slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-SUSE-RU-2025:4131-1 advisory.

    Changes for suse-migration-sle16-activation:

    - Simplify interface naming by disabling predictable names at boot
    - shellcheck heavily complained
    - check migration target before testing for architecture version
    - Create systemd.link files for virtual VMware/Hyper-V NICs
    - Add changes for newest wicked2nm
    - Activation packages can no longer be noarch
    - Architecture check before allowing migration to be activated
    - Add missing pre snapshot setup to run_migration
    - Add wicked2nm network migration
    - Setup ExclusiveArch for activation packages
    - Make activation package require by provides tag
    - Fix product related requirement settings

    Changes for SLES16-Migration:

    - Added .ssh directory for migration user
    - Add etc/motd overlay file       Print message how to show migration progress information
    - Fix build on more architectures
    - Initial changelog

    Changes for SLES16-SAP_Migration:

    - Support wicked2nm migration
    - Migration live image for SLES4SAP 15 to 16

    Changes for suse-migration-services:

    - Set systemd offline for Zypper in chroot mode
    - Fix apparmor install procedure
    - Fixed azuremetadata device lookup
    - Use of f-strings not allowed in the DMS
    - Simplify interface naming by disabling predictable names at boot
    - Fixed test_check_lsm_migration unit test
    - Fix setup_host_network_test by mocking os.makedirs
    - wicked2nm: log network state on nm-online failure
    - Fixed LSM pre checks to be more robust
    - shellcheck heavily complained
    - Do not evaluate wicked2nm output in precheck
    - Fix unit test for lsm check
    - prechecks/lsm.py: remove _apparmor_analyze_profiles()
    - LSM migration check for AppArmor -> SELinux
    - Improve pre-check message
    - Fix MinSLEVersion value depending on target
    - reduce package set on migration image
    - Fixed behavior of wicked2m pre check
    - implementation of sshd root login pre-check
    - Fixed selinux to apparmor migration
    - Fixed reading of migration config for target class
    - Add recursion guard to MigrationConfig::_merge_config_dicts
    - shrink migration image
    - container/sle16/config.sh
    - sle16/config.sh - use dropin for s390 migration-config
    - doc: fix indentation
    - check for migration target by matching ISO file name
    - config: introduce dropin dir migration-config.d/
    - Apply SLE16 live image setup to container setup
    - bind mount only required subdirectories under /run into chroot
    - Add missing package requirement
    - check migration target before testing for architecture version
    - setup_host_network: simplify code - use os.makedirs()
    - Create systemd.link files for virtual VMware/Hyper-V NIC
    - Preserve systemd.link files from /etc/systemd/network/
    - Add changes for the newest wicked2nm
    - Ensure wicked2nm is a dependency of pre-checks for SLE 16 migration
    - Activation packages can no longer be noarch
    - Fix update of image .changes files
    - Architecture check before allowing migration to be activated
    - Improve error logs when wicked2nm fails
    - Include image changelog to version bump
    - Ensure wicked2nm migration is always running, despite warnings
    - Fix: add --no-recommends on patterns-base-selinux installation
    - Update suse-migration-services for container use
    - Update SLE16 migration container
    - Update SAP live migration image
    - Add missing pre snapshot setup to run_migration
    - Follow up fix for the wicked to nm migration
    - Add wicked2nm network migration
    - Add glob support to preserve_files
    - Setup ExclusiveArch for activation packages
    - Build sles4sap migration for cloud on x86_64 only
    - Do not build sles4sap migration on s390x
    - Use systemctl kexec
    - Fix: return the correct kernel path based on machine type
    - Fixed glob pattern match for package name
    - Remove menitoning of SLES 12-SP4
    - Make activation package require by provides tag
    - Added SLES16-SAP_Migration live image
    - Do not use list[str] type hint
    - Fix error evaluation from offline_migrations API
    - Fix logging from non unit files
    - Fix product related requirement settings
    - Repos for migration image must be in kiwi
    - Added .ssh to migration user for SAP 15 live image
    - Added SLES15-SAP_Migration Makefile target
    - Add proper release package for SLE16 migration
    - Fix typo in service name
    - Drop obsolete check for resolv.conf
    - Fix migration user home dir setup for SLE16
    - Update README_QA.rst
    - test: split unit test for setup_name_resolver
    - Install patterns-base-selinux for Apparmor migration
    - Ensure the rebuild counter is not stripped from the rpm
    - Exit silently if no migration iso is found
    - Ensure rpmlintrc file is part of suse-migration-services SRPM
    - Ignore fixup! entries when generating changelog
    - Increase python test matrix
    - Remove redundanct requires on itself
    - Fix ordering of pre-checks and actual migration
    - Add SLES15-Migration target to Makefile
    - Fix suse-migration-console-log service
    - Fix typo in REA- Activate only connections if present in the current system
    - Improve error output, exit codes and add flag to disable user hints
    - Add support for autoip-fallback
    - Issue only a info when dhcp.update is non default
    - Add ipv4_static broadcast
    - Apply dhcp settings to mirror wicked client id
    - Fix test.sh, fail if migration succeed but expect fail
    - Fix sysctl handling
    - Avoid cloning in parsing of route
    - Fix continue migration to show all warnings beforehand
    - Improve warning messages - show interface, element names
    - Remove unwrap in route parsing
    - bump slab from 0.4.10 to 0.4.11 to address CVE-2025-55159 (bsc#1248010)
    - Fix netconfig handling with proper priority setting
    - Add ovs support
    - Use agama-network instead of agama-(lib|server)
    - Only activate connections marked with autostart
    - Give hint in error message how to ignore warnings
    - Update README.md with updated installation and usage infos
    - Add support for Leap 15
    - Remove BuildRequires that are no longer necessary due to the agama-network switch.
    - The agama-network switch also removes the vulnerable and       unmaintained 'users' crate from the dependencies. (bsc#1244188)DME_QA
    - Fix: split name resolver setup into its own service
    - Fix: set path according to current arch in grub.d/99_migration
    - Add support to enable single rpm transaction for upgrade
    - enable suse-migration-ha.service in the migration image
    - Migration for high availability extension
    - RPM wrapper fixes
    - Cleanup secfile to follow python singlespec policy
    - Support product specifier in ISO name
    - Ensure sle16 images can build on all supported platforms
    - Use name pattern compatible to suse-migration-rpm
    - Fix SLE15 migration images
    - SAP product should migrate to 15 SP4
    - Add SLES15-SAP-Migration
    - Bump target to SLE15 SP7
    - Update bumpversion config       Include sle16 container build to version bump
    - Handle selinux boot option when using kexec
    - Ensure migration to SLES16 uses selinux, not apparmor
    - improve os-release parsing
    - Ensure SLES16 is also detected in SCC precheck
    - Add high availablity extension check
    - Fix package names for python packages on SLE16
    - Relax on the shim-install call
    - Fixup package name for SLE16 and SLE16 container
    - Fix changelog references for activation packages
    - Add product migration check

    Changes for suse-migration-rpm:

    - Fix MinSLEVersion value depending on target
    - Add product requirement according to image name.
    - Exit silently if no migration iso is found.
    - Add build and perl(Date::Parse) to ensure we can append changelog entries to generated package.

    Changes for wicked2nm:

    - Activate only connections if present in the current system
    - Improve error output, exit codes and add flag to disable user hints
    - Add support for autoip-fallback
    - Issue only a info when dhcp.update is non default
    - Add ipv4_static broadcast
    - Apply dhcp settings to mirror wicked client id
    - Fix test.sh, fail if migration succeed but expect fail
    - Fix sysctl handling
    - Avoid cloning in parsing of route
    - Fix continue migration to show all warnings beforehand
    - Improve warning messages - show interface, element names
    - Remove unwrap in route parsing
    - bump slab from 0.4.10 to 0.4.11 to address CVE-2025-55159 (bsc#1248010)
    - Fix netconfig handling with proper priority setting
    - Add ovs support
    - Use agama-network instead of agama-(lib|server)
    - Only activate connections marked with autostart
    - Give hint in error message how to ignore warnings
    - Update README.md with updated installation and usage infos
    - Add support for Leap 15
    - Remove BuildRequires that are no longer necessary due to the agama-network switch.
    - The agama-network switch also removes the vulnerable and       unmaintained 'users' crate from the dependencies. (bsc#1244188)

    Chages for image-janitor:
    - Fix packaging (add doc, license)
    - Release 0.2.0 with configuration files packaged
    - Initial packag

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:3944-1 advisory.

    - CVE-2025-55159 - updated slab with the uninit memory access fix (bsc#1248003)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3954-1 advisory.

    Update to version 2.3.3 (bsc#1240044).

    Security issues fixed:

    - CVE-2025-55159: slab: incorrect bounds check in `get_disjoint_mut` function can lead to potential crash     due to out-of-bounds access (bsc#1248055).
    - CVE-2020-35881: traitobject: log4rs: out-of-bounds write due to fat pointer layout assumptions     (bsc#1249851).

    Other issues fixed:

    - Build and install efs-proxy binary (bsc#1240044).

    - Fixed in version 2.3.3:
      * Add environment variable support for AWS profiles and regions
      * Regenerate Cargo.lock with rust 1.70.0
      * Update circle-ci config
      * Fix AWS Env Variable Test and Code Style Issue
      * Remove CentOS 8 and Ubuntu 16.04 from verified Linux distribution list

    - Fixed in version 2.3.2:
      * Update version in amazon-efs-utils.spec to 2.3.1
      * Fix incorrect package version

    - Fixed in version 2.3.1:
      * Fix backtrace version to resolve ubuntu and rhel build issues
      * Pin Cargo.lock to avoid unexpected error across images

    - Fixed in version 2.3.0:
      * Add support for pod-identity credentials in the credentials chain
      * Enable mounting with IPv6 when using with the 'stunnel' mount option

    - Fixed in version 2.2.1:
      * Update log4rs

    - Fixed in version 2.2.0
      * Use region-specific domain suffixes for dns endpoints where missing
      * Merge PR #211 - Amend Debian control to use binary architecture

    - Fixed in version 2.1.0
      * Add mount option for specifying region
      * Add new ISO regions to config file

    - Fixed in version 2.0.4
      * Add retry logic to and increase timeout for EC2 metadata token         retrieval requests

    - Fixed in version 2.0.3:
      * Upgrade py version
      * Replace deprecated usage of datetime

    - Fixed in version 2.0.2
      * Check for efs-proxy PIDs when cleaning tunnel state files
      * Add PID to log entries

    - Fxied in  version 2.0.1
      * Disable Nagle's algorithm for efs-proxy TLS mounts to improve latencies

    - Fixed in version 2.0.0:
      * Replace stunnel, which provides TLS encryptions for mounts, with efs-proxy, a component built in-house     at AWS.
        Efs-proxy lays the foundation for upcoming feature launches at EFS.

    - Fixed in version 1.36.0:
      * Support new mount option: crossaccount, conduct cross account mounts via ip address. Use client AZ-ID     to choose         mount target.

    - Fixed in version 1.35.2:
      * Revert 'Add warning if using older Version'
      * Support MacOS Sonoma

    - Fixed in version 1.35.1:
      * Revert openssl requirement change
      * Revert 'Update EFS Documentation: Clarify Current FIPS Compliance Status'
      * Update EFS Documentation: Clarify Current FIPS Compliance Status
      * test: Change repo urls in eol debian9 build
      * Check private key file size to skip generation
      * test: Fix pytest that failed since commit 3dd89ca
      * Fix should_check_efs_utils_version scope
      * Add warning if using old version
      * Add 'fsap' option as EFS-only option

    - Fixed in version 1.35.0:
      * Add parameters to allow mount fo pod impersonation feature in EFS CSI Driver
      * Updated the README with support of Oracle8 distribution
      * Readme troubleshooting section + table of contents
      * Add efs-utils Support for MacOS Ventura EC2 instances

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method     incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to     uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in     slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might     be beyond the slab's actual length. (CVE-2025-55159)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-92719fd556 advisory.

    Update to version 0.4.11.

    This version includes a fix for CVE-2025-55159, but there are zero packages in Fedora or EPEL that use the     affected API, so no rebuilds are necessary.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-1e9ad724f8 advisory.

    Update to version 0.4.11.

    This version includes a fix for CVE-2025-55159, but there are zero packages in Fedora or EPEL that use the     affected API, so no rebuilds are necessary.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
275759	SUSE SLED15 / SLES15 : Recommended update for suse-migration-sle16-activation, SLES16-Migration, SLES16-SAP_Migration, suse-migration-services, suse-migration-rpm, wicked2nm, image-janitor (SUSE-SU-SUSE-RU-2025:4131-1)	Nessus	SuSE Local Security Checks	medium
274450	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : sccache (SUSE-SU-2025:3944-1)	Nessus	SuSE Local Security Checks	medium
274420	SUSE SLES15 / openSUSE 15 Security Update : aws-efs-utils (SUSE-SU-2025:3954-1)	Nessus	SuSE Local Security Checks	medium
259918	Linux Distros Unpatched Vulnerability : CVE-2025-55159	Nessus	Misc.	medium
254420	Fedora 41 : rust-slab (2025-92719fd556)	Nessus	Fedora Local Security Checks	medium
254418	Fedora 42 : rust-slab (2025-1e9ad724f8)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2025-55159

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium