The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.

The remote Ubuntu 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7634-1 advisory.

    It was discovered that the GNU C Library incorrectly handled the strcmp implementation optimized for     Power10 processors. This could cause applications to crash, compute wrong results, or leak confidential     information. (CVE-2025-5702)

    It was discovered that the GNU C Library incorrectly handled the strncmp implementation optimized for     Power10 processors. This could cause applications to crash, compute wrong results, or leak confidential     information. This issue only affected Ubuntu 25.04. (CVE-2025-5745)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-11066 advisory.

    - CVE-2025-5702: Vector register overwrite bug in glibc (RHEL-95485)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:11066 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: Vector register overwrite bug in glibc (CVE-2025-5702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20411 advisory.

    [2.34-168.0.1.20]
    - Forward-port Oracle patches for ol9-u6       Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       Oracle history:
      June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19
      - Forward-port Oracle patches for ol9-u6         Reviewed-by: David Faust <david.faust@oracle.com>       May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14
      - Forward-port Oracle patches for ol9-u6         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1
      - Forward-port Oracle patches for ol9-u6         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1
      - Forward-port Oracle patches for ol9-u6 DP         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1
      - Forward-port Oracle patches for ol9-u5         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4
      - Forward-port Oracle patches for ol9-u4         Reviewed by: David Faust <david.faust@oracle.com>       August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3
      - Forward-port Oracle patches for ol9-u4         Reviewed by: David Faust <david.faust@oracle.com>       May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2
      - Forward-port Oracle patches for ol9-u4         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1
      - Forward-port Oracle patches for ol9-u4         Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>       March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1
      - Forward-port Oracle patches for ol9-u4-beta         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12
      - Forward-port Oracle patches for ol9         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7
      - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7
      - Forward-port Oracle patches for ol9         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1
      - Forward-port Oracle patches for ol9         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2
      - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks
      - Created tunable glibc.pthread.stack_hugetlb to control when hugepages         can be used for stack allocation.
      - In case THP are enabled and glibc.pthread.stack_hugetlb is set to         0, glibc will madvise the kernel not to use allow hugepages for stack         allocations.
        Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1
      - Merge Oracle patches for ol9-u2 beta         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1
      - Merge Oracle patches for ol9-u1 beta         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1
      - Merge Oracle patches with ol9 beta
      - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

    [2.34-168.20]
    - CVE-2025-5702 glibc: Vector register overwrite bug in glibc (RHEL-95547)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-9877 advisory.

    [2.34-168.0.1.20]
    - Forward-port Oracle patches for ol9-u6       Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       Oracle history:

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:9877 advisory.

    * glibc: Vector register overwrite bug in glibc (CVE-2025-5702)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9877 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: Vector register overwrite bug in glibc (CVE-2025-5702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e489437b3d advisory.

    This update contains the following bug fixes and enhancements:
    * String function register clobbers specific to POWER10 machines (CVE-2025-5702, CVE-2025-5745).
    * Crashes in TLS management when auditors are used (rhbz#2330213)
    * Optimizations for x86-64 CPUs
    * Optimizations for AArch64 CPUs



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-851644b160 advisory.

    This update addresses two string function vulnerabilities specific to POWER10 machines (CVE-2025-5702,     CVE-2025-5745) and fixes a bug in TLS management when auditors are used (rhbz#2330213).


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
242200	Ubuntu 24.04 LTS / 25.04 : GNU C Library vulnerabilities (USN-7634-1)	Nessus	Ubuntu Local Security Checks	medium
242176	Oracle Linux 10 : glibc (ELSA-2025-11066)	Nessus	Oracle Linux Local Security Checks	medium
242114	RHEL 10 : glibc (RHSA-2025:11066)	Nessus	Red Hat Local Security Checks	medium
241519	Oracle Linux 9 : glibc (ELSA-2025-20411)	Nessus	Oracle Linux Local Security Checks	medium
241050	Oracle Linux 9 : glibc (ELSA-2025-9877)	Nessus	Oracle Linux Local Security Checks	medium
240940	AlmaLinux 9 : glibc (ALSA-2025:9877)	Nessus	Alma Linux Local Security Checks	medium
240921	RHEL 9 : glibc (RHSA-2025:9877)	Nessus	Red Hat Local Security Checks	medium
240529	Fedora 41 : glibc (2025-e489437b3d)	Nessus	Fedora Local Security Checks	medium
240346	Fedora 42 : glibc (2025-851644b160)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2025-5702

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium