png_create_info_struct in png.c in libpng 1.6.36 has a memory leak, as demonstrated by pngcp. NOTE: a third party has stated "I don't think it is libpng's job to free this buffer.

According to the version of the libpng package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A memory leak was found in the pngcp.c utility of     libpng. The pngcp utility fails to free the png_info     structure allocated by png_create_info_struct before     exiting.(CVE-2019-6129)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libpng packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - ** DISPUTED ** png_create_info_struct in png.c in     libpng 1.6.36 has a memory leak, as demonstrated by     pngcp. NOTE: a third party has stated 'I don't think it     is libpng's job to free this buffer.'(CVE-2019-6129)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update 231, 8 Update 221, 11 Update 4, or 12 Update 2. It is, therefore, affected by multiple vulnerabilities:

  - Unspecified vulnerabilities in the utilities and JCE     subcomponents of Oracle Java SE, which could allow an     unauthenticated remote attacker to cause a partial denial     of service. (CVE-2019-2762, CVE-2019-2769, CVE-2019-2842)

  - An unspecified vulnerability in the security subcomponent     of Oracle Java SE, which could allow an unauthenticated     local attacker to gain unauthorized access to critical Java     SE data. (CVE-2019-2745)

  - Unspecified vulnerabilities in the networking and security     subcomponents of Oracle Java SE, which could allow an     unauthenticated remote attacker to gain unauthorized     access to Java SE data. Exploitation of this vulnerability     requires user interaction.     (CVE-2019-2766, CVE-2019-2786, CVE-2019-2818)

  - An unspecified vulnerability in the networking subcomponent     of Oracle Java SE, which could allow an unauthenticated     remote attacker unauthorized read, update, insert or     delete access to Java SE data. (CVE-2019-2816)

  - An unspecified vulnerability in the JSSE subcomponent of     Oracle Java SE, which could allow an unauthenticated,     remote attacker to gain unauthorized access to critical     Java SE data. Exploitation of this vulnerability requires     user interaction. (CVE-2019-2821)

  - A use after free vulnerability exists in the libpng     subcomponent of Oracle Java SE. An unauthenticated,     remote attacker can exploit this to cause a complete     denial of service condition in Java SE. Exploitation     of this vulnerability requires user interaction.
    (CVE-2019-7317)

Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
135121	EulerOS Virtualization for ARM 64 3.0.6.0 : libpng (EulerOS-SA-2020-1334)	Nessus	Huawei Local Security Checks	medium
133996	EulerOS 2.0 SP8 : libpng (EulerOS-SA-2020-1162)	Nessus	Huawei Local Security Checks	medium
126821	Oracle Java SE 1.7.0_231 / 1.8.0_221 / 1.11.0_4 / 1.12.0_2 Multiple Vulnerabilities (Jul 2019 CPU)	Nessus	Windows	medium
126820	Oracle Java SE 1.7.0_231 / 1.8.0_221 / 1.11.0_4 / 1.12.0_2 Multiple Vulnerabilities (Jul 2019 CPU) (Unix)	Nessus	Misc.	medium

Detections

Analytics

CVE-2019-6129

medium

Tenable Plugins

medium

medium

medium

medium