LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata() function via a crafted pdflatex.fmt file (or perhaps a crafted .o file) to llvm-lto. NOTE: this is disputed because the relationship between pdflatex.fmt and any LLVM language front end is not explained, and because a crash of the llvm-lto application should be categorized as a usability problem.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0170 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-46049:
    LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata() function via a crafted pdflatex.fmt     file (or perhaps a crafted .o file) to llvm-lto. NOTE: this is disputed because the relationship between     pdflatex.fmt and any LLVM language front end is not explained, and because a crash of the llvm-lto     application should be categorized as a usability problem.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the llvm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata() function via a crafted pdflatex.fmt     file (or perhaps a crafted .o file) to llvm-lto. NOTE: this is disputed because the relationship between     pdflatex.fmt and any LLVM language front end is not explained, and because a crash of the llvm-lto     application should be categorized as a usability problem.(CVE-2023-46049)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization llvm security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the llvm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    LLVM 15.0.0 has a NULL pointer dereference in the parseOneMetadata() function via a crafted pdflatex.fmt     file (or perhaps a crafted .o file) to llvm-lto. NOTE: this is disputed because the relationship between     pdflatex.fmt and any LLVM language front end is not explained, and because a crash of the llvm-lto     application should be categorized as a usability problem.(CVE-2023-46049)

Tenable has extracted the preceding description block directly from the EulerOS llvm security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
239163	TencentOS Server 4: llvm (TSSA-2024:0170)	Nessus	Tencent Local Security Checks	medium
205981	EulerOS Virtualization 2.11.0 : llvm (EulerOS-SA-2024-2195)	Nessus	Huawei Local Security Checks	medium
205929	EulerOS 2.0 SP12 : llvm (EulerOS-SA-2024-2219)	Nessus	Huawei Local Security Checks	medium
205924	EulerOS 2.0 SP12 : llvm (EulerOS-SA-2024-2243)	Nessus	Huawei Local Security Checks	medium
202429	EulerOS 2.0 SP10 : llvm (EulerOS-SA-2024-1914)	Nessus	Huawei Local Security Checks	medium
202407	EulerOS 2.0 SP10 : llvm (EulerOS-SA-2024-1890)	Nessus	Huawei Local Security Checks	medium
200958	EulerOS 2.0 SP11 : llvm (EulerOS-SA-2024-1839)	Nessus	Huawei Local Security Checks	medium
200955	EulerOS 2.0 SP11 : llvm (EulerOS-SA-2024-1818)	Nessus	Huawei Local Security Checks	medium

Detections

Analytics

CVE-2023-46049

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium