A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4084 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4084-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Andreas Henriksson     March 11, 2025                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libmodbus     Version        : 3.1.6-2+deb11u1     CVE ID         : CVE-2022-0367 CVE-2024-10918                      CVE-2024-36843 CVE-2024-36844 CVE-2024-36845     Debian Bug     : 1074422

    Two separate issues where identified and have now been adressed in libmodbus.
    For one of the problems multiple CVE identifiers have been allocated to the     same issue and all of them are mentioned below.

    CVE-2022-0367

        A heap-based buffer overflow flaw was found in libmodbus in function         modbus_reply() in src/modbus.c.

    CVE-2024-10918

        Stack-based Buffer Overflow vulnerability in libmodbus v3.1.10 allows to         overflow the buffer allocated for the Modbus response if the function tries         to reply to a Modbus request with an unexpected length.

    CVE-2024-36843

        This is a duplicate of CVE-2022-0367

    CVE-2024-36844

        This is a duplicate of CVE-2022-0367

    CVE-2024-36845

        This is a duplicate of CVE-2022-0367

    For Debian 11 bullseye, these problems have been fixed in version     3.1.6-2+deb11u1.

    We recommend that you upgrade your libmodbus packages.

    For the detailed security status of libmodbus please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libmodbus

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.
    (CVE-2022-0367)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.
    (CVE-2022-0367)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:10196-1 advisory.

  - A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.
    (CVE-2022-0367)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3098 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3098-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     September 04, 2022                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libmodbus     Version        : 3.1.4-2+deb10u2     CVE ID         : CVE-2022-0367

    A heap-based buffer overflow flaw was found in libmodbus, a library for the     Modbus protocol, which can be abused for a denial of service attack or     memory corruption.

    For Debian 10 buster, this problem has been fixed in version     3.1.4-2+deb10u2.

    We recommend that you upgrade your libmodbus packages.

    For the detailed security status of libmodbus please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libmodbus

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
232625	Debian dla-4084 : libmodbus-dev - security update	Nessus	Debian Local Security Checks	high
229630	Linux Distros Unpatched Vulnerability : CVE-2022-0367	Nessus	Misc.	high
405230	Alpine: multiple libmodbus packages: security update to 3.1.8-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405230	Alpine: multiple libmodbus packages: security update to 3.1.8-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
167328	openSUSE 15 Security Update : libmodbus (openSUSE-SU-2022:10196-1)	Nessus	SuSE Local Security Checks	high
164684	Debian dla-3098 : libmodbus-dev - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2022-0367

high

Tenable Plugins

high

high

high

high

high

high