' for recovery(CVE-2023-53299)

 scsi: qla2xxx: Wait for io return on terminate rport(CVE-2023-53322)

 udf: Detect system inodes linked into directory hierarchy(CVE-2023-53695)

 igb: Fix igb_down hung on surprise removal(CVE-2023-53148)

 cifs: Fix warning and UAF when destroy the MR list(CVE-2023-53427)

 scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()(CVE-2023-53803)

 ubi: ensure that VID header offset + VID header size = alloc, size(CVE-2023-53265)

 fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

 firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails(CVE-2022-50087)

 md-raid10: fix KASAN warning(CVE-2022-50211)

 scsi: ses: Fix possible desc_ptr out-of-bounds accesses(CVE-2023-53675)

 mmc: core: Fix kernel panic when remove non-standard SDIO card(CVE-2022-50640)

 nfs: handle failure of nfs_get_lock_context in unlock path(CVE-2025-38023)

 udf: Do not update file length for failed writes to inline files(CVE-2023-53295)

 RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug(CVE-2025-38024)

 sctp: check send stream number after wait_for_sndbuf(CVE-2023-53296)

 net/sched: sch_qfq: Fix race condition on qfq_aggregate(CVE-2025-38477)

 RDMA/rxe: Fix 'kernel NULL pointer dereference' error(CVE-2022-50671)

 i40e: add validation for ring_len param(CVE-2025-39973)

 md/raid1: Fix stack memory use after return in raid1_reshape(CVE-2025-38445)

 Squashfs: check return result of sb_min_blocksize(CVE-2025-38415)

 net/tunnel: wait until all sk_user_data reader finish before releasing the sock(CVE-2022-50405)

 ip6_vti: fix slab-use-after-free in decode_session6(CVE-2023-53821)

 af_unix: Fix data-races around user-unix_inflight.(CVE-2023-53204)

 RDMA/rxe: Fix error unwind in rxe_create_qp()(CVE-2022-50127)

 __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock(CVE-2025-38058)

 NFSD: Protect against send buffer overflow in NFSv2 READ(CVE-2022-50410)

 scsi: hpsa: Fix possible memory leak in hpsa_init_one()(CVE-2022-50646)

 sctp: handle the error returned from sctp_auth_asoc_init_active_key(CVE-2022-50243)

 vsock: Do not allow binding to VMADDR_PORT_ANY(CVE-2025-38618)

 smb: client: Fix use-after-free in cifs_fill_dirent(CVE-2025-38051)

 scsi: libiscsi: Initialize iscsi_conn-dd_data only if memory is allocated(CVE-2025-38700)

 sctp: fix a potential overflow in sctp_ifwdtsn_skip(CVE-2023-53372)

 pstore/ram: Check start of empty przs during init(CVE-2023-53331)

 clk: samsung: Fix memory leak in _samsung_clk_register_pll()(CVE-2022-50449)

 md/raid10: prevent soft lockup while flush writes(CVE-2023-53151)

 nfsd: call op_release, even when op_func returns an error(CVE-2023-53241)

 cifs: Release folio lock on fscache read hit.(CVE-2023-53593)

 net: bridge: fix soft lockup in br_multicast_query_expired()(CVE-2025-39773)

 cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

 dm raid: fix address sanitizer warning in raid_status(CVE-2022-50084)

 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()(CVE-2025-38724)

 scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()(CVE-2023-54014)

 block: fix resource leak in blk_register_queue() error path(CVE-2025-37980)

 drm/client: Fix memory leak in drm_client_target_cloned(CVE-2023-54091)

 dm flakey: fix a crash with invalid table line(CVE-2023-53786)

 crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()(CVE-2023-53817)

 hwrng: virtio - Fix race on data_avail and actual data(CVE-2023-53998)

 sched/fair: Don't balance task to its current running CPU(CVE-2023-53215)

 ppp: associate skb with a device at tx(CVE-2022-50655)

 fbdev: bitblit: bound-check glyph index in bit_putcs*(CVE-2025-40322)

 acct: fix potential integer overflow in encode_comp_t()(CVE-2022-50749)

 udf: Avoid double brelse() in udf_rename()(CVE-2022-50755)

 tee: add overflow check in register_shm_helper()(CVE-2022-50080)

 drm: Prevent drm_copy_field() to attempt copying a NULL pointer(CVE-2022-50884)

 crypto: api - Use work queue in crypto_destroy_instance(CVE-2023-53799)

 mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()(CVE-2023-53623)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel packages.

Read more at https://www.tenable.com/plugins/nessus/302380

]]> <![CDATA[EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-1331)]]> https://www.tenable.com/plugins/nessus/302379 https://www.tenable.com/plugins/nessus/302379 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302379 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.(CVE-2025-14524)

 When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts
 *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.(CVE-2025-15079)

 When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a locally running SSH agent.(CVE-2025-15224)

 When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers.

 Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.(CVE-2025-14017)

Tenable has extracted the preceding description block directly from the EulerOS curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected curl packages.

Read more at https://www.tenable.com/plugins/nessus/302379

]]> <![CDATA[EulerOS 2.0 SP12 : libarchive (EulerOS-SA-2026-1367)]]> https://www.tenable.com/plugins/nessus/302378 https://www.tenable.com/plugins/nessus/302378 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302378 with Medium Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)

Tenable has extracted the preceding description block directly from the EulerOS libarchive security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libarchive packages.

Read more at https://www.tenable.com/plugins/nessus/302378

]]> <![CDATA[EulerOS 2.0 SP10 : python-ldap (EulerOS-SA-2026-1320)]]> https://www.tenable.com/plugins/nessus/302377 https://www.tenable.com/plugins/nessus/302377 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302377 with Medium Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the python-ldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, the sanitization method `ldap.filter.escape_filter_chars` can be tricked to skip escaping of special characters when a crafted `list` or `dict` is supplied as the `assertion_value` parameter, and the non-default `escape_mode=1` is configured. The method `ldap.filter.escape_filter_chars` supports 3 different escaping modes. `escape_mode=0` (default) and `escape_mode=2` happen to raise exceptions when a `list` or `dict` object is supplied as the `assertion_value` parameter. However, `escape_mode=1` computes without performing adequate logic to ensure a fully escaped return value. If an application relies on the vulnerable method in the `python-ldap` library to escape untrusted user input, an attacker might be able to abuse the vulnerability to launch ldap injection attacks which could potentially disclose or manipulate ldap data meant to be inaccessible to them. Version 3.4.5 fixes the issue by adding a type check at the start of the `ldap.filter.escape_filter_chars` method to raise an exception when the supplied `assertion_value` parameter is not of type `str`.(CVE-2025-61911)

 python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.(CVE-2025-61912)

Tenable has extracted the preceding description block directly from the EulerOS python-ldap security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-ldap packages.

Read more at https://www.tenable.com/plugins/nessus/302377

]]> <![CDATA[EulerOS 2.0 SP12 : libpcap (EulerOS-SA-2026-1368)]]> https://www.tenable.com/plugins/nessus/302376 https://www.tenable.com/plugins/nessus/302376 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302376 with Low Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the libpcap package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.(CVE-2025-11961)

Tenable has extracted the preceding description block directly from the EulerOS libpcap security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libpcap packages.

Read more at https://www.tenable.com/plugins/nessus/302376

]]> <![CDATA[EulerOS 2.0 SP12 : glibc (EulerOS-SA-2026-1391)]]> https://www.tenable.com/plugins/nessus/302375 https://www.tenable.com/plugins/nessus/302375 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302375 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.

 Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [162+ 1, 163] and exactly 163 for posix_memalign and aligned_alloc.

 Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.(CVE-2026-0861)

 Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.(CVE-2025-15281)

Tenable has extracted the preceding description block directly from the EulerOS glibc security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected glibc packages.

Read more at https://www.tenable.com/plugins/nessus/302375

]]> <![CDATA[EulerOS 2.0 SP12 : gnupg2 (EulerOS-SA-2026-1361)]]> https://www.tenable.com/plugins/nessus/302374 https://www.tenable.com/plugins/nessus/302374 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302374 with High Severity

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the gnupg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)(CVE-2025-68973)

Tenable has extracted the preceding description block directly from the EulerOS gnupg2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gnupg2 packages.

Read more at https://www.tenable.com/plugins/nessus/302374

]]> <![CDATA[EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-1397)]]> https://www.tenable.com/plugins/nessus/302373 https://www.tenable.com/plugins/nessus/302373 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302373 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock-cork.(CVE-2025-39913)

 md: fix rcu protection in md_wakeup_thread(CVE-2025-68374)

 usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer(CVE-2025-68331)

 fs: dlm: fix invalid derefence of sb_lvbptr(CVE-2022-50516)

 net: atlantic: fix fragment overflow handling in RX path(CVE-2025-68301)

 netfilter: nf_reject: don't leak dst refcount for loopback packets(CVE-2025-38732)

 net: ipv6: fix field-spanning memcpy warning in AH output(CVE-2025-40363)

 net/mlx5e: Remove skb secpath if xfrm state is not found(CVE-2025-38590)

 fs: quota: create dedicated workqueue for quota_release_work(CVE-2025-40196)

 Squashfs: fix uninit-value in squashfs_get_parent(CVE-2025-40049)

 scsi: lpfc: Fix buffer free/clear order in deferred receive path(CVE-2025-39841)

 media: imon: make send_packet() more robust(CVE-2025-68194)

 libceph: fix potential use-after-free in have_mon_and_osd_map()(CVE-2025-68285)

 pid: Add a judgment for ns null in pid_nr_ns(CVE-2025-40178)

 scsi: qla2xxx: Clear cmds after chip reset(CVE-2025-68745)

 ACPI: video: Fix use-after-free in acpi_video_switch_brightness()(CVE-2025-40211)

 tty: n_gsm: fix deadlock and link starvation in outgoing data path(CVE-2022-50116)

 nexthop: Forbid FDB status change while nexthop is in a group(CVE-2025-39980)

 icmp6: Fix null-ptr-deref of ip6_null_entry-rt6i_idev in icmp6_dev().(CVE-2023-53343)

 i40e: remove read access to debugfs files(CVE-2025-39901)

 raw: Fix NULL deref in raw_get_next().(CVE-2023-53198)

 NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid(CVE-2025-68349)

 sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto(CVE-2025-40281)

 RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device(CVE-2023-53393)

 netfilter: nft_objref: validate objref and objrefmap expressions(CVE-2025-40206)

 cifs: fix session state check in reconnect to avoid use-after-free issue(CVE-2023-53794)

 cifs: parse_dfs_referrals: prevent oob on malformed input(CVE-2025-40099)

 crypto: af_alg - Set merge to zero early in af_alg_sendmsg(CVE-2025-39931)

 nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.(CVE-2025-38400)

 fs: Prevent file descriptor table allocations exceeding INT_MAX(CVE-2025-39756)

 mtd: core: fix possible resource leak in init_mtd()(CVE-2022-50304)

 ipv4: start using dst_dev_rcu()(CVE-2025-40074)

 bpf: Reject narrower access to pointer ctx fields(CVE-2025-38591)

 RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()(CVE-2023-53335)

 bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}(CVE-2025-40183)

 Squashfs: reject negative file sizes in squashfs_read_inode()(CVE-2025-40200)

 nvme-multipath: fix lockdep WARN due to partition scan work(CVE-2025-68218)

 fbdev: fix potential buffer overflow in do_register_framebuffer()(CVE-2025-38702)

 PCI/AER: Fix NULL pointer access by aer_info(CVE-2025-68309)

 x86/apic: Don't disable x2APIC if locked(CVE-2022-50720)

 netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm(CVE-2025-39894)

 fuse: fix livelock in synchronous file put from fuseblk workers(CVE-2025-40220)

 md/raid1: Fix stack memory use after return in raid1_reshape(CVE-2025-38445)

 iommu/amd: Avoid stack buffer overflow from kernel cmdline(CVE-2025-38676)

 ext4: fix off-by-one errors in fast-commit block filling(CVE-2022-50428)

 Squashfs: check return result of sb_min_blocksize(CVE-2025-38415)

 ext4: refresh inline data size before write operations(CVE-2025-68264)

 bpf: Sync pending IRQ work before freeing ring buffer(CVE-2025-40319)

 block: avoid possible overflow for chunk_sectors check in blk_stack_limits()(CVE-2025-39795)

 xfrm: Zero padding when dumping algos and encap(CVE-2023-53684)

 crypto: hisilicon/qm - request reserved interrupt for virtual function(CVE-2025-40136)

 scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()(CVE-2025-68229)

 nbd: defer config unlock in nbd_genl_connect(CVE-2025-68366)

 virtiofs: add filesystem context source name check(CVE-2025-37773)

 net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast(CVE-2025-40140)

 page_pool: always add GFP_NOWARN for ATOMIC allocations(CVE-2025-68321)

 i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path(CVE-2025-39911)

 drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE(CVE-2025-40277)

 qed: allow sleep in qed_mcp_trace_dump()(CVE-2023-53509)

 IB/mad: Don't call to function that might sleep while in atomic context(CVE-2022-50472)

 net: openvswitch: remove never-working support for setting nsh fields(CVE-2025-40254)

 md/raid0, raid10: Don't set discard sectors for request queue(CVE-2022-50583)

 futex: Don't leak robust_list pointer on exec race(CVE-2025-40341)

 x86/MCE: Always save CS register on AMD Zen IF Poison errors(CVE-2023-53438)

 ksm: use range-walk function to jump over holes in scan_get_next_rmap_item(CVE-2025-68211)

 tcp_metrics: use dst_dev_net_rcu()(CVE-2025-40075)

 net/ip6_tunnel: Prevent perpetual tunnel growth(CVE-2025-40173)

 fbdev: bitblit: bound-check glyph index in bit_putcs*(CVE-2025-40322)

 xfs: do not propagate ENODATA disk errors into xattr code(CVE-2025-39835)

 scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write(CVE-2023-53282)

 smb: client: fix race with concurrent opens in rename(2)(CVE-2025-39825)

 PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type(CVE-2025-23161)

 tipc: Fix use-after-free in tipc_mon_reinit_self().(CVE-2025-40280)

 usbnet: Fix using smp_processor_id() in preemptible code warnings(CVE-2025-40164)

 mm/hugetlb: fix folio is still mapped when deleted(CVE-2025-40006)

 binfmt_misc: restore write access before closing files opened by open_exec()(CVE-2025-68239)

 scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT(CVE-2022-49534)

 smb: client: Fix refcount leak for cifs_sb_tlink(CVE-2025-40103)

 KVM: x86: use array_index_nospec with indices that come from guest(CVE-2025-39823)

 bpf: Fix invalid prog-stats access when update_effective_progs fails(CVE-2025-68742)

 of: check previous kernel's ima-kexec-buffer against memory bounds(CVE-2022-50159)

 media: tuner: xc5000: Fix use-after-free in xc5000_release(CVE-2025-39994)

 i40e: fix idx validation in i40e_validate_queue_map(CVE-2025-39972)

 net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()(CVE-2025-40252)

 __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock(CVE-2025-38058)

 ipv6: prevent infinite loop in rt6_nlmsg_size()(CVE-2025-38588)

 vsock: Ignore signal/timeout on connect() if already established(CVE-2025-40248)

 cifs: fix mid leak during reconnection after timeout threshold(CVE-2023-53597)

 ixgbevf: fix mailbox API compatibility by negotiating supported features(CVE-2025-40104)

 iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()(CVE-2023-53476)

 usb: storage: sddr55: Reject out-of-bound new_pba(CVE-2025-40345)

 drm/vmwgfx: Fix Use-after-free in validation(CVE-2025-40111)

 sctp: initialize more fields in sctp_v6_from_sk()(CVE-2025-39812)

 mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race(CVE-2025-38085)

 media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb()(CVE-2025-38694)

 crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id(CVE-2025-68724)

 netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed(CVE-2022-50500)

 net: bridge: fix soft lockup in br_multicast_query_expired()(CVE-2025-39773)

 cifs: fix small mempool leak in SMB2_negotiate()(CVE-2022-49938)

 blk-mq: fix NULL dereference on q-elevator in blk_mq_elv_switch_none(CVE-2023-53292)

 ipv6: reject malicious packets in ipv6_gso_segment()(CVE-2025-38572)

 pinctrl: check the return value of pinmux_ops::get_function_name()(CVE-2025-40030)

 of: overlay: Call of_changeset_init() early(CVE-2023-53856)

 macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse(CVE-2025-68367)

 fs/proc: fix uaf in proc_readdir_de()(CVE-2025-40271)

 ipv6/sit: use DEV_STATS_INC() to avoid data-races(CVE-2022-50764)

 sctp: linearize cloned gso packets in sctp_rcv(CVE-2025-38718)

 timers: Fix NULL function pointer race in timer_shutdown_sync()(CVE-2025-68214)

 ARM: 9317/1: kexec: Make smp stop calls asynchronous(CVE-2023-53712)

 media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()(CVE-2025-39713)

 drm/vmwgfx: Fix a null-ptr access in the cursor snooper(CVE-2025-40110)

 sctp: Fix MAC comparison to be constant-time(CVE-2025-40204)

 scsi: st: Fix array overflow in st_setup()(CVE-2025-37857)

 ceph: fix potential use-after-free bug when trimming caps(CVE-2023-53867)

 sctp: avoid NULL dereference when chunk data buffer is missing(CVE-2025-40240)

 x86/fpu: Ensure XFD state on signal delivery(CVE-2025-68171)

 mm/compaction: fix UBSAN shift-out-of-bounds warning(CVE-2025-21815)

 netfilter: xt_nfacct: don't assume acct name is null-terminated(CVE-2025-38639)

 usb: typec: ucsi: displayport: Fix NULL pointer access(CVE-2025-37994)

 NFSD: free copynotify stateid in nfs4_free_ol_stateid()(CVE-2025-40273)

 RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction(CVE-2025-38161)

 scsi: target: Fix multiple LUN_RESET handling(CVE-2023-53586)

 ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr(CVE-2025-68183)

 bpf: Add preempt_count_{sub,add} into btf id deny list(CVE-2023-54086)

 tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().(CVE-2025-40186)

 bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls(CVE-2025-38608)

 smb: client: fix memory leak in cifs_construct_tcon()(CVE-2025-68295)

 bpf: Fix stackmap overflow check in __bpf_get_stackid()(CVE-2025-68378)

 usb: early: xhci-dbc: Fix a potential out-of-bound memory access(CVE-2023-53840)

 scsi: libiscsi: Initialize iscsi_conn-dd_data only if memory is allocated(CVE-2025-38700)

 usbnet: Prevents free active kevent(CVE-2025-68312)

 media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove(CVE-2025-39996)

 xfrm: delete x-tunnel as we delete x(CVE-2025-40215)

 arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()(CVE-2025-40346)

 eventpoll: Fix semi-unbounded recursion(CVE-2025-38614)

 smb3: fix for slab out of bounds on mount to ksmbd(CVE-2025-38728)

 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()(CVE-2025-38724)

 tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check()(CVE-2025-68188)

 software node: Correct a OOB check in software_node_get_reference_args()(CVE-2025-38342)

 jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted(CVE-2025-68337)

 be2net: pass wrb_params in case of OS2BMC be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL at be_send_pkt_to_bmc() call site.(CVE-2025-40264)

 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request(CVE-2025-38430)

 net: dlink: handle copy_thresh allocation failure(CVE-2025-40053)

 net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer(CVE-2025-39937)

 nfs4_setup_readdir(): insufficient locking for -d_parent-d_inode dereferencing(CVE-2025-68185)

 dm-stripe: fix a possible integer overflow(CVE-2025-39940)

 netfilter: ctnetlink: fix refcount leak on table dump(CVE-2025-38721)

 RDMA/rxe: Fix null deref on srq-rq.queue after resize failure(CVE-2025-68379)

 usb: typec: ucsi: displayport: Fix deadlock(CVE-2025-37967)

 netdevsim: fix memory leak in nsim_bus_dev_new()(CVE-2022-50772)

 ceph: fix race condition validating r_parent before applying state(CVE-2025-39927)

 bnxt_en: Fix memory corruption when FW resources change during ifdown(CVE-2025-39810)

 virtio_net: Fix error unwinding of XDP initialization(CVE-2023-53499)

 virtio: break and reset virtio devices on device_shutdown()(CVE-2025-38064)

 NFS: Fix a race when updating an existing write(CVE-2025-39697)

 nvme-fc: use lock accessing port_state and rport state(CVE-2025-40342)

 net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM(CVE-2025-39770)

 NFSD: fix race between nfsd registration and exports_proc(CVE-2025-38232)

 net: netpoll: fix incorrect refcount handling causing incorrect cleanup(CVE-2025-68245)

 bpf: Fix issue in verifying allow_ptr_leaks(CVE-2023-54181)

 cifs: Fix connections leak when tlink setup failed(CVE-2022-49822)

 cifs: avoid NULL pointer dereference in dbg call(CVE-2025-37844)

 objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()(CVE-2025-37937)

 bpf: Explicitly check accesses to bpf_sock_addr(CVE-2025-40078)

 nvmet-fc: avoid scheduling association deletion twice(CVE-2025-40343)

 md/raid1,raid10: don't ignore IO flags(CVE-2025-22125)

 KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT(CVE-2022-50224)

 vfio/type1: prevent underflow of locked_vm via exec()(CVE-2023-53171)

 RDMA/bnxt_re: Prevent handling any completions after qp destroy(CVE-2023-54048)

 ipv6: fix possible infinite loop in fib6_info_uses_dev()(CVE-2025-38587)

 mm: hugetlb: avoid soft lockup when mprotect to large memory area(CVE-2025-40153)

 net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup(CVE-2025-68192)

 tcp: Clear tcp_sk(sk)-fastopen_rsk in tcp_disconnect().(CVE-2025-39955)

 udp_tunnel: use netdev_warn() instead of netdev_WARN()(CVE-2025-68191)

 mm/vmscan: don't try to reclaim hwpoison folio(CVE-2025-37834)

 ima: Handle error code returned by ima_filter_rule_match()(CVE-2025-68740)

 bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log(CVE-2023-54145)

 net/mlx5e: Move representor neigh cleanup to profile cleanup_tx(CVE-2023-54148)

 dma-buf: insert memory barrier before updating num_fences(CVE-2025-38095)

 bpf: Do not let BPF test infra emit invalid GSO types to stack(CVE-2025-68725)

 ext4: guard against EA inode refcount underflow in xattr update(CVE-2025-40190)

 iavf: use internal state to free traffic IRQs(CVE-2023-53850)

 genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie(CVE-2025-38062)

 mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list(CVE-2025-39725)

 nbd: restrict sockets to TCP and UDP(CVE-2025-40080)

 crypto: hisilicon/qm - set NULL to qm-debug.qm_diff_regs(CVE-2025-40062)

 libceph: replace BUG_ON with bounds check for map-max_osd(CVE-2025-68283)

 ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe(CVE-2025-68241)

 net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()(CVE-2025-40187)

 fbcon: Set fb_display[i]-mode to NULL when the mode is released(CVE-2025-40323)

 net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error(CVE-2025-21924)

 HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()(CVE-2025-39808)

 ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()(CVE-2025-68261)

 ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()(CVE-2025-40198)

 scsi: sg: Do not sleep in atomic context(CVE-2025-40259)

 drm/scheduler: fix fence ref counting(CVE-2022-49829)

 nvmet-fc: move lsop put work to nvmet_fc_ls_req_op(CVE-2025-40171)

 PCI: Fix reference leak in pci_register_host_bridge()(CVE-2025-37836)

 scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()(CVE-2025-40115)

 Drivers: hv: vmbus: Don't dereference ACPI root object handle(CVE-2023-53647)

 tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().(CVE-2025-40149)

 NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()(CVE-2025-39730)

 vxlan: Annotate FDB data races(CVE-2025-38037)

 iio: common: st_sensors: Fix use of uninitialize device structs(CVE-2025-38531)

 usb: storage: Fix memory leak in USB bulk transport(CVE-2025-68288)

 cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()(CVE-2025-40194)

 cifs: prevent NULL pointer dereference in UTF16 conversion(CVE-2025-39838)

 scsi: target: target_core_configfs: Add length check to avoid buffer overflow(CVE-2025-39998)

 netfilter: nft_ct: add seqadj extension for natted connections(CVE-2025-68206)

 mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory(CVE-2025-39883)

 regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex(CVE-2025-68354)

 bpf: Enforce expected_attach_type for tailcall compatibility(CVE-2025-40123)

 media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID(CVE-2025-40016)

 scsi: qla4xxx: Prevent a potential error pointer dereference(CVE-2025-39676)

 block: fix resource leak in blk_register_queue() error path(CVE-2025-37980)

 blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx(CVE-2025-40125)

 NFSD: Fix crash in nfsd4_read_release()(CVE-2025-40324)

 RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug(CVE-2025-38024)

 vsock: Fix transport_* TOCTOU(CVE-2025-38461)

 net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree(CVE-2025-38468)

 e1000: fix OOB in e1000_tbi_should_accept()(CVE-2025-71093)

 mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats(CVE-2025-68800)

 iavf: Fix reset error handling(CVE-2022-50053)

 net/mlx5: Handle pairing of E-switch via uplink un/load APIs(CVE-2023-53347)

 vsock: Fix transport_{g2h,h2g} TOCTOU(CVE-2025-38462)

 x86/fpu: Drop fpregs lock before inheriting FPU permissions(CVE-2022-49783)

 fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds(CVE-2025-40304)

 net: phy: mscc: Fix memory leak when using one step timestamping(CVE-2025-38148)

 RDMA/hns: Fix double destruction of rsv_qp(CVE-2025-38582)

 mlxsw: spectrum_router: Fix neighbour use-after-free(CVE-2025-68801)

 net_sched: sch_sfq: reject invalid perturb period(CVE-2025-38193)

 iavf: fix off-by-one issues in iavf_config_rss_reg()(CVE-2025-71087)

 RDMA/rxe: Fix incomplete state save in rxe_requester(CVE-2023-53539)

Tenable has extracted the preceding description block directly from the EulerOS kernel security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel packages.

Read more at https://www.tenable.com/plugins/nessus/302373

]]> <![CDATA[EulerOS 2.0 SP12 : libpng (EulerOS-SA-2026-1400)]]> https://www.tenable.com/plugins/nessus/302372 https://www.tenable.com/plugins/nessus/302372 Mon, 16 Mar 2026 00:00:00 GMT Nessus Plugin ID 302372 with High Severity

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the libpng package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of- bounds memory access. This issue has been patched in version 1.6.51.(CVE-2025-64505)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.(CVE-2025-64506)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management.
 Upgrade to libpng 1.6.52 or later.(CVE-2025-66293)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018.
 This vulnerability is fixed in 1.6.54.(CVE-2026-22695)

 LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.(CVE-2026-22801)

Tenable has extracted the preceding description block directly from the EulerOS libpng security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libpng packages.

Read more at https://www.tenable.com/plugins/nessus/302372

]]> <![CDATA[FreeBSD : chromium -- security fixes (e45fb606-b731-4871-881d-27a1d5e2fd03)]]> https://www.tenable.com/plugins/nessus/302371 https://www.tenable.com/plugins/nessus/302371 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302371 with Critical Severity

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e45fb606-b731-4871-881d-27a1d5e2fd03 advisory.

 Chrome Releases reports:
 This update includes 29 security fixes:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302371

]]> <![CDATA[FreeBSD : chromium -- security fix (73eeb578-fd13-4d79-b50b-ed25c3614528)]]> https://www.tenable.com/plugins/nessus/302370 https://www.tenable.com/plugins/nessus/302370 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302370 with High Severity

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 73eeb578-fd13-4d79-b50b-ed25c3614528 advisory.

 Chrome Releases reports:
 This update includes 1 security fix:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302370

]]> <![CDATA[FreeBSD : chromium -- security fixes (26776062-fd24-4c2f-bf6c-7f231948ab19)]]> https://www.tenable.com/plugins/nessus/302369 https://www.tenable.com/plugins/nessus/302369 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302369 with High Severity

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 26776062-fd24-4c2f-bf6c-7f231948ab19 advisory.

 Chrome Releases reports:
 This update includes 2 security fixes:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302369

]]> <![CDATA[MiracleLinux 8 : osbuild-composer-101.4-4.el8_10.ML.1 (AXSA:2026-304:05)]]> https://www.tenable.com/plugins/nessus/302368 https://www.tenable.com/plugins/nessus/302368 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302368 with Critical Severity

Synopsis

The remote MiracleLinux host is missing one or more security updates.

Description

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-304:05 advisory.

 * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
 * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected osbuild-composer, osbuild-composer-core and / or osbuild-composer-worker packages.

Read more at https://www.tenable.com/plugins/nessus/302368

]]> <![CDATA[Fedora 44 : pgadmin4 (2026-220c4ca745)]]> https://www.tenable.com/plugins/nessus/302367 https://www.tenable.com/plugins/nessus/302367 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302367 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-220c4ca745 advisory.

 Update to pgadmin4-9.13.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected pgadmin4 package.

Read more at https://www.tenable.com/plugins/nessus/302367

]]> <![CDATA[Fedora 44 : qgis (2026-8f09799b91)]]> https://www.tenable.com/plugins/nessus/302366 https://www.tenable.com/plugins/nessus/302366 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302366 with High Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8f09799b91 advisory.

 Update to qgis-3.44.8.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected qgis package.

