The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.

The remote NewStart CGSL host, running version MAIN 6.06, has glibc packages installed that are affected by multiple vulnerabilities:

  - The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It     may use the notification thread attributes object (passed through its struct sigevent parameter) after it     has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified     other impact. (CVE-2021-33574)

  - elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH     containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain     privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and     decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the     ./ directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very     uncommon; most likely, no such program is shipped with any common Linux distribution. (CVE-2017-16997)

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to     cause a denial of service (out-of-bounds read and crash) via 64 bytes of input. (CVE-2016-6261)

  - The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent     attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.
    (CVE-2016-6263)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when     processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in     degraded service or Denial of Service on the local system. This is related to netgroupcache.c.
    (CVE-2021-27645)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has glibc packages installed that are affected by multiple vulnerabilities:

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance     the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a     different vulnerability from CVE-2016-10228. (CVE-2020-27618)

  - The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when     processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in     degraded service or Denial of Service on the local system. This is related to netgroupcache.c.
    (CVE-2021-27645)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2021-3326)

  - The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It     may use the notification thread attributes object (passed through its struct sigevent parameter) after it     has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified     other impact. (CVE-2021-33574)

  - A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory     corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and     size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and     escalate their privileges on the system. (CVE-2021-3999)

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3152 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3152-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Helmut Grohne     October 17, 2022                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : glibc     Version        : 2.28-10+deb10u2     CVE ID         : CVE-2016-10228 CVE-2019-19126 CVE-2019-25013                      CVE-2020-1752 CVE-2020-6096 CVE-2020-10029                      CVE-2020-27618 CVE-2021-3326 CVE-2021-3999                      CVE-2021-27645 CVE-2021-33574 CVE-2021-35942                      CVE-2022-23218 CVE-2022-23219     Debian Bug     : 856503 945250 953108 953788 961452 973914 979273 981198                      983479 989147 990542

    This update fixes a wide range of vulnerabilities. A significant portion     affects character set conversion.

    CVE-2016-10228

        The iconv program in the GNU C Library when invoked with multiple         suffixes in the destination encoding (TRANSLATE or IGNORE) along with         the -c option, enters an infinite loop when processing invalid         multi-byte input sequences, leading to a denial of service.

    CVE-2019-19126

        On the x86-64 architecture, the GNU C Library fails to ignore the         LD_PREFER_MAP_32BIT_EXEC environment variable during program         execution after a security transition, allowing local attackers to         restrict the possible mapping addresses for loaded libraries and         thus bypass ASLR for a setuid program.

    CVE-2019-25013

        The iconv feature in the GNU C Library, when processing invalid         multi-byte input sequences in the EUC-KR encoding, may have a buffer         over-read.

    CVE-2020-10029

        The GNU C Library could overflow an on-stack buffer during range         reduction if an input to an 80-bit long double function contains a         non-canonical bit pattern, a seen when passing a         0x5d414141414141410000 value to sinl on x86 targets. This is related         to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.

    CVE-2020-1752

        A use-after-free vulnerability introduced in glibc was found in the         way the tilde expansion was carried out. Directory paths containing         an initial tilde followed by a valid username were affected by this         issue. A local attacker could exploit this flaw by creating a         specially crafted path that, when processed by the glob function,         would potentially lead to arbitrary code execution.

    CVE-2020-27618

        The iconv function in the GNU C Library, when processing invalid         multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390,         and IBM1399 encodings, fails to advance the input state, which could         lead to an infinite loop in applications, resulting in a denial of         service, a different vulnerability from CVE-2016-10228.

    CVE-2020-6096

        An exploitable signed comparison vulnerability exists in the ARMv7         memcpy() implementation of GNU glibc. Calling memcpy() (on ARMv7         targets that utilize the GNU glibc implementation) with a negative         value for the 'num' parameter results in a signed comparison         vulnerability. If an attacker underflows the 'num' parameter to         memcpy(), this vulnerability could lead to undefined behavior such as         writing to out-of-bounds memory and potentially remote code         execution.  Furthermore, this memcpy() implementation allows for         program execution to continue in scenarios where a segmentation fault         or crash should have occurred. The dangers occur in that subsequent         execution and iterations of this code will be executed with this         corrupted data.

    CVE-2021-27645

        The nameserver caching daemon (nscd) in the GNU C Library, when         processing a request for netgroup lookup, may crash due to a         double-free, potentially resulting in degraded service or Denial of         Service on the local system. This is related to netgroupcache.c.

