The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2025_11066 advisory.

    * glibc: Vector register overwrite bug in glibc (CVE-2025-5702)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 10 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2025_11066 advisory.

    * glibc: Vector register overwrite bug in glibc (CVE-2025-5702)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2025_9877 advisory.

    * glibc: Vector register overwrite bug in glibc (CVE-2025-5702)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10618:11 advisory.

    * glibc: Vector register overwrite bug in glibc (CVE-2025-5702)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 11.0. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-11.0 advisory.

  - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and     xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated     against an XML schema with certain identity constraints, or a crafted XML schema must be used.
    (CVE-2024-56171)

  - ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings     in tinfo/read_entry.c in the terminfo library. (CVE-2