Read more at https://www.tenable.com/plugins/nessus/302366

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-23942]]> https://www.tenable.com/plugins/nessus/302365 https://www.tenable.com/plugins/nessus/302365 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302365 with Medium Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2. The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root. This issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14. (CVE-2026-23942)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302365

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-23943]]> https://www.tenable.com/plugins/nessus/302364 https://www.tenable.com/plugins/nessus/302364 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302364 with Medium Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS. Two compression algorithms are affected:
 * zlib: Activates immediately after key exchange, enabling unauthenticated attacks * zlib@openssh.com:
 Activates post-authentication, enabling authenticated attacks Each SSH packet can decompress ~255 MB from 256 KB of wire data (1029:1 amplification ratio). Multiple packets can rapidly exhaust available memory, causing OOM kills in memory-constrained environments. This vulnerability is associated with program files lib/ssh/src/ssh_transport.erl and program routines ssh_transport:decompress/2, ssh_transport:handle_packet_part/4. This issue affects OTP from OTP 17.0 until OTP 28.4.1, 27.3.4.9 and 26.2.5.18 corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14. (CVE-2026-23943)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302364

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-23941]]> https://www.tenable.com/plugins/nessus/302363 https://www.tenable.com/plugins/nessus/302363 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302363 with High Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling. This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7. The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content- Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request. This issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5. (CVE-2026-23941)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302363

]]> <![CDATA[Unity Linux 20.1070a Security Update: binutils (UTSA-2026-006200)]]> https://www.tenable.com/plugins/nessus/302362 https://www.tenable.com/plugins/nessus/302362 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302362 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006200 advisory.

 A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by this issue is the function bfd_elf_set_group_contents of the file bfd/elf.c. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The name of the patch is 41461010eb7c79fee7a9d5f6209accdaac66cc6b. It is recommended to apply a patch to fix this issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected binutils package.

Read more at https://www.tenable.com/plugins/nessus/302362

]]> <![CDATA[Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: grafana-pcp (UTSA-2026-006194)]]> https://www.tenable.com/plugins/nessus/302361 https://www.tenable.com/plugins/nessus/302361 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302361 with Critical Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006194 advisory.

 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines.
 This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected grafana-pcp package.

Read more at https://www.tenable.com/plugins/nessus/302361

]]> <![CDATA[Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: grafana-pcp (UTSA-2026-006199)]]> https://www.tenable.com/plugins/nessus/302360 https://www.tenable.com/plugins/nessus/302360 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302360 with Critical Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006199 advisory.

 During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected grafana-pcp package.

Read more at https://www.tenable.com/plugins/nessus/302360

]]> <![CDATA[Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: grafana-pcp (UTSA-2026-006197)]]> https://www.tenable.com/plugins/nessus/302359 https://www.tenable.com/plugins/nessus/302359 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302359 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006197 advisory.

 The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected grafana-pcp package.

Read more at https://www.tenable.com/plugins/nessus/302359

]]> <![CDATA[Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: grafana-pcp (UTSA-2026-006198)]]> https://www.tenable.com/plugins/nessus/302358 https://www.tenable.com/plugins/nessus/302358 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302358 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006198 advisory.

 Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected grafana-pcp package.

Read more at https://www.tenable.com/plugins/nessus/302358

]]> <![CDATA[Unity Linux 20.1070a Security Update: bpftrace (UTSA-2026-006195)]]> https://www.tenable.com/plugins/nessus/302357 https://www.tenable.com/plugins/nessus/302357 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302357 with Low Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006195 advisory.

 If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected bpftrace package.

Read more at https://www.tenable.com/plugins/nessus/302357

]]> <![CDATA[Unity Linux 20.1070a Security Update: binutils (UTSA-2026-006196)]]> https://www.tenable.com/plugins/nessus/302356 https://www.tenable.com/plugins/nessus/302356 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302356 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006196 advisory.

 A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is named 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944. It is recommended to apply a patch to fix this issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected binutils package.

Read more at https://www.tenable.com/plugins/nessus/302356

]]> <![CDATA[Fedora 44 : python3.10 (2026-ec79778b27)]]> https://www.tenable.com/plugins/nessus/302355 https://www.tenable.com/plugins/nessus/302355 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302355 with High Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ec79778b27 advisory.

 Update to 3.10.20

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3.10 package.

Read more at https://www.tenable.com/plugins/nessus/302355

]]> <![CDATA[Fedora 43 : python3.10 (2026-41f576f846)]]> https://www.tenable.com/plugins/nessus/302354 https://www.tenable.com/plugins/nessus/302354 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302354 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-41f576f846 advisory.

 Update to 3.10.20

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3.10 package.

Read more at https://www.tenable.com/plugins/nessus/302354

]]> <![CDATA[Fedora 42 : alertmanager (2026-83937af369)]]> https://www.tenable.com/plugins/nessus/302353 https://www.tenable.com/plugins/nessus/302353 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302353 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-83937af369 advisory.

 Initial build after rename and update to 0.31.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected alertmanager package.

Read more at https://www.tenable.com/plugins/nessus/302353

]]> <![CDATA[Fedora 42 : python3.10 (2026-66ae29ad2c)]]> https://www.tenable.com/plugins/nessus/302352 https://www.tenable.com/plugins/nessus/302352 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302352 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-66ae29ad2c advisory.

 Update to 3.10.20

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3.10 package.

Read more at https://www.tenable.com/plugins/nessus/302352

]]> <![CDATA[Fedora 42 : python3.11 (2026-2cca15998f)]]> https://www.tenable.com/plugins/nessus/302351 https://www.tenable.com/plugins/nessus/302351 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302351 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2cca15998f advisory.

 Update to 3.11.15

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3.11 package.

Read more at https://www.tenable.com/plugins/nessus/302351

]]> <![CDATA[Fedora 42 : golang-github-openprinting-ipp-usb (2026-2c281f4add)]]> https://www.tenable.com/plugins/nessus/302350 https://www.tenable.com/plugins/nessus/302350 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302350 with High Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2c281f4add advisory.

 0.9.31


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected golang-github-openprinting-ipp-usb package.

Read more at https://www.tenable.com/plugins/nessus/302350

]]> <![CDATA[Fedora 42 : wireshark (2026-a92f2096cd)]]> https://www.tenable.com/plugins/nessus/302349 https://www.tenable.com/plugins/nessus/302349 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302349 with High Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a92f2096cd advisory.

 New version 4.6.4


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected 1:wireshark package.

Read more at https://www.tenable.com/plugins/nessus/302349

]]> <![CDATA[Fedora 44 : python3.11 (2026-0581dff027)]]> https://www.tenable.com/plugins/nessus/302348 https://www.tenable.com/plugins/nessus/302348 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302348 with High Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0581dff027 advisory.

 Update to 3.11.15

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3.11 package.

Read more at https://www.tenable.com/plugins/nessus/302348

]]> <![CDATA[Fedora 43 : python3.11 (2026-29658d2f4b)]]> https://www.tenable.com/plugins/nessus/302347 https://www.tenable.com/plugins/nessus/302347 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302347 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-29658d2f4b advisory.

 Update to 3.11.15

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected python3.11 package.

Read more at https://www.tenable.com/plugins/nessus/302347

]]> <![CDATA[Fedora 43 : wireshark (2026-f7473d3da8)]]> https://www.tenable.com/plugins/nessus/302346 https://www.tenable.com/plugins/nessus/302346 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302346 with High Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f7473d3da8 advisory.

 New version 4.6.4


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected 1:wireshark package.

Read more at https://www.tenable.com/plugins/nessus/302346

]]> <![CDATA[Fedora 42 : glab (2026-da55f4dcd8)]]> https://www.tenable.com/plugins/nessus/302345 https://www.tenable.com/plugins/nessus/302345 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302345 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-da55f4dcd8 advisory.

 Update to 1.89.0

 ----

 Update to 1.88.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected glab package.

Read more at https://www.tenable.com/plugins/nessus/302345

]]> <![CDATA[Fedora 44 : pcs (2026-015b33238d)]]> https://www.tenable.com/plugins/nessus/302344 https://www.tenable.com/plugins/nessus/302344 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302344 with High Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-015b33238d advisory.

 - Rebased pcs to the newest major version (see CHANGELOG.md)
 - Updated standalone web UI and HA Cluster Management Cockpit application to pcs-web-ui 0.1.24.2 (see CHANGELOG_WUI.md)
 - Fixed FTBFS with Python 3.15
 - Fixed issues with installing pcs on Fedora 43+, upgrade and uninstall



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected pcs package.

Read more at https://www.tenable.com/plugins/nessus/302344

]]> <![CDATA[openSUSE 16 Security Update : qemu (openSUSE-SU-2026:20357-1)]]> https://www.tenable.com/plugins/nessus/302343 https://www.tenable.com/plugins/nessus/302343 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302343 with Medium Severity

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20357-1 advisory.

 - Update to version 10.0.8
 - CVE-2025-14876: Fixed unbounded allocation in virtio-crypto. (bsc#1255400)
 - CVE-2026-0665: Fixed PIRQ bounds check in xen_physdev_map_pirq. (bsc#1256484)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302343

]]> <![CDATA[openSUSE 16 Security Update : amazon-ssm-agent (openSUSE-SU-2026:20351-1)]]> https://www.tenable.com/plugins/nessus/302342 https://www.tenable.com/plugins/nessus/302342 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302342 with High Severity

Synopsis

The remote openSUSE host is missing a security update.

Description

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20351-1 advisory.

 - CVE-2025-47913: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected amazon-ssm-agent package.

Read more at https://www.tenable.com/plugins/nessus/302342

]]> <![CDATA[openSUSE 16 Security Update : libsoup2 (openSUSE-SU-2026:20354-1)]]> https://www.tenable.com/plugins/nessus/302341 https://www.tenable.com/plugins/nessus/302341 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302341 with High Severity

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20354-1 advisory.

 - CVE-2025-4476: null pointer dereference may lead to denial of service (bsc#1243422).
 - CVE-2025-14523: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (bsc#1254876).
 - CVE-2025-32049: Denial of Service attack to websocket server (bsc#1240751).
 - CVE-2026-0716: improper bounds handling may allow out-of-bounds read (bsc#1256418).
 - CVE-2026-0719: stack-based buffer overflow in NTLM authentication can lead to arbitrary code execution (bsc#1256399).
 - CVE-2026-1467: lack of input sanitization can lead to unintended or unauthorized HTTP requests (bsc#1257398).
 - CVE-2026-1539: proxy authentication credentials leaked via the Proxy-Authorization header when handling HTTP redirects (bsc#1257441).
 - CVE-2026-1760: improper handling of HTTP requests combining certain headers by SoupServer can lead to HTTP request smuggling and potential DoS (bsc#1257597).
 - CVE-2026-2369: Buffer overread due to integer underflow when handling zero-length resources (bsc#1258120).
 - CVE-2026-2443: out-of-bounds read when processing specially crafted HTTP Range headers can lead to heap information disclosure to remote attackers (bsc#1258170).
 - CVE-2026-2708: HTTP request smuggling via duplicate Content-Length headers (bsc#1258508).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected libsoup-2_4-1, libsoup2-devel, libsoup2-lang and / or typelib-1_0-Soup-2_4 packages.

Read more at https://www.tenable.com/plugins/nessus/302341

]]> <![CDATA[openSUSE 16 Security Update : osc, obs-scm-bridge (openSUSE-SU-2026:20361-1)]]> https://www.tenable.com/plugins/nessus/302340 https://www.tenable.com/plugins/nessus/302340 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302340 with Medium Severity

Synopsis

The remote openSUSE host is missing a security update.

Description

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20361-1 advisory.

 Changes in osc:

 - 1.24.0
 - Command-line:
 - Add '--target-owner' option to 'git-obs repo fork' command
 - Add '--self' parameter to fix 'no matching parent repo' error message in 'git-obs pr create'
 - Fix 'osc aggregatepac' for scmsync packages
 - Fix 'osc build' to retrieve buildconfig from git package's cache
 - Fix 'osc token' error handling for project wide trigger
 - Fix string formatting for id in obs-request.xml in 'git-obs pr dump'
 - Library:
 - Consolidate build types in build.py and commandline.py
 - Fix build.get_build_type() by comparing binary_type only if specified
 - Make use of queryconfig tool configurable and consistent
 - Fix how get_request_collection() filters the projects and packages
 - Support copying packages from an scmsync source, when target exists
 - Add timestamps to the DEBUG output
 - Update new project template

 - 1.23.0
 - Command-line:
 - Add '--target-owner' option to 'git-obs pr create' to specify the target owner explicitly
 - Add '--target-branch' option to 'git-obs staging search' command
 - Added 'git-obs staging search' command to find project PRs with referenced package PRs that have all been approved
 - Change 'git-obs pr dump' to produce directories that match the specified pull request IDs
 - Change 'git-obs pr dump' to write STATUS file
 - Properly error out on invalid 'PR:' references in 'git-obs pr dump'
 - Fix 'git-obs pr create' when the source repo is not a fork
 - Fix 'git-obs api' command when server returns 'null'
 - Fix 'osc build --alternative-project=...' when there's no .osc in the current directory
 - Fix argument and store handling in 'osc results' command
 - Library:
 - Add Manifest.get_package_paths() method that lists all paths to existings packages in a project
 - Fix Manifest class to handle loading empty YAML files or strings
 - Fix working with meta during git rebase by determining the current branch from rebase head
 - Fix handling local branch when fetching remote
 - Move get_label_ids() from PullRequest to Repo class
 - Change GitStore not to require apiurl anymore
 - Fix storing last_buildroot for git packages
 - Store the last buildroot only if there's a store detected
 - Fix BuildRoot so it acts as a tuple and the individual values are accessible via indexes
 - Make PullReqest.parse_id() more permissive by accepting trailing whitespaces
 - Fix 'missingok' argument in server_diff()
 - Fix gitea_api.PullRequest ordering methods
 - Add return to gitea_api.Branch.list()

 - PKGBUILD changes
 * Remove redundant packages from makedepends. If a package depends on something, it implicitly makedepends on it as well
 * Add python-ruamel-yaml dependency
 * Build and install man pages
 * Add python-argparse-manpage and python-sphinx to makedepends for building man pages
 * Add check() to run the test suite
 * Add checkdepends for test suite dependencies
 * Add optdepends as an equivalent to RPM's Recommends, making it easier for users to find packages needed for optional features
 * Use $pkgname variable across the script
 * Install shell completion files
 * Bump pkgrel

 - 1.22.0
 - Command-line:
 - Add 'git-obs staging' commands
 - Add '--gitea-fork-org' option to 'osc fork' command
 - Add '--git-branch' option to 'osc fork' command
 - Add 'DELETE' to 'git-obs api' allowed methods
 - Add commit messages as commented lines to the template in 'git-obs pr create'
 - Add filtering by label to 'git-obs pr list'
 - Properly handle fork mismatch in 'osc fork'
 - Change 'osc build' to build from any git repo if '--alternative-project' is specified
 - Fix 'osc service' for git based packages
 - Fix 'git-obs pr dump' to skip the dump if the target has the same updated_at timestamp as the pull request in Gitea
 - Fix 'git-obs pr dump' to do case insensitive check on owner and repo
 - Fix retrieving 'arch' argument in 'osc buildlog'
 - Library:
 - Add 'status' to the output of gitea_api.Git.get_submodules()
 - Add 'remote' argument to gitea_api.Repo.clone_or_update()
 - Add gitea_api.common.TemporaryDirectory class that supports 'delete' argument on python 3.6+
 - Add gitea_api.GitDiffGenerator class for creating submodule diffs without a git checkout
 - Add 'depth' argument to gitea_api.Repo.clone() and clone_or_update()
 - Add gitea_api.StagingPullRequestWrapper class for handling staging
 - Add gitea_api.PullRequest.get_host_owner_repo_number() method
 - Make GitObsCommand.add_argument_owner_repo() and add_argument_owner_repo_pull() reusable by allowing setting 'dest' argument
 - Warn if the git package doesn't have the same branch as the parent project
 - Extend gitea_api.PullRequest with methods that work with 'PR:' references
 - Support setting labels in gitea_api.PullRequest.create()
 - Fix gitea_api to use pagination instead of limit -1 everywhere
 - Remove duplicate, unused PullRequestReview class from gitea_api.pr
 - Move clone_or_update() from 'git-obs pr dump' command to gitea_api.Repo
 - Change gitea_api.Repo.clone_or_update() to take 'ssh_private_key_path' argument
 - Improve performance of gitea_api.IssueTimelineEntry by listing and caching requests instead of fetching them one by one
 - Make GitObsCommand.add_argument_owner_repo() and add_argument_owner_repo_pull() reusable by allowing setting 'help' argument
 - Change gitea_api.Repo.clone() to stop borrowing objects when 'reference' or 'reference_if_able' is used
 - Fix the resulting dictionary in gitea_api.PullRequest._get_label_ids()
 - Make gitea_api.RepoExists exception more helpful by giving a hint to fork under a different name
 - Use server_diff() instead of server_diff_noex() to exit with a non-zero return code
 - Return preinstallimage.info and allow podman to use preinstallimage

 - 1.21.0
 - Command-line:
 - Modify osc subcommands to error out if they don't work with git
 - Add 'git-obs meta' commands for managing the local metadata
 - Add 'git-obs meta info' command for printing resolved metadata about the current checkout
 - Add -b/--branch option to 'git-obs repo clone' command
 - Add 'git-obs pr dump' command to store pull request information on disk
 - Add 'git-obs --quiet' option (that mutes printing gitea settings now)
 - Automatially pull meta after 'git-obs repo clone'
 - Change 'git-obs pr review interactive' to write 'merge ok' comment instead of scheduling a merge
 - Mute stderr when creating a worktree in 'git-obs pr review interactive'
 - Change 'git-obs -G' to accept url to select a gitea login entry
 - Support substitutions in 'osc build --root'
 - Fix crash in 'osc build' when 'build_repositories' in store was None
 - Fix filtering by reviewers in 'git-obs pr list'
 - Update 'osc rq show' command to include history comments in verbose mode
 - Library:
 - Refactor GitStore
 - Migrate git_scm.Store over to gitea_api.Git
 - Store buildinfo and buildconfig files in GitStore's cache instead directly in the repo
 - Move code from 'git-obs meta pull' command to GitStore.pull()
 - Improve GitStore.pull() to support reading project from project.build
 - Rephrase the error message about detached HEAD in GitStore
 - Improve GitStore's error messages by adding instructions on how to fix missing metadata
 - Be more permissive when loading parent project_store in GitStore
 - Fix loading _manifest in a project git
 - Fix git store to check if all the required fields are present
 - Derive package name from topdir if a package is part of a project checkout
 - Change 'git-obs pr review interactive' to run pager process as a context manager
 - Change obs_api.TarDiff to spawn a process extracting archives as a context manager
 - Change 'commit' argument in gitea_api.Git.reset() to optional
 - Add gitea_api.Git.get_owner_repo_from_url() staticmethod
 - Add gitea_api.Git.urljoin() static method
 - Fix gitea_api.Git.get_branch_head() to raise a proper exception if the HEAD cannot be retrieved
 - Fix gitea_api.Git to work with the current remote instead of 'origin'
 - Fix get_store() to throw the exception from git store if .osc directory is not present
 - Introduce GitObsRuntimeError exception and use it where appropriate
 - Fix tardiff by removing directories with shutil.rmtree() and files by os.unlink()
 - Add 'quiet' option to gitea_api.Git.switch()
 - Mute stderr in git_obs.Git.lfs_cat_file()
 - Treat None flavor as in multibuild resolve
 - Make Token.triggered_at optional as it's not available in the oficially released OBS code
 - Add BaseModel.from_string() and BaseModel.to_string() methods
 - Add BaseModel.from_file() and BaseModel.to_file() methods
 - Fix BaseModel to initialize from a dictionary via __init__ instead of setattr
 - Docs:
 - Update docs for the new git metadata store
 - Update list of recommended gitea permissions in git-obs-quickstart
 - Spec:
 - Install git-obs-metadata man page

 - 1.20.0
 - Command-line:
 - Fix 'osc fork' command to use the right tracking branch
 - Fix 'osc blt' command by checking if the working copy is a package
 - Make 'osc buildlog' work outside of osc package directory
 - Add 'git-obs pr close' and 'git-obs pr reopen' commands
 - Add 'close' option to 'git-obs pr review interactive'
 - Change 'git-obs pr review interactive' to work with all archives, not only those in Git LFS
 - Fix checkout of the base branch in 'git-obs pr review interactive' command
 - Library:
 - Support _manifest file in git store
 - Allow pull request IDs in '/!' format
 - Properly handle deleted users and teams in the git-obs timeline
 - Handle situations when there's 'None' among timeline entries
 - Skip binary files in gitea_api.PullRequest.get_patch()
 - Change get_user_input(), add support for vertically printed list of answers
 - Spec:
 - Provide git-obs

 - 1.19.1
 - Command-line:
 - Use OSC_PACKAGE_CACHE_DIR env var instead of deprecated OSC_PACKAGECACHEDIR
 - Connection:
 - Check for both upper and lowercase versions of HTTP_PROXY and HTTPS_PROXY env vars
 - Library:
 - Add 'trackingbranch' field to ScmsyncObsinfo model
 - Revert Return None if GitStore cannot determine apiurl
 - Throw a proper exception when 'apiurl' argument of 'makeurl()' is empty
 - Move code setting apiurl from store to 'osc.conf.get_config()'
 - Simplify 'osc.commandline.Osc.get_api_url()' to return the value from 'self.options'
 - Remove 'osc.commandline.Osc.post_argparse()' because it's no longer used
 - Fix unit tests to use the new code path to run osc
 - Fix osc.gitea_api.dt_sanitize() by replacing dateutil with datetime

 - 1.19.0
 - Command-line:
 - Add 'git-obs pr cancel-scheduled-merge' command
 - Add timeline to 'git-obs pr review interactive'
 - Add '--timeline' option to 'git-obs pr get'
 - Fix 'git-obs pr search' by using pagination to retrieve all results
 - Extend '--message' option in git-obs subcommands with the '-m' short option
 - Add a different message for scheduled merges in 'git-obs pr merge' command
 - Library:
 - Add 'conn' parameter to gitea_api.common.GiteaModel
 - Add gitea_api.Connection.scheme attribute
 - Add gitea_api.PullRequest.merge_commit property
 - Add gitea_api.PullRequest.get_owner_repo_number()
 - Add gitea_api.common.dt_sanitize() for sanitizing datetime strings
 - Handle missing head repo in the PullRequest properties
 - Return None if GitStore cannot determine apiurl
 - Remove extra newline from store files
 - Fix the 'Move remaining imports in osc.babysitter into try-except block' change by preserving the order of handling the exceptions
 - Spec:
 - Use primary_python to define runtime requires matching the shebang lines
 - Provide %{use_python_pkg}-osc for all pythons and python3-osc for primary_python
 - Add conflict with obs-scm-bridge < 0.7.3

 - 1.18.0
 - Command-line:
 - Add 'git-obs pr comment [--message=...]' command
 - Add 'git-obs pr show-patch' command
 - Add '--reviewer' option to 'git-obs pr review {approve,decline,interactive}' to support group reviews via group review bot
 - Update 'git-obs pr review interactive' to return non-zero return codes for 'exit' and 'skip' actions
 - Make 'osc results --show-excluded' work in a project context
 - Add '--no-pager' global option
 - Fix 'osc fork' by copying whole query part to the new scmsync url
 - Fix 'osc buildinfo' for git packages by handing the 'build_repositories' files by store objects
 - Fix crash in 'git-obs pr get --patch'
 - Fix git-obs to exit with 130 on keyboard interrupt
 - Fix --sccache help typo in 'osc build' command
 - Connection:
 - Don't retry requests on 504 Gateway Timeout
 - Library:
 - If a devel project is not specified, try reading it from a mapping from URL set in OBS:GitDevelProjectMap project attribute
 - Improve detection of packages and projects in git
 - scmsync_obsinfo: Pass correct revision to obs-scm-bridge
 - Add obs_api.Request.search() method
 - Raise an exception if obs-scm-bridge fails
 - Fix obs_scm.Package.get_pulled_srcmd5() returning an empty string
 - Fix git store to support non-default remote
 - Extend 'gitea_api.User.get()' to take 'username' parameter
 - Move get_editor() and related functions from command-line module to gitea_api.common
 - Migrate subcommands from using Store() to get_store() that is git aware
 - Make imports lazy to imporove osc load times

 Changes in obs-scm-bridge:

 - use the system default python version (boo#1247410)

 - 0.7.4
 * syntax fix

 - 0.7.3
 * fix .gitsubmodule parser to handle space and tabs mixed

 - package /etc/obs/service directories

 - 0.7.2
 * Improved error reporting of invalid files in package subdirs
 * Introducing a mechanic to limit asset handling

 - 0.7.1
 * export trackingbranch to scmsync.obsinfo

 - 0.7.0
 * supporting _manifest file as successor of _subdirs
 * record configured branch of submodules in package scmsync url
 * stay on the configured branch of a submodule on checkout

 - 0.6.3
 * Allow ssh:// scm urls as used by osc
 * project mode: avoid unecessary changes in package meta url
 * code cleanup

 - fix dependency (it is python3-PyYAML)

 - fix missing dependency to PyYAML

 - 0.6.2
 * Make project mode always look for _config in the top dir, also when using subdirs.

 - 0.6.1
 * new noobsinfo query parameter (can be used to hide git informations in sources, binaries won't contain them either then).

 - 0.6.0
 * project mode: switching to to track package sources using git sha sums instead of md5sum via download_assets

 - 0.5.4
 * fixed support of subdir parameter usage on project level
 * Fix handling of projectscmsync in the package xml writers

 - 0.5.3
 * Switch to ssh url when using the bridge via osc

 - 0.5.2
 * Don't overwrite files from git, but complain instead with an error. For example _scmsync.obsinfo file must not be part of the git tree. boo#1230469 CVE-2024-22038

 - 0.5.1
 * Don't generate _scmsync.obsinfo outside of OBS source server import use case (eg. no more for osc co)
 * Enforce python 3.11 requirement
 * Fix export of _scmsync.obsinfo in project mode
 * Fix submodule detection
 * EXPERIMENTAL: support multiple package subdirs via _subdirs file. This syntax will change! (not documented on purpose therefore atm)
 * Using git credential manager
 * Report some errors as transient, so that OBS can re-try

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected obs-scm-bridge and / or osc packages.

Read more at https://www.tenable.com/plugins/nessus/302340

]]> <![CDATA[openSUSE 16 Security Update : tomcat (openSUSE-SU-2026:20350-1)]]> https://www.tenable.com/plugins/nessus/302339 https://www.tenable.com/plugins/nessus/302339 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302339 with Medium Severity

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20350-1 advisory.

 Update to Tomcat 9.0.115:

 - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
 - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
 - CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).
 * Catalina + Fix: 69623: Additional fix for the long standing regression that meant that calls to ClassLoader.getResource().getContent() failed when made from within a web application with resource caching enabled if the target resource was packaged in a JAR file. (markt) + Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the CsrfPreventionFilter. (schultz) + Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2 requests when the content-length header is not set. (dsoumis) + Update: Update the minimum and recommended versions for Tomcat Native to 1.3.4. (markt) + Add: Add a new ssoReauthenticationMode to the Tomcat provided Authenticators that provides a per Authenticator override of the SSO Valve requireReauthentication attribute. (markt) + Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception rather than silently using a replacement character. (markt) + Fix: 69871: Increase log level to INFO for missing configuration for the rewrite valve. (remm) + Fix: Add log warnings for additional Host appBase suspicious values.
 (remm) + Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.
 org.apache.catalina.Connector no longer requires org.apache.tomcat.jni.AprStatus to be present. (markt) + Add: Add the ability to use a custom function to generate the client identifier in the CrawlerSessionManagerValve. This is only available programmatically. Pull request #902 by Brian Matzon. (markt) + Fix: Change the SSO reauthentication behaviour for SPNEGO authentication so that a normal SPNEGO authentication is performed if the SSL Valve is configured with reauthentication enabled. This is so that the delegated credentials will be available to the web application. (markt) + Fix: When generating the class path in the Loader, re-order the check on individual class path components to avoid a potential NullPointerException. Identified by Coverity Scan. (markt) + Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull request #915 by Joshua Rogers. (remm) + Update: Add an attribute, digestInRfc3112Order, to MessageDigestCredentialHandler to control the order in which the credential and salt are digested. By default, the current, non-RFC 3112 compliant, order of salt then credential will be used. This default will change in Tomcat 12 to the RFC 3112 compliant order of credential then salt. (markt)
 * Cluster + Add: 62814: Document that human-readable names maybe used for mapSendOptions and align documentation with channelSendOptions. Based on pull request #929 by archan0621. (markt)
 * Clustering + Fix: Correct a regression introduced in 9.0.109 that broke some clustering configurations. (markt)
 * Coyote + Fix: Prevent concurrent release of OpenSSLEngine resources and the termination of the Tomcat Native library as it can cause crashes during Tomcat shutdown. (markt) + Fix: Avoid possible NPEs when using a TLS enabled custom connector. (remm) + Fix: Improve warnings when setting ciphers lists in the FFM code, mirroring the tomcat-native changes. (remm) + Fix: 69910: Dereference TLS objects right after closing a socket to improve memory efficiency. (remm) + Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig to reflect the existing implementation that allows one configuration style to be used for the trust attributes and a different style for all the other attributes. (markt) + Fix: Better warning message when OpenSSLConf configuration elements are used with a JSSE TLS implementation. (markt) + Fix: When using OpenSSL via FFM, don't log a warning about missing CA certificates unless CA certificates were configured and the configuration failed. (markt) + Add: For configuration consistency between OpenSSL and JSSE TLS implementations, TLSv1.3 cipher suites included in the ciphers attribute of an SSLHostConfig are now always ignored (previously they would be ignored with OpenSSL implementations and used with JSSE implementations) and a warning is logged that the cipher suite has been ignored. (markt) + Add: Add the ciphersuite attribute to SSLHostConfig to configure the TLSv1.3 cipher suites. (markt) + Add: Add OCSP support to JSSE based TLS connectors and make the use of OCSP configurable per connector for both JSSE and OpenSSL based TLS implementations. Align the checks performed by OpenSSL with those performed by JSSE. (markt) + Add: Add support for soft failure of OCSP checks with soft failure support disabled by default. (markt) + Add: Add support for configuring the verification flags passed to OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt) + Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.
 + Fix: Don't log an incorrect certificate KeyStore location when creating a TLS connector if the KeyStore instance has been set directly on the connector. (markt) + Fix: HTTP/0.9 only allows GET as the HTTP method. (remm) + Add: Add strictSni attribute on the Connector to allow matching the SSLHostConfig configuration associated with the SNI host name to the SSLHostConfig configuration matched from the HTTP protocol host name. Non matching configurations will cause the request to be rejected. The attribute default value is true, enabling the matching. (remm) + Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm) + Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL provider. Pull request #912 by aogburn. (markt) + Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.
 * Jasper + Fix: 69333: Correct a regression in the previous fix for 69333 and ensure that reuse() or release() is always called for a tag. (markt) + Fix: 69877: Catch IllegalArgumentException when processing URIs when creating the classpath to handle invalid URIs. (remm) + Fix: Fix populating the classpath with the webapp classloader repositories. (remm) + Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some exception details. Patch submitted by Eric Blanquer. (remm)
 * Jdbc-pool + Fix: 64083: If the underlying connection has been closed, don't add it to the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)
 * Web applications + Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server status output if one or more of the web applications failed to start.
 (schultz) + Add: Manager: Include web application state in the HTML and JSON complete server status output. (markt) + Add: Documentation: Expand the documentation to better explain when OCSP is supported and when it is not. (markt)
 * Websocket + Fix: 69920: When attempting to write to a closed Writer or OutputStream obtained from a WebSocket session, throw an IOException rather than an IllegalStateExcpetion as required by Writer and strongly suggested by OutputStream. (markt)
 * Other + Add: Add property gpg.sign.files to optionally disable release artefact signing with GPG. (rjung) + Add: Add test.silent property to suppress JUnit console output during test execution. Useful for cleaner console output when running tests with multiple threads. (csutherl) + Update: Update the internal fork of Commons Pool to 2.13.1. (markt) + Update: Update the internal fork of Commons DBCP to 2.14.0. (markt) + Update: Update Commons Daemon to 1.5.1. (markt) + Update: Update ByteBuddy to 1.18.3. (markt) + Update: Update UnboundID to 7.0.4. (markt) + Update: Update Checkstyle to 12.3.1. (markt) + Add: Improvements to French translations. (markt) + Add: Improvements to Japanese translations provided by tak7iji. (markt) + Add: Improvements to Chinese translations provided by Yang. vincent.h and yong hu. (markt) + Update: Update Tomcat Native to 1.3.5. (markt) + Add: Add test profile system for selective test execution. Profiles can be specified via -Dtest.profile= to run specific test subsets without using patterns directly. Profile patterns are defined in test-profiles.properties. (csutherl) + Update: Update file extension to media type mappings to align with the current list used by the Apache Web Server (httpd). (markt) + Update: Update Commons Daemon to 1.5.0. (markt) + Update: Update Byte Buddy to 1.18.2. (markt) + Update: Update Checkstyle to 12.2.0. (markt) + Add: Improvements to Spanish translations provided by White Vogel. (markt) + Add: Improvements to French translations. (remm) + Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt) + Update: Update to Byte Buddy 1.17.8. (markt) + Update: Update to Checkstyle 12.1.1. (markt) + Update: Update to Jacoco 0.8.14. (markt) + Update: Update to SpotBugs 4.9.8. (markt) + Update: Update to JSign 7.4. (markt) + Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302339

]]> <![CDATA[Fedora 43 : pcs (2026-88c901f6a2)]]> https://www.tenable.com/plugins/nessus/302338 https://www.tenable.com/plugins/nessus/302338 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302338 with High Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-88c901f6a2 advisory.

 - Rebased pcs to the newest major version (see CHANGELOG.md)
 - Updated standalone web UI and HA Cluster Management Cockpit application to pcs-web-ui 0.1.24.2 (see CHANGELOG_WUI.md)
 - Fixed FTBFS with Python 3.15
 - Fixed issues with installing pcs on Fedora 43+, upgrade and uninstall



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected pcs package.

Read more at https://www.tenable.com/plugins/nessus/302338

]]> <![CDATA[Fedora 43 : insight (2026-0106837085)]]> https://www.tenable.com/plugins/nessus/302337 https://www.tenable.com/plugins/nessus/302337 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302337 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0106837085 advisory.

 New upstream snapshot.
 Fixes CVEs 2025-11494, 2025-11495, 2026-2341, 2026-3441, 2026-3442.
 Fixes CVEs 2025-69644, 2025-69645, 2025-69646.
 Fixes FTBFS.
 Relax BR of itcl/itk/iwidgets.
 Patch libtool_tag to force C++ language tagging in libtool.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected insight package.

Read more at https://www.tenable.com/plugins/nessus/302337

]]> <![CDATA[Fedora 42 : pcs (2026-c8dc2c0de3)]]> https://www.tenable.com/plugins/nessus/302336 https://www.tenable.com/plugins/nessus/302336 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302336 with High Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c8dc2c0de3 advisory.

 - Rebased pcs to the newest major version (see CHANGELOG.md)
 - Updated standalone web UI and HA Cluster Management Cockpit application to pcs-web-ui 0.1.24.2 (see CHANGELOG_WUI.md)
 - Fixed FTBFS with Python 3.15
 - Fixed issues with installing pcs on Fedora 43+, upgrade and uninstall

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected pcs package.

Read more at https://www.tenable.com/plugins/nessus/302336

]]> <![CDATA[Fedora 42 : insight (2026-8af0e7ea3e)]]> https://www.tenable.com/plugins/nessus/302335 https://www.tenable.com/plugins/nessus/302335 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302335 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8af0e7ea3e advisory.

 New upstream snapshot.
 Fixes CVEs 2025-11494, 2025-11495, 2026-2341, 2026-3441, 2026-3442.
 Fixes CVEs 2025-69644, 2025-69645, 2025-69646.
 Fixes FTBFS.
 Relax BR of itcl/itk/iwidgets.
 Patch libtool_tag to force C++ language tagging in libtool.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected insight package.

Read more at https://www.tenable.com/plugins/nessus/302335

]]> <![CDATA[Fedora 43 : systemd (2026-0e8eeb6a8a)]]> https://www.tenable.com/plugins/nessus/302334 https://www.tenable.com/plugins/nessus/302334 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302334 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0e8eeb6a8a advisory.

 - A bunch of bugfixes
 - More sanitization for invalid values received from hardware and firmware


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected systemd package.

Read more at https://www.tenable.com/plugins/nessus/302334

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xorg-x11-server (UTSA-2026-006165)]]> https://www.tenable.com/plugins/nessus/302333 https://www.tenable.com/plugins/nessus/302333 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302333 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006165 advisory.

 A flaw was discovered in the X.Org X servers X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memory corruption or a crash when affected clients disconnect.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected xorg-x11-server package.

Read more at https://www.tenable.com/plugins/nessus/302333

]]> <![CDATA[Unity Linux 20.1070e Security Update: avahi (UTSA-2026-006169)]]> https://www.tenable.com/plugins/nessus/302332 https://www.tenable.com/plugins/nessus/302332 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302332 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006169 advisory.

 Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi- daemon crashes.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected avahi package.

Read more at https://www.tenable.com/plugins/nessus/302332

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: redis6 (UTSA-2026-006184)]]> https://www.tenable.com/plugins/nessus/302331 https://www.tenable.com/plugins/nessus/302331 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302331 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006184 advisory.

 Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of memory or is killed. By default, the Redis configuration does not limit the output buffer of normal clients (see client-output-buffer-limit). Therefore, the output buffer can grow unlimitedly over time. As a result, the service is exhausted and the memory is unavailable. When password authentication is enabled on the Redis server, but no password is provided, the client can still cause the output buffer to grow from NOAUTH responses until the system will run out of memory. This issue has been patched in version 7.4.3. An additional workaround to mitigate this problem without patching the redis-server executable is to block access to prevent unauthenticated users from connecting to Redis. This can be done in different ways. Either using network access control tools like firewalls, iptables, security groups, etc, or enabling TLS and requiring users to authenticate using client side certificates.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected redis6 package.

Read more at https://www.tenable.com/plugins/nessus/302331

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-urllib3 (UTSA-2026-006150)]]> https://www.tenable.com/plugins/nessus/302330 https://www.tenable.com/plugins/nessus/302330 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302330 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006150 advisory.

 urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-urllib3 package.

Read more at https://www.tenable.com/plugins/nessus/302330

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gimp (UTSA-2026-006173)]]> https://www.tenable.com/plugins/nessus/302329 https://www.tenable.com/plugins/nessus/302329 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302329 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006173 advisory.

 GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

 The specific flaw exists within the parsing of ICO files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI- CAN-26752.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gimp package.

Read more at https://www.tenable.com/plugins/nessus/302329

]]> <![CDATA[Unity Linux 20.1070e Security Update: expat (UTSA-2026-006167)]]> https://www.tenable.com/plugins/nessus/302328 https://www.tenable.com/plugins/nessus/302328 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302328 with Low Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006167 advisory.

 In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected expat package.

Read more at https://www.tenable.com/plugins/nessus/302328

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xorg-x11-server (UTSA-2026-006183)]]> https://www.tenable.com/plugins/nessus/302327 https://www.tenable.com/plugins/nessus/302327 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302327 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006183 advisory.

 A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected xorg-x11-server package.

Read more at https://www.tenable.com/plugins/nessus/302327

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: redis6 (UTSA-2026-006176)]]> https://www.tenable.com/plugins/nessus/302326 https://www.tenable.com/plugins/nessus/302326 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302326 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006176 advisory.

 Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a specially crafted string to trigger a stack/heap out of bounds write on hyperloglog operations, potentially leading to remote code execution. The bug likely affects all Redis versions with hyperloglog operations implemented. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19. An additional workaround to mitigate the problem without patching the redis- server executable is to prevent users from executing hyperloglog operations. This can be done using ACL to restrict HLL commands.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected redis6 package.

Read more at https://www.tenable.com/plugins/nessus/302326

]]> <![CDATA[Unity Linux 20.1070e Security Update: assimp (UTSA-2026-006192)]]> https://www.tenable.com/plugins/nessus/302325 https://www.tenable.com/plugins/nessus/302325 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302325 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006192 advisory.

 A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3.
 Affected is the function Assimp::MD3Importer::ValidateSurfaceHeaderOffsets of the file code/AssetLib/MD3/MD3Loader.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected assimp package.

Read more at https://www.tenable.com/plugins/nessus/302325

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: redis6 (UTSA-2026-006177)]]> https://www.tenable.com/plugins/nessus/302324 https://www.tenable.com/plugins/nessus/302324 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302324 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006177 advisory.

 Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starvation and, ultimately, a denial of service. This vulnerability is fixed in 8.0.3, 7.4.5, 7.2.10, and 6.2.19.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected redis6 package.

Read more at https://www.tenable.com/plugins/nessus/302324

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: perl-YAML-LibYAML (UTSA-2026-006156)]]> https://www.tenable.com/plugins/nessus/302323 https://www.tenable.com/plugins/nessus/302323 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302323 with Critical Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006156 advisory.

 YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected perl-YAML-LibYAML package.

Read more at https://www.tenable.com/plugins/nessus/302323

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-pip (UTSA-2026-006147)]]> https://www.tenable.com/plugins/nessus/302322 https://www.tenable.com/plugins/nessus/302322 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302322 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006147 advisory.

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-pip package.

Read more at https://www.tenable.com/plugins/nessus/302322

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xorg-x11-server (UTSA-2026-006191)]]> https://www.tenable.com/plugins/nessus/302321 https://www.tenable.com/plugins/nessus/302321 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302321 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006191 advisory.

 A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which allows a client to bypass length checks.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected xorg-x11-server package.

Read more at https://www.tenable.com/plugins/nessus/302321

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gimp (UTSA-2026-006179)]]> https://www.tenable.com/plugins/nessus/302320 https://www.tenable.com/plugins/nessus/302320 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302320 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006179 advisory.

 A flaw was found in GIMP when processing certain TGA image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing a heap buffer overflow.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gimp package.

Read more at https://www.tenable.com/plugins/nessus/302320

]]> <![CDATA[Unity Linux 20.1070e Security Update: vim (UTSA-2026-006145)]]> https://www.tenable.com/plugins/nessus/302319 https://www.tenable.com/plugins/nessus/302319 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302319 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006145 advisory.

 Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium because a user must be made to view such an archive with Vim and then press 'x' on such a strange filename. The issue has been fixed as of Vim patch v9.1.1198.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected vim package.

Read more at https://www.tenable.com/plugins/nessus/302319

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xorg-x11-server (UTSA-2026-006141)]]> https://www.tenable.com/plugins/nessus/302318 https://www.tenable.com/plugins/nessus/302318 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302318 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006141 advisory.

 A flaw was identified in the X.Org X servers X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected xorg-x11-server package.

Read more at https://www.tenable.com/plugins/nessus/302318

]]> <![CDATA[Unity Linux 20.1070e Security Update: assimp (UTSA-2026-006180)]]> https://www.tenable.com/plugins/nessus/302317 https://www.tenable.com/plugins/nessus/302317 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302317 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006180 advisory.

 A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as problematic.
 Affected by this issue is the function MDLImporter::ImportUVCoordinate_3DGS_MDL345 of the file assimp/code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument iIndex leads to out-of-bounds read. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected assimp package.

Read more at https://www.tenable.com/plugins/nessus/302317

]]> <![CDATA[Unity Linux 20.1070e Security Update: vim (UTSA-2026-006151)]]> https://www.tenable.com/plugins/nessus/302316 https://www.tenable.com/plugins/nessus/302316 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302316 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006151 advisory.

 When switching to other buffers using the :all command and visual mode still being active, this may cause a heap-buffer overflow, because Vim does not properly end visual mode and therefore may try to access beyond the end of a line in a buffer. In Patch 9.1.1003 Vim will correctly reset the visual mode before opening other windows and buffers and therefore fix this bug. In addition it does verify that it won't try to access a position if the position is greater than the corresponding buffer line. Impact is medium since the user must have switched on visual mode when executing the :all ex command. The Vim project would like to thank github user gandalf4a for reporting this issue. The issue has been fixed as of Vim patch v9.1.1003

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected vim package.

Read more at https://www.tenable.com/plugins/nessus/302316

]]> <![CDATA[Unity Linux 20.1070e Security Update: vim (UTSA-2026-006149)]]> https://www.tenable.com/plugins/nessus/302315 https://www.tenable.com/plugins/nessus/302315 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302315 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006149 advisory.

 Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vims zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1551 contains a patch for the vulnerability.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected vim package.

Read more at https://www.tenable.com/plugins/nessus/302315

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: openssl (UTSA-2026-006143)]]> https://www.tenable.com/plugins/nessus/302314 https://www.tenable.com/plugins/nessus/302314 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302314 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006143 advisory.

 Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer.

 Impact summary: The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service.

 The OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes, the helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16 source byte count as the destination buffer capacity to UTF8_putc(). For BMP code points above U+07FF, UTF-8 requires three bytes, but the forwarded capacity can be just two bytes. UTF8_putc() then returns -1, and this negative value is added to the output length without validation, causing the length to become negative. The subsequent trailing NUL byte is then written at a negative offset, causing write outside of heap allocated buffer.

 The vulnerability is reachable via the public PKCS12_get_friendlyname() API when parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a different code path that avoids this issue, PKCS12_get_friendlyname() directly invokes the vulnerable function. Exploitation requires an attacker to provide a malicious PKCS#12 file to be parsed by the application and the attacker can just trigger a one zero byte write before the allocated buffer.
 For that reason the issue was assessed as Low severity according to our Security Policy.

 The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.

 OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.

 OpenSSL 1.0.2 is not affected by this issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected openssl package.

Read more at https://www.tenable.com/plugins/nessus/302314

]]> <![CDATA[Unity Linux 20.1070e Security Update: openssh (UTSA-2026-006162)]]> https://www.tenable.com/plugins/nessus/302313 https://www.tenable.com/plugins/nessus/302313 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302313 with Low Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006162 advisory.

 ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected openssh package.

Read more at https://www.tenable.com/plugins/nessus/302313

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-pip (UTSA-2026-006134)]]> https://www.tenable.com/plugins/nessus/302312 https://www.tenable.com/plugins/nessus/302312 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302312 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006134 advisory.

 urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content- Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-pip package.

Read more at https://www.tenable.com/plugins/nessus/302312

]]> <![CDATA[Unity Linux 20.1070e Security Update: vim (UTSA-2026-006139)]]> https://www.tenable.com/plugins/nessus/302311 https://www.tenable.com/plugins/nessus/302311 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302311 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006139 advisory.

 Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected vim package.

Read more at https://www.tenable.com/plugins/nessus/302311

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: redis6 (UTSA-2026-006170)]]> https://www.tenable.com/plugins/nessus/302310 https://www.tenable.com/plugins/nessus/302310 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302310 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006170 advisory.

 Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to cause an integer overflow and potentially lead to remote code execution The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected redis6 package.

Read more at https://www.tenable.com/plugins/nessus/302310

]]> <![CDATA[Unity Linux 20.1070e Security Update: avahi (UTSA-2026-006163)]]> https://www.tenable.com/plugins/nessus/302309 https://www.tenable.com/plugins/nessus/302309 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302309 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006163 advisory.

 Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., h.local as a CNAME for h.local). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected avahi package.

Read more at https://www.tenable.com/plugins/nessus/302309

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-urllib3 (UTSA-2026-006153)]]> https://www.tenable.com/plugins/nessus/302308 https://www.tenable.com/plugins/nessus/302308 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302308 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006153 advisory.

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd).
 The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-urllib3 package.

Read more at https://www.tenable.com/plugins/nessus/302308

]]> <![CDATA[Unity Linux 20.1070e Security Update: avahi (UTSA-2026-006160)]]> https://www.tenable.com/plugins/nessus/302307 https://www.tenable.com/plugins/nessus/302307 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302307 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006160 advisory.

 Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected avahi package.

Read more at https://www.tenable.com/plugins/nessus/302307

]]> <![CDATA[Unity Linux 20.1070e Security Update: vim (UTSA-2026-006137)]]> https://www.tenable.com/plugins/nessus/302306 https://www.tenable.com/plugins/nessus/302306 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302306 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006137 advisory.

 Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a screen and just operates silently in batch mode.
 However, it is still possible to trigger the function that handles the scrolling of a gui version of Vim by feeding some binary characters to Vim. The function that handles the scrolling however may be triggering a redraw, which will access the ScreenLines pointer, even so this variable hasn't been allocated (since there is no screen). This vulnerability is fixed in 9.1.1043.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected vim package.

Read more at https://www.tenable.com/plugins/nessus/302306

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: perl-JSON-XS (UTSA-2026-006133)]]> https://www.tenable.com/plugins/nessus/302305 https://www.tenable.com/plugins/nessus/302305 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302305 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006133 advisory.

 JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected perl-JSON-XS package.

Read more at https://www.tenable.com/plugins/nessus/302305

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-pip (UTSA-2026-006136)]]> https://www.tenable.com/plugins/nessus/302304 https://www.tenable.com/plugins/nessus/302304 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302304 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006136 advisory.

 urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-pip package.

Read more at https://www.tenable.com/plugins/nessus/302304

]]> <![CDATA[Unity Linux 20.1070e Security Update: assimp (UTSA-2026-006193)]]> https://www.tenable.com/plugins/nessus/302303 https://www.tenable.com/plugins/nessus/302303 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302303 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006193 advisory.

 A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been classified as problematic. Affected is the function MDCImporter::InternReadFile of the file assimp/code/AssetLib/MDC/MDCLoader.cpp of the component MDC File Parser. The manipulation of the argument pcVerts leads to out-of-bounds read. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected assimp package.

Read more at https://www.tenable.com/plugins/nessus/302303

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gimp (UTSA-2026-006174)]]> https://www.tenable.com/plugins/nessus/302302 https://www.tenable.com/plugins/nessus/302302 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302302 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006174 advisory.

 A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing use-after-free issues.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gimp package.

Read more at https://www.tenable.com/plugins/nessus/302302

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-kdcproxy (UTSA-2026-006138)]]> https://www.tenable.com/plugins/nessus/302301 https://www.tenable.com/plugins/nessus/302301 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302301 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006138 advisory.

 If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name.
 This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where the use_dns setting is explicitly set to false are not affected.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-kdcproxy package.

Read more at https://www.tenable.com/plugins/nessus/302301

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xorg-x11-server (UTSA-2026-006190)]]> https://www.tenable.com/plugins/nessus/302300 https://www.tenable.com/plugins/nessus/302300 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302300 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006190 advisory.

 A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected xorg-x11-server package.

Read more at https://www.tenable.com/plugins/nessus/302300

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xorg-x11-server (UTSA-2026-006189)]]> https://www.tenable.com/plugins/nessus/302299 https://www.tenable.com/plugins/nessus/302299 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302299 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006189 advisory.

 In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected xorg-x11-server package.

Read more at https://www.tenable.com/plugins/nessus/302299

]]> <![CDATA[Unity Linux 20.1070e Security Update: assimp (UTSA-2026-006186)]]> https://www.tenable.com/plugins/nessus/302298 https://www.tenable.com/plugins/nessus/302298 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302298 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006186 advisory.

 A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the library ParsingUtils.h of the component File Handler. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected assimp package.

Read more at https://www.tenable.com/plugins/nessus/302298

]]> <![CDATA[Unity Linux 20.1070e Security Update: fetchmail (UTSA-2026-006182)]]> https://www.tenable.com/plugins/nessus/302297 https://www.tenable.com/plugins/nessus/302297 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302297 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006182 advisory.

 In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected fetchmail package.

Read more at https://www.tenable.com/plugins/nessus/302297

]]> <![CDATA[Unity Linux 20.1070e Security Update: vim (UTSA-2026-006155)]]> https://www.tenable.com/plugins/nessus/302296 https://www.tenable.com/plugins/nessus/302296 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302296 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006155 advisory.

 Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vims tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives. Impact is low because this exploit requires direct user interaction. However, successfully exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive. The victim must edit such a file using Vim which will reveal the filename and the file content, a careful user may suspect some strange things going on. Successful exploitation could results in the ability to execute arbitrary commands on the underlying operating system. Version 9.1.1552 contains a patch for the vulnerability.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected vim package.

Read more at https://www.tenable.com/plugins/nessus/302296

]]> <![CDATA[Unity Linux 20.1070e Security Update: vim (UTSA-2026-006132)]]> https://www.tenable.com/plugins/nessus/302295 https://www.tenable.com/plugins/nessus/302295 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302295 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006132 advisory.

 Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack buffer overflow exists in special_keys() (in src/netbeans.c). The while (*tok) loop writes two bytes per iteration into a 64-byte stack buffer (keybuf) with no bounds check. A malicious NetBeans server can overflow keybuf with a single specialKeys command.
 The issue has been fixed as of Vim patch v9.1.2148.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected vim package.

Read more at https://www.tenable.com/plugins/nessus/302295

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xorg-x11-server (UTSA-2026-006161)]]> https://www.tenable.com/plugins/nessus/302294 https://www.tenable.com/plugins/nessus/302294 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302294 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006161 advisory.

 A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications.
 Improper error handling during notification creation can leave dangling pointers that lead to a use-after- free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a denial of service.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected xorg-x11-server package.

Read more at https://www.tenable.com/plugins/nessus/302294

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-urllib3 (UTSA-2026-006146)]]> https://www.tenable.com/plugins/nessus/302293 https://www.tenable.com/plugins/nessus/302293 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302293 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006146 advisory.

 urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content- Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-urllib3 package.

Read more at https://www.tenable.com/plugins/nessus/302293

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gimp (UTSA-2026-006144)]]> https://www.tenable.com/plugins/nessus/302292 https://www.tenable.com/plugins/nessus/302292 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302292 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006144 advisory.

 GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

 The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27823.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gimp package.

Read more at https://www.tenable.com/plugins/nessus/302292

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: pcs (UTSA-2026-006185)]]> https://www.tenable.com/plugins/nessus/302291 https://www.tenable.com/plugins/nessus/302291 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302291 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006185 advisory.

 Tornado is a Python web framework and asynchronous networking library. When Tornado's ``multipart/form- data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous. All versions of Tornado prior to 6.5.0 are affected. The vulnerable parser is enabled by default. Upgrade to Tornado version 6.50 to receive a patch. As a workaround, risk can be mitigated by blocking `Content-Type:
 multipart/form-data` in a proxy.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected pcs package.

Read more at https://www.tenable.com/plugins/nessus/302291

]]> <![CDATA[Unity Linux 20.1070e Security Update: alsa-lib (UTSA-2026-006158)]]> https://www.tenable.com/plugins/nessus/302290 https://www.tenable.com/plugins/nessus/302290 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302290 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006158 advisory.

 alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected alsa-lib package.

Read more at https://www.tenable.com/plugins/nessus/302290

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-urllib3 (UTSA-2026-006157)]]> https://www.tenable.com/plugins/nessus/302289 https://www.tenable.com/plugins/nessus/302289 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302289 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006157 advisory.

 urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-urllib3 package.

Read more at https://www.tenable.com/plugins/nessus/302289

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-006142)]]> https://www.tenable.com/plugins/nessus/302288 https://www.tenable.com/plugins/nessus/302288 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302288 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006142 advisory.

 An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds.

 This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66.


 Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected httpd package.

Read more at https://www.tenable.com/plugins/nessus/302288

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: redis6 (UTSA-2026-006135)]]> https://www.tenable.com/plugins/nessus/302287 https://www.tenable.com/plugins/nessus/302287 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302287 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006135 advisory.

 Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate different LUA objects and potentially run their own code in the context of another user. The problem exists in all versions of Redis with LUA scripting. This issue is fixed in version 8.2.2. A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing LUA scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected redis6 package.

Read more at https://www.tenable.com/plugins/nessus/302287

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gimp (UTSA-2026-006178)]]> https://www.tenable.com/plugins/nessus/302286 https://www.tenable.com/plugins/nessus/302286 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302286 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006178 advisory.

 GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

 The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI- CAN-25100.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gimp package.

Read more at https://www.tenable.com/plugins/nessus/302286

]]> <![CDATA[Unity Linux 20.1070e Security Update: autogen (UTSA-2026-006166)]]> https://www.tenable.com/plugins/nessus/302285 https://www.tenable.com/plugins/nessus/302285 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302285 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006166 advisory.

 A vulnerability, which was classified as problematic, was found in GNU libopts up to 27.6. Affected is the function __strstr_sse2. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. This issue was initially reported to the tcpreplay project, but the code maintainer explains, that this bug appears to be in libopts which is an external library. This vulnerability only affects products that are no longer supported by the maintainer.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected autogen package.

Read more at https://www.tenable.com/plugins/nessus/302285

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gnupg2 (UTSA-2026-006148)]]> https://www.tenable.com/plugins/nessus/302284 https://www.tenable.com/plugins/nessus/302284 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302284 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006148 advisory.

 In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected gnupg2 package.

Read more at https://www.tenable.com/plugins/nessus/302284

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-kdcproxy (UTSA-2026-006154)]]> https://www.tenable.com/plugins/nessus/302283 https://www.tenable.com/plugins/nessus/302283 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302283 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006154 advisory.

 If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copies the entire buffered stream into a new buffer on each recv() call, even when the transfer is incomplete, causing excessive memory allocation and CPU usage. Additionally, kdcproxy accepts incoming response chunks as long as the received data length is not exactly equal to the length indicated in the response header, even when individual chunks or the total buffer exceed the maximum length of a Kerberos message.
 This allows an attacker to send unbounded data until the connection timeout is reached (approximately 12 seconds), exhausting server memory or CPU resources. Multiple concurrent requests can cause accept queue overflow, denying service to legitimate clients.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-kdcproxy package.

Read more at https://www.tenable.com/plugins/nessus/302283

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xorg-x11-server (UTSA-2026-006172)]]> https://www.tenable.com/plugins/nessus/302282 https://www.tenable.com/plugins/nessus/302282 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302282 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006172 advisory.

 A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected xorg-x11-server package.

Read more at https://www.tenable.com/plugins/nessus/302282

]]> <![CDATA[Unity Linux 20.1070e Security Update: assimp (UTSA-2026-006188)]]> https://www.tenable.com/plugins/nessus/302281 https://www.tenable.com/plugins/nessus/302281 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302281 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006188 advisory.

 A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function MDCImporter::ValidateSurfaceHeader of the file assimp/code/AssetLib/MDC/MDCLoader.cpp. The manipulation of the argument pcSurface2 leads to out-of-bounds read. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
 The project decided to collect all Fuzzer bugs in a main-issue to address them in the future.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected assimp package.

Read more at https://www.tenable.com/plugins/nessus/302281

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: redis6 (UTSA-2026-006168)]]> https://www.tenable.com/plugins/nessus/302280 https://www.tenable.com/plugins/nessus/302280 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302280 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006168 advisory.

 Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to block a script by restricting both the EVAL and FUNCTION command families.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected redis6 package.

Read more at https://www.tenable.com/plugins/nessus/302280

]]> <![CDATA[Unity Linux 20.1070e Security Update: expat (UTSA-2026-006164)]]> https://www.tenable.com/plugins/nessus/302279 https://www.tenable.com/plugins/nessus/302279 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302279 with High Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006164 advisory.

 In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected expat package.

Read more at https://www.tenable.com/plugins/nessus/302279

]]> <![CDATA[Unity Linux 20.1070e Security Update: vim (UTSA-2026-006175)]]> https://www.tenable.com/plugins/nessus/302278 https://www.tenable.com/plugins/nessus/302278 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302278 with Low Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006175 advisory.

 A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the local host. Upgrading to version 9.1.1097 is able to address this issue. The patch is identified as c5654b84480822817bb7b69ebc97c174c91185e9. It is recommended to upgrade the affected component.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected vim package.

Read more at https://www.tenable.com/plugins/nessus/302278

]]> <![CDATA[Unity Linux 20.1070e Security Update: exiv2 (UTSA-2026-006187)]]> https://www.tenable.com/plugins/nessus/302277 https://www.tenable.com/plugins/nessus/302277 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302277 with Low Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006187 advisory.

 Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of- bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing the metadata, which is a less frequently used Exiv2 operation than reading the metadata. The bug is fixed in version 0.28.6.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected exiv2 package.