    CVE-2021-3326

        The iconv function in the GNU C Library, when processing invalid         input sequences in the ISO-2022-JP-3 encoding, fails an assertion in         the code path and aborts the program, potentially resulting in a         denial of service.

    CVE-2021-33574

        The mq_notify function in the GNU C Library has a use-after-free. It         may use the notification thread attributes object (passed through         its struct sigevent parameter) after it has been freed by the caller,         leading to a denial of service (application crash) or possibly         unspecified other impact.

    CVE-2021-35942

        The wordexp function in the GNU C Library may crash or read arbitrary         memory in parse_param (in posix/wordexp.c) when called with an         untrusted, crafted pattern, potentially resulting in a denial of         service or disclosure of information. This occurs because atoi was         used but strtoul should have been used to ensure correct calculations.

    CVE-2021-3999

        An off-by-one buffer overflow and underflow in getcwd() may lead to         memory corruption when the size of the buffer is exactly 1. A local         attacker who can control the input buffer and size passed to getcwd()         in a setuid program could use this flaw to potentially execute         arbitrary code and escalate their privileges on the system.

    CVE-2022-23218

        The deprecated compatibility function svcunix_create in the sunrpc         module of the GNU C Library copies its path argument on the stack         without validating its length, which may result in a buffer overflow,         potentially resulting in a denial of service or (if an application         is not built with a stack protector enabled) arbitrary code execution.

    CVE-2022-23219

        The deprecated compatibility function clnt_create in the sunrpc module         of the GNU C Library copies its hostname argument on the stack without         validating its length, which may result in a buffer overflow,         potentially resulting in a denial of service or (if an application is         not built with a stack protector enabled) arbitrary code execution.


    For Debian 10 buster, these problems have been fixed in version     2.28-10+deb10u2.

    We recommend that you upgrade your glibc packages.

    For the detailed security status of glibc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/glibc

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when     processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in     degraded service or Denial of Service on the local system. This is related to netgroupcache.c.
    (CVE-2021-27645)

  - A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory     corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and     size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and     escalate their privileges on the system. (CVE-2021-3999)

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when     processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in     degraded service or Denial of Service on the local system. This is related to netgroupcache.c.
    (CVE-2021-27645)

  - ** DISPUTED ** In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can     force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an     internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states     'the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which     ought to require a separate application bug to do so unintentionally. Hence there's no security impact to     the bug.' (CVE-2021-43396)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when     processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in     degraded service or Denial of Service on the local system. This is related to netgroupcache.c.
    (CVE-2021-27645)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its hostname argument on the stack without validating its length, which may result in     a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23219)

  - A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory     corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and     size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and     escalate their privileges on the system. (CVE-2021-3999)

  - The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when     processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in     degraded service or Denial of Service on the local system. This is related to netgroupcache.c.
    (CVE-2021-27645)

  - The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc)     through 2.34 copies its path argument on the stack without validating its length, which may result in a     buffer overflow, potentially resulting in a denial of service or (if an application is not built with a     stack protector enabled) arbitrary code execution. (CVE-2022-23218)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5310-1 advisory.

    Jan Engelhardt, Tavis Ormandy, and others discovered that the GNU C Library iconv feature incorrectly     handled certain input sequences. An attacker could possibly use this issue to cause the GNU C Library to     hang or crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu     20.04 LTS. (CVE-2016-10228, CVE-2019-25013, CVE-2020-27618, CVE-2020-29562, CVE-2021-3326)

    Jason Royes and Samuel Dytrych discovered that the GNU C Library incorrectly handled signed comparisons on     ARMv7 targets. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in a     denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and     Ubuntu 20.04 LTS. (CVE-2020-6096)

    It was discovered that the GNU C Library nscd daemon incorrectly handled certain netgroup lookups. An     attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of     service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-27645)

    It was discovered that the GNU C Library wordexp function incorrectly handled certain patterns. An     attacker could use this issue to cause the GNU C Library to crash, resulting in a denial of service, or     possibly obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
    (CVE-2021-35942)

    It was discovered that the GNU C Library realpath function incorrectly handled return values. An attacker     could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 21.10.
    (CVE-2021-3998)

    It was discovered that the GNU C library getcwd function incorrectly handled buffers. An attacker could     use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2021-3999)

    It was discovered that the GNU C Library sunrpc module incorrectly handled buffer lengths. An attacker     could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service.
    (CVE-2022-23218, CVE-2022-23219)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:4358 advisory.