Read more at https://www.tenable.com/plugins/nessus/302277

]]> <![CDATA[Unity Linux 20.1070e Security Update: avahi (UTSA-2026-006159)]]> https://www.tenable.com/plugins/nessus/302276 https://www.tenable.com/plugins/nessus/302276 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302276 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006159 advisory.

 Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected avahi package.

Read more at https://www.tenable.com/plugins/nessus/302276

]]> <![CDATA[Unity Linux 20.1070e Security Update: vim (UTSA-2026-006140)]]> https://www.tenable.com/plugins/nessus/302275 https://www.tenable.com/plugins/nessus/302275 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302275 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006140 advisory.

 Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:redir` ex command to register, variables and files. It also allows to show the contents of registers using the `:registers` or `:display` ex command. When redirecting the output of `:display` to a register, Vim will free the register content before storing the new content in the register. Now when redirecting the `:display` command to a register that is being displayed, Vim will free the content while shortly afterwards trying to access it, which leads to a use-after-free. Vim pre 9.1.1115 checks in the ex_display() function, that it does not try to redirect to a register while displaying this register at the same time. However this check is not complete, and so Vim does not check the `+` and `*` registers (which typically donate the X11/clipboard registers, and when a clipboard connection is not possible will fall back to use register 0 instead. In Patch 9.1.1115 Vim will therefore skip outputting to register zero when trying to redirect to the clipboard registers `*` or `+`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected vim package.

Read more at https://www.tenable.com/plugins/nessus/302275

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xorg-x11-server (UTSA-2026-006181)]]> https://www.tenable.com/plugins/nessus/302274 https://www.tenable.com/plugins/nessus/302274 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302274 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006181 advisory.

 A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected xorg-x11-server package.

Read more at https://www.tenable.com/plugins/nessus/302274

]]> <![CDATA[Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-pip (UTSA-2026-006152)]]> https://www.tenable.com/plugins/nessus/302273 https://www.tenable.com/plugins/nessus/302273 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302273 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006152 advisory.

 When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706.
 Note that upgrading pip to a fixed version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706.

 Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the vulnerable fallback code.

 Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-pip package.

Read more at https://www.tenable.com/plugins/nessus/302273

]]> <![CDATA[Unity Linux 20.1070e Security Update: fontforge (UTSA-2026-006171)]]> https://www.tenable.com/plugins/nessus/302272 https://www.tenable.com/plugins/nessus/302272 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302272 with Medium Severity

Synopsis

The Unity Linux host is missing one or more security updates.

Description

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006171 advisory.

 FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected fontforge package.

Read more at https://www.tenable.com/plugins/nessus/302272

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-3082]]> https://www.tenable.com/plugins/nessus/302271 https://www.tenable.com/plugins/nessus/302271 Sun, 15 Mar 2026 00:00:00 GMT Nessus Plugin ID 302271 with High Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of Huffman tables. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28840. (CVE-2026-3082)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302271

]]> <![CDATA[Debian dla-4501 : wireless-regdb - security update]]> https://www.tenable.com/plugins/nessus/302270 https://www.tenable.com/plugins/nessus/302270 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302270 with High Severity

Synopsis

The remote Debian host is missing a security-related update.

Description

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4501 advisory.

 ------------------------------------------------------------------------- Debian LTS Advisory DLA-4501-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Ben Hutchings March 14, 2026 https://wiki.debian.org/LTS
 -------------------------------------------------------------------------

 Package : wireless-regdb Version : 2026.02.04-1~deb11u1

 This update includes the changes in wireless-regdb 2026.02.04, reflecting changes to radio regulations in many countries.

 For Debian 11 bullseye, this update is available as version 2026.02.04-1~deb11u1.

 We recommend that you upgrade your wireless-regdb packages.

 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Attachment:
 signature.asc Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade the wireless-regdb packages.

Read more at https://www.tenable.com/plugins/nessus/302270

]]> <![CDATA[Debian dla-4500 : gimp - security update]]> https://www.tenable.com/plugins/nessus/302269 https://www.tenable.com/plugins/nessus/302269 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302269 with High Severity

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4500 advisory.

 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4500-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Thorsten Alteholz March 14, 2026 https://wiki.debian.org/LTS
 - -------------------------------------------------------------------------

 Package : gimp Version : 2.10.22-4+deb11u6 CVE ID : CVE-2026-0797 CVE-2026-2044 CVE-2026-2045 CVE-2026-2048


 Several vulnerabilities were discovered in GIMP, the GNU Image Manipulation Program, which could result in denial of service or potentially the execution of arbitrary code if malformed XWD, ICNS, PGM or ICO files are opened.


 For Debian 11 bullseye, these problems have been fixed in version 2.10.22-4+deb11u6.

 We recommend that you upgrade your gimp packages.

 For the detailed security status of gimp please refer to its security tracker page at:
 https://security-tracker.debian.org/tracker/gimp

 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the gimp packages.

Read more at https://www.tenable.com/plugins/nessus/302269

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-31899]]> https://www.tenable.com/plugins/nessus/302268 https://www.tenable.com/plugins/nessus/302268 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302268 with High Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input. (CVE-2026-31899)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302268

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-32640]]> https://www.tenable.com/plugins/nessus/302267 https://www.tenable.com/plugins/nessus/302267 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302267 with Critical Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5. (CVE-2026-32640)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302267

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-32627]]> https://www.tenable.com/plugins/nessus/302266 https://www.tenable.com/plugins/nessus/302266 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302266 with Medium Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - Debian Linux - cpp-httplib - cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is configured with a proxy and set_follow_location(true), any HTTPS redirect it follows will have TLS certificate and hostname verification silently disabled on the new connection. The client will accept any certificate presented by the redirect target expired, self-signed, or forged without raising an error or notifying the application. A network attacker in a position to return a redirect response can fully intercept the follow-up HTTPS connection, including any credentials or session tokens in flight. This vulnerability is fixed in 0.37.2. (CVE-2026-32627)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302266

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-29078]]> https://www.tenable.com/plugins/nessus/302265 https://www.tenable.com/plugins/nessus/302265 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302265 with High Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - Lexbor is a web browser engine library. Prior to 2.7.0, the ISO2022JP encoder in Lexbor fails to reset the temporary size variable between iterations. The statement ctx->buffer_used -= size with a stale size = 3 causes an integer underflow that wraps to SIZE_MAX. Afterwards, memcpy is called with a negative length, leading to an outofbounds read from the stack and an outofbounds write to the heap. The source data is partially controllable via the contents of the DOM tree. This vulnerability is fixed in 2.7.0.
 (CVE-2026-29078)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302265

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-30853]]> https://www.tenable.com/plugins/nessus/302264 https://www.tenable.com/plugins/nessus/302264 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302264 with Medium Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to 9.5.0, a path traversal vulnerability in the RocketBook (.rb) input plugin (src/calibre/ebooks/rb/reader.py) allows an attacker to write arbitrary files to any path writable by the calibre process when a user opens or converts a crafted .rb file. This is the same bug class fixed in CVE-2026-26065 for the PDB readers, but the fix was never applied to the RB reader. This vulnerability is fixed in 9.5.0. (CVE-2026-30853)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302264

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-32314]]> https://www.tenable.com/plugins/nessus/302263 https://www.tenable.com/plugins/nessus/302263 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302263 with High Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. Prior to 0.13.10, the Rust implementation of Yamux can panic when processing a crafted inbound Data frame that sets SYN and uses a body length greater than DEFAULT_CREDIT (e.g. 262145). On the first packet of a new inbound stream, stream state is created and a receiver is queued before oversized-body validation completes. When validation fails, the temporary stream is dropped and cleanup may call remove(...).expect(stream not found), triggering a panic in the connection state machine. This is remotely reachable over a normal Yamux session and does not require authentication. This vulnerability is fixed in 0.13.10.
 (CVE-2026-32314)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302263

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-31814]]> https://www.tenable.com/plugins/nessus/302262 https://www.tenable.com/plugins/nessus/302262 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302262 with High Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - Yamux is a stream multiplexer over reliable, ordered connections such as TCP/IP. From 0.13.0 to before 0.13.9, a specially crafted WindowUpdate can cause arithmetic overflow in send-window accounting, which triggers a panic in the connection state machine. This is remotely reachable over a normal network connection and does not require authentication. This vulnerability is fixed in 0.13.9. (CVE-2026-31814)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302262

]]> <![CDATA[Linux Distros Unpatched Vulnerability : CVE-2026-32772]]> https://www.tenable.com/plugins/nessus/302261 https://www.tenable.com/plugins/nessus/302261 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302261 with High Severity

Synopsis

The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.

Description

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

 - telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR. (CVE-2026-32772)

Note that Nessus relies on the presence of the package as reported by the vendor.

Solution

There is no known solution at this time.

Read more at https://www.tenable.com/plugins/nessus/302261

]]> <![CDATA[CBL Mariner 2.0 Security Update: CBL-Mariner Releases (CVE-2026-23868)]]> https://www.tenable.com/plugins/nessus/302260 https://www.tenable.com/plugins/nessus/302260 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302260 with Medium Severity

Synopsis

The remote CBL Mariner host is missing one or more security updates.

Description

The version of CBL-Mariner Releases installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-23868 advisory.

 - Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but May be possible. (CVE-2026-23868)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302260

]]> <![CDATA[Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-23868)]]> https://www.tenable.com/plugins/nessus/302259 https://www.tenable.com/plugins/nessus/302259 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302259 with Medium Severity

Synopsis

The remote Azure Linux host is missing one or more security updates.

Description

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-23868 advisory.

 - Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but May be possible. (CVE-2026-23868)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302259

]]> <![CDATA[SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libsoup (SUSE-SU-2026:0894-1)]]> https://www.tenable.com/plugins/nessus/302258 https://www.tenable.com/plugins/nessus/302258 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302258 with Medium Severity

Synopsis

The remote SUSE host is missing a security update.

Description

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0894-1 advisory.

 This update for libsoup fixes the following issue:

 - CVE-2026-0716: improper bounds handling may allow out-of-bounds read (bsc#1256418).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302258

]]> <![CDATA[SUSE SLES12 Security Update : python (SUSE-SU-2026:0891-1)]]> https://www.tenable.com/plugins/nessus/302257 https://www.tenable.com/plugins/nessus/302257 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302257 with Medium Severity

Synopsis

The remote SUSE host is missing a security update.

Description

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0891-1 advisory.

 This update for python fixes the following issue:

 - CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in `BytesGenerator` (bsc#1257181).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302257

]]> <![CDATA[SUSE SLED15 / SLES15 Security Update : dnsdist (SUSE-SU-2026:0888-1)]]> https://www.tenable.com/plugins/nessus/302256 https://www.tenable.com/plugins/nessus/302256 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302256 with High Severity

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0888-1 advisory.

 Update to dnsdist 1.9.11:

 - CVE-2025-8671: Add mitigations for the HTTP/2 MadeYouReset attack (bsc#1253852).
 - CVE-2025-30187: denial of service via crafted DoH exchange (bsc#1250054).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected dnsdist package.

Read more at https://www.tenable.com/plugins/nessus/302256

]]> <![CDATA[SUSE SLES15 Security Update : qemu (SUSE-SU-2026:0889-1)]]> https://www.tenable.com/plugins/nessus/302255 https://www.tenable.com/plugins/nessus/302255 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302255 with Medium Severity

Synopsis

The remote SUSE host is missing a security update.

Description

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:0889-1 advisory.

 This update for qemu fixes the following issue:

 - CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto (bsc#1255400).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected qemu-sgabios package.

Read more at https://www.tenable.com/plugins/nessus/302255

]]> <![CDATA[SUSE SLES15 / openSUSE 15 Security Update : tomcat10 (SUSE-SU-2026:0890-1)]]> https://www.tenable.com/plugins/nessus/302254 https://www.tenable.com/plugins/nessus/302254 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302254 with Medium Severity

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0890-1 advisory.

 Update to Tomcat 10.1.52:

 - CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
 - CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
 - CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).

 Changelog:

 * Catalina + Fix: 69623: Additional fix for the long standing regression that meant that calls to ClassLoader.getResource().getContent() failed when made from within a web application with resource caching enabled if the target resource was packaged in a JAR file. (markt) + Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the CsrfPreventionFilter. (schultz) + Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2 requests when the content-length header is not set. (dsoumis) + Update: Enable minimum and recommended Tomcat Native versions to be set separately for Tomcat Native 1.x and 2.x. Update the minimum and recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum and recommended versions for Tomcat Native 2.x to 2.0.12. (markt) + Add: Add a new ssoReauthenticationMode to the Tomcat provided Authenticators that provides a per Authenticator override of the SSO Valve requireReauthentication attribute. (markt) + Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception rather than silently using a replacement character. (markt) + Fix: 69932: Fix request end access log pattern regression, which would log the start time of the request instead. (remm) + Fix: 69871: Increase log level to INFO for missing configuration for the rewrite valve. (remm) + Fix: Add log warnings for additional Host appBase suspicious values.
 (remm) + Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar.
 org.apache.catalina.Connector no longer requires org.apache.tomcat.jni.AprStatus to be present. (markt) + Add: Add the ability to use a custom function to generate the client identifier in the CrawlerSessionManagerValve. This is only available programmatically. Pull request #902 by Brian Matzon. (markt) + Fix: Change the SSO reauthentication behaviour for SPNEGO authentication so that a normal SPNEGO authentication is performed if the SSL Valve is configured with reauthentication enabled. This is so that the delegated credentials will be available to the web application. (markt) + Fix: When generating the class path in the Loader, re-order the check on individual class path components to avoid a potential NullPointerException. Identified by Coverity Scan. (markt) + Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull request #915 by Joshua Rogers. (remm) + Update: Add an attribute, digestInRfc3112Order, to MessageDigestCredentialHandler to control the order in which the credential and salt are digested. By default, the current, non-RFC 3112 compliant, order of salt then credential will be used. This default will change in Tomcat 12 to the RFC 3112 compliant order of credential then salt. (markt) + Fix: Log warnings when the SSO configuration does not comply with the documentation. (remm) + Update: Deprecate the RemoteAddrFilter and RemoteAddrValve in favour of the RemoteCIDRFilter and RemoteCIDRValve. (markt) + Fix: 69837: Fix corruption of the class path generated by the Loader when running on Windows. (markt) + Fix: Reject requests that map to invalid Windows file names earlier.
 (markt) + Fix: 69839: Ensure that changes to session IDs (typically after authentication) are promulgated to the SSO Valve to ensure that SSO entries are fully clean-up on session expiration. Patch provided by Kim Johan Andersson. (markt) + Fix: Fix a race condition in the creation of the storage location for the FileStore. (markt)
 * Cluster + Add: 62814: Document that human-readable names may be used for mapSendOptions and align documentation with channelSendOptions. Based on pull request #929 by archan0621. (markt)
 * Clustering + Fix: Correct a regression introduced in 10.1.45 that broke some clustering configurations. (markt)
 * Coyote + Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown that triggered a significant memory leak. Patch provided by Wes. (markt) + Fix: Avoid possible NPEs when using a TLS enabled custom connector. (remm) + Fix: Improve warnings when setting ciphers lists in the FFM code, mirroring the tomcat-native changes. (remm) + Fix: 69910: Dereference TLS objects right after closing a socket to improve memory efficiency. (remm) + Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig to reflect the existing implementation that allows one configuration style to be used for the trust attributes and a different style for all the other attributes. (markt) + Fix: Better warning message when OpenSSLConf configuration elements are used with a JSSE TLS implementation. (markt) + Fix: When using OpenSSL via FFM, don't log a warning about missing CA certificates unless CA certificates were configured and the configuration failed. (markt) + Add: For configuration consistency between OpenSSL and JSSE TLS implementations, TLSv1.3 cipher suites included in the ciphers attribute of an SSLHostConfig are now always ignored (previously they would be ignored with OpenSSL implementations and used with JSSE implementations) and a warning is logged that the cipher suite has been ignored. (markt) + Add: Add the ciphersuite attribute to SSLHostConfig to configure the TLSv1.3 cipher suites. (markt) + Add: Add OCSP support to JSSE based TLS connectors and make the use of OCSP configurable per connector for both JSSE and OpenSSL based TLS implementations. Align the checks performed by OpenSSL with those performed by JSSE. (markt) + Add: Add support for soft failure of OCSP checks with soft failure support disabled by default. (markt) + Add: Add support for configuring the verification flags passed to OCSP_basic_verify when using an OpenSSL based TLS implementation. (markt) + Fix: Fix OpenSSL FFM code compatibility with LibreSSL versions below 3.5.
 + Fix: Prevent concurrent release of OpenSSLEngine resources and the termination of the Tomcat Native library as it can cause crashes during Tomcat shutdown. (markt) + Fix: Don't log an incorrect certificate KeyStore location when creating a TLS connector if the KeyStore instance has been set directly on the connector. (markt) + Fix: HTTP/0.9 only allows GET as the HTTP method. (remm) + Add: Add strictSni attribute on the Connector to allow matching the SSLHostConfig configuration associated with the SNI host name to the SSLHostConfig configuration matched from the HTTP protocol host name. Non matching configurations will cause the request to be rejected. The attribute default value is true, enabling the matching. (remm) + Fix: Graceful failure for OCSP on BoringSSL in the FFM code. (remm) + Fix: Fix use of deferAccept attribute in JMX, since it is normally only removed in Tomcat 11. (remm) + Fix: 69866: Fix a memory leak when using a trust store with the OpenSSL provider. Pull request #912 by aogburn. (markt) + Fix: Fix potential crash on shutdown when a Connector depends on the Tomcat Native library. (markt) + Fix: Fix AJP message length check. Pull request #916 by Joshua Rogers.
 + Fix: 69848: Fix copy/paste errors in 10.1.47 that meant DELETE requests received via the AJP connector were processed as OPTIONS requests and PROPFIND requests were processed as TRACE. (markt) + Fix: Various OCSP processing issues in the OpenSSL FFM code. (dsoumis)
 * General + Add: Add test.silent property to suppress JUnit console output during test execution. Useful for cleaner console output when running tests with multiple threads. (csutherl)
 * Jasper + Fix: 69333: Correct a regression in the previous fix for 69333 and ensure that reuse() or release() is always called for a tag. (markt) + Fix: 69877: Catch IllegalArgumentException when processing URIs when creating the classpath to handle invalid URIs. (remm) + Fix: Fix populating the classpath with the webapp classloader repositories. (remm) + Fix: 69862: Avoid NPE unwrapping Servlet exception which would hide some exception details. Patch submitted by Eric Blanquer. (remm)
 * Jdbc-pool + Fix: 64083: If the underlying connection has been closed, don't add it to the pool when it is returned. Pull request #235 by Alex Panchenko. (markt)
 * Web applications + Fix: Manager: Fix abrupt truncation of the HTML and JSON complete server status output if one or more of the web applications failed to start.
 (schultz) + Add: Manager: Include web application state in the HTML and JSON complete server status output. (markt) + Add: Documentation: Expand the documentation to better explain when OCSP is supported and when it is not. (markt)
 * Websocket + Fix: 69920: When attempting to write to a closed Writer or OutputStream obtained from a WebSocket session, throw an IOException rather than an IllegalStateExcpetion as required by Writer and strongly suggested by OutputStream. (markt) + Fix: 69845: When using permessage-deflate with Java 25 onwards, handle the underlying Inflater and/or Deflater throwing IllegalStateException when closed rather than NullPointerException as they do in Java 24 and earlier.
 * Other + Update: Update the internal fork of Commons Pool to 2.13.1. (markt) + Update: Update the internal fork of Commons DBCP to 2.14.0. (markt) + Update: Update Commons Daemon to 1.5.1. (markt) + Update: Update ByteBuddy to 1.18.3. (markt) + Update: Update UnboundID to 7.0.4. (markt) + Update: Update Checkstyle to 12.3.1. (markt) + Add: Improvements to French translations. (markt) + Add: Improvements to Japanese translations provided by tak7iji. (markt) + Add: Improvements to Chinese translations provided by Yang. vincent.h and yong hu. (markt) + Update: Update Tomcat Native to 2.0.12. (markt) + Add: Add property 'gpg.sign.files' to optionally disable release artefact signing with GPG. (rjung) + Add: Add test profile system for selective test execution. Profiles can be specified via -Dtest.profile= to run specific test subsets without using patterns directly. Profile patterns are defined in test-profiles.properties. (csutherl) + Update: Update file extension to media type mappings to align with the current list used by the Apache Web Server (httpd). (markt) + Update: Update the packaged version of the Tomcat Migration Tool for Jakarta EE to 1.0.10. (markt) + Update: Update Commons Daemon to 1.5.0. (markt) + Update: Update Byte Buddy to 1.18.2. (markt) + Update: Update Checkstyle to 12.2.0. (markt) + Add: Improvements to Spanish translations provided by White Vogel. (markt) + Add: Improvements to French translations. (remm) + Update: Update the internal fork of Apache Commons BCEL to 6.11.0. (markt) + Update: Update to Byte Buddy 1.17.8. (markt) + Update: Update to Checkstyle 12.1.1. (markt) + Update: Update to Jacoco 0.8.14. (markt) + Update: Update to SpotBugs 4.9.8. (markt) + Update: Update to JSign 7.4. (markt) + Update: Update Maven Resolver Ant Tasks to 1.6.0. (rjung)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302254

]]> <![CDATA[SUSE SLES12 Security Update : python3 (SUSE-SU-2026:0897-1)]]> https://www.tenable.com/plugins/nessus/302253 https://www.tenable.com/plugins/nessus/302253 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302253 with Medium Severity

Synopsis

The remote SUSE host is missing a security update.

Description

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:0897-1 advisory.

 - CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in BytesGenerator (bsc#1257181).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302253

]]> <![CDATA[SUSE SLES15 Security Update : glibc (SUSE-SU-2026:0896-1)]]> https://www.tenable.com/plugins/nessus/302252 https://www.tenable.com/plugins/nessus/302252 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302252 with Medium Severity

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0896-1 advisory.

 - CVE-2026-0861: memalign: reinstate alignment overflow check (bsc#1256766)
 - CVE-2026-0915: resolv: Fix NSS DNS backend for getnetbyaddr (bsc#1256822)
 - CVE-2025-15281: posix: Reset wordexp_t fields with WRDE_REUSE (bsc#1257005)
 - CVE-2025-8058: posix: Fix double-free after allocation failure in regcomp (bsc#1246965)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302252

]]> <![CDATA[SUSE SLES12 Security Update : libpng15 (SUSE-SU-2026:0898-1)]]> https://www.tenable.com/plugins/nessus/302251 https://www.tenable.com/plugins/nessus/302251 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302251 with Medium Severity

Synopsis

The remote SUSE host is missing a security update.

Description

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:0898-1 advisory.

 - CVE-2025-64505: heap buffer over-read in 'png_do_quantize' via malformed palette index (bsc#1254157).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libpng15-15 package.

Read more at https://www.tenable.com/plugins/nessus/302251

]]> <![CDATA[SUSE SLES12 Security Update : busybox (SUSE-SU-2026:0892-1)]]> https://www.tenable.com/plugins/nessus/302250 https://www.tenable.com/plugins/nessus/302250 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302250 with High Severity

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0892-1 advisory.

 - CVE-2023-42363: use-after-free vulnerability in xasprintf function in xfuncs_printf.c (bsc#1217580).
 - CVE-2023-42364: use-after-free in the awk.c evaluate function (bsc#1217584).
 - CVE-2023-42365: use-after-free in the awk.c copyvar function (bsc#1217585).
 - CVE-2025-46394: files in a TAR archive can have their filenames hidden from a listing if terminal escape sequences are used when naming other files included in the archive (bsc#1241661).
 - CVE-2025-60876: request line incorrectly neutralized mat lead to header injection (bsc#1253245).
 - CVE-2026-26157: Arbitrary file overwrite and potential code execution via incomplete path sanitization (bsc#1258163).
 - CVE-2026-26158: Arbitrary file modification and privilege escalation via unvalidated tar archive entries (bsc#1258167).
 - CVE-2021-42380: Additional fix for use-after-realloc in awk (bsc#1192869).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected busybox package.

Read more at https://www.tenable.com/plugins/nessus/302250

]]> <![CDATA[Fedora 43 : SDL2_sound (2026-6ea6f0a56b)]]> https://www.tenable.com/plugins/nessus/302249 https://www.tenable.com/plugins/nessus/302249 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302249 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6ea6f0a56b advisory.

 Latest upstream snapshot from `stable-2.0` branch. Fixes CVE-2025-14369 in bundled `dr_flac`.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected SDL2_sound package.

Read more at https://www.tenable.com/plugins/nessus/302249

]]> <![CDATA[Fedora 42 : freerdp (2026-53fe996a57)]]> https://www.tenable.com/plugins/nessus/302248 https://www.tenable.com/plugins/nessus/302248 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302248 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-53fe996a57 advisory.

 Update to 3.23.0 to fix CVE-2026-26965, CVE-2026-26955, CVE-2026-26271, CVE-2026-25997, CVE-2026-25959, CVE-2026-25955, CVE-2026-25954, CVE-2026-25953, CVE-2026-25952, CVE-2026-25942, CVE-2026-25941



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected 2:freerdp package.

Read more at https://www.tenable.com/plugins/nessus/302248

]]> <![CDATA[Fedora 42 : SDL2_sound (2026-bfa5bd0004)]]> https://www.tenable.com/plugins/nessus/302247 https://www.tenable.com/plugins/nessus/302247 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302247 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-bfa5bd0004 advisory.

 Latest upstream snapshot from `stable-2.0` branch. Fixes CVE-2025-14369 in bundled `dr_flac`.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected SDL2_sound package.

Read more at https://www.tenable.com/plugins/nessus/302247

]]> <![CDATA[Fedora 43 : chromium (2026-0dc0c88f83)]]> https://www.tenable.com/plugins/nessus/302246 https://www.tenable.com/plugins/nessus/302246 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302246 with Critical Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0dc0c88f83 advisory.

 Update to 146.0.7680.71

 * CVE-2026-3913: Heap buffer overflow in WebML
 * CVE-2026-3914: Integer overflow in WebML
 * CVE-2026-3915: Heap buffer overflow in WebML
 * CVE-2026-3916: Out of bounds read in Web Speech
 * CVE-2026-3917: Use after free in Agents
 * CVE-2026-3918: Use after free in WebMCP
 * CVE-2026-3919: Use after free in Extensions
 * CVE-2026-3920: Out of bounds memory access in WebML
 * CVE-2026-3921: Use after free in TextEncoding
 * CVE-2026-3922: Use after free in MediaStream
 * CVE-2026-3923: Use after free in WebMIDI
 * CVE-2026-3924: Use after free in WindowDialog
 * CVE-2026-3925: Incorrect security UI in LookalikeChecks
 * CVE-2026-3926: Out of bounds read in V8
 * CVE-2026-3927: Incorrect security UI in PictureInPicture
 * CVE-2026-3928: Insufficient policy enforcement in Extensions
 * CVE-2026-3929: Side-channel information leakage in ResourceTiming
 * CVE-2026-3930: Unsafe navigation in Navigation
 * CVE-2026-3931: Heap buffer overflow in Skia
 * CVE-2026-3932: Insufficient policy enforcement in PDF
 * CVE-2026-3934: Insufficient policy enforcement in ChromeDriver
 * CVE-2026-3935: Incorrect security UI in WebAppInstalls
 * CVE-2026-3936: Use after free in WebView
 * CVE-2026-3937: Incorrect security UI in Downloads
 * CVE-2026-3938: Insufficient policy enforcement in Clipboard
 * CVE-2026-3939: Insufficient policy enforcement in PDF
 * CVE-2026-3940: Insufficient policy enforcement in DevTools
 * CVE-2026-3941: Insufficient policy enforcement in DevTools
 * CVE-2026-3942: Incorrect security UI in PictureInPicture


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected chromium package.

Read more at https://www.tenable.com/plugins/nessus/302246

]]> <![CDATA[Fedora 43 : SDL3_sound (2026-243f5046dc)]]> https://www.tenable.com/plugins/nessus/302245 https://www.tenable.com/plugins/nessus/302245 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302245 with Medium Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-243f5046dc advisory.

 Latest snapshot from 3.0 branch. Fixes CVE-2025-14369.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected SDL3_sound package.

Read more at https://www.tenable.com/plugins/nessus/302245

]]> <![CDATA[Fedora 44 : gst-devtools / gst-editing-services / gstreamer1 / gstreamer1-doc / etc (2026-9cfb46ac78)]]> https://www.tenable.com/plugins/nessus/302244 https://www.tenable.com/plugins/nessus/302244 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302244 with High Severity

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-9cfb46ac78 advisory.

 1.28.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Read more at https://www.tenable.com/plugins/nessus/302244

]]> <![CDATA[Oracle Linux 8 : dtrace (ELSA-2026-50151)]]> https://www.tenable.com/plugins/nessus/302243 https://www.tenable.com/plugins/nessus/302243 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302243 with Critical Severity

Synopsis

The remote Oracle Linux host is missing a security update.

Description

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-50151 advisory.

 [2.0.6-1]
 - Fix dtprobed unsafe probe description handling (CVE-2026-21991).
 [Orabug: 39054018]

 Credit Statement:
 The following people or organizations reported security vulnerabilities addressed by this ELSA to Oracle:
 Dhiraj Mishra: CVE-2026-21991

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected dtrace, dtrace-devel and / or dtrace-testsuite packages.

Read more at https://www.tenable.com/plugins/nessus/302243

]]> <![CDATA[Google Chrome < 146.0.7680.80 Vulnerability]]> https://www.tenable.com/plugins/nessus/302242 https://www.tenable.com/plugins/nessus/302242 Sat, 14 Mar 2026 00:00:00 GMT Nessus Plugin ID 302242 with High Severity

Synopsis

A web browser installed on the remote macOS host is affected by a vulnerability.

Description

The version of Google Chrome installed on the remote macOS host is prior to 146.0.7680.80. It is, therefore, affected by a vulnerability as referenced in the 2026_03_stable-channel-update-for-desktop_13 advisory.

 - Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) (CVE-2026-3909)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Google Chrome version 146.0.7680.80 or later.

Read more at https://www.tenable.com/plugins/nessus/302242

]]>