  - The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in     parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in     a denial of service or disclosure of information. This occurs because atoi was used but strtoul should     have been used to ensure correct calculations. (CVE-2021-35942)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4358 advisory.

  - The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when     processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in     degraded service or Denial of Service on the local system. This is related to netgroupcache.c.
    (CVE-2021-27645)

  - The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It     may use the notification thread attributes object (passed through its struct sigevent parameter) after it     has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified     other impact. (CVE-2021-33574)

  - The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in     parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in     a denial of service or disclosure of information. This occurs because atoi was used but strtoul should     have been used to ensure correct calculations. (CVE-2021-35942)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202107-07 (glibc: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in glibc. Please review       the CVE identifiers referenced below for details.
  Impact :

    An attacker could cause a possible Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9560 advisory.

    - CVE-2021-33574: Deep copy pthread attribute in mq_notify (#1966472)
    - CVE-2021-35942: wordexp: handle overflow in positional parameter number       (#1979127)
    - CVE-2021-27645: nscd: Fix double free in netgroupcache (#1927877)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4358 advisory.

    - CVE-2021-33574: Deep copy pthread attribute in mq_notify (#1966472)
    - CVE-2021-35942: wordexp: handle overflow in positional parameter number       (#1979127)
    - CVE-2021-27645: nscd: Fix double free in netgroupcache (#1927877)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4358 advisory.

  - glibc: Use-after-free in addgetnetgrentX function in netgroupcache.c (CVE-2021-27645)

  - glibc: mq_notify does not handle separately allocated thread attributes (CVE-2021-33574)

  - glibc: Arbitrary read in wordexp() (CVE-2021-35942)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4358 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: Arbitrary read in wordexp() (CVE-2021-35942)

    * glibc: Use-after-free in addgetnetgrentX function in netgroupcache.c (CVE-2021-27645)

    * glibc: mq_notify does not handle separately allocated thread attributes (CVE-2021-33574)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
266254	NewStart CGSL MAIN 6.06 : glibc Multiple Vulnerabilities (NS-SA-2025-0229)	Nessus	NewStart CGSL Local Security Checks	critical
502935	Siemens SIMATIC S7-1500 TM MFP BIOS Double Free (CVE-2021-27645)	Tenable OT Security	Tenable.ot	low
175224	EulerOS Virtualization 3.0.2.0 : glibc (EulerOS-SA-2023-1693)	Nessus	Huawei Local Security Checks	low
167455	NewStart CGSL MAIN 6.02 : glibc Multiple Vulnerabilities (NS-SA-2022-0085)	Nessus	NewStart CGSL Local Security Checks	critical
166426	Debian dla-3152 : glibc-doc - security update	Nessus	Debian Local Security Checks	critical
165975	EulerOS Virtualization 3.0.6.0 : glibc (EulerOS-SA-2022-2560)	Nessus	Huawei Local Security Checks	critical
165873	EulerOS Virtualization 3.0.6.6 : glibc (EulerOS-SA-2022-2501)	Nessus	Huawei Local Security Checks	high
162370	EulerOS 2.0 SP5 : glibc (EulerOS-SA-2022-1889)	Nessus	Huawei Local Security Checks	low
161532	EulerOS 2.0 SP3 : glibc (EulerOS-SA-2022-1724)	Nessus	Huawei Local Security Checks	low
160141	EulerOS 2.0 SP8 : glibc (EulerOS-SA-2022-1565)	Nessus	Huawei Local Security Checks	critical
158502	Ubuntu 18.04 LTS / 20.04 LTS : GNU C Library vulnerabilities (USN-5310-1)	Nessus	Ubuntu Local Security Checks	critical
157813	Rocky Linux 8 : glibc (RLSA-2021:4358)	Nessus	Rocky Linux Local Security Checks	critical
157656	AlmaLinux 8 : glibc (ALSA-2021:4358)	Nessus	Alma Linux Local Security Checks	critical
157005	GLSA-202107-07 : glibc: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
155674	Oracle Linux 8 : glibc (ELSA-2021-9560)	Nessus	Oracle Linux Local Security Checks	critical
155417	Oracle Linux 8 : glibc (ELSA-2021-4358)	Nessus	Oracle Linux Local Security Checks	critical
155175	CentOS 8 : glibc (CESA-2021:4358)	Nessus	CentOS Local Security Checks	critical
155059	RHEL 8 : glibc (RHSA-2021:4358)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2021-27645

low

Tenable Plugins

critical

low

low

critical

critical

critical

high

low

low

critical

critical

critical

critical

critical

critical

critical

critical

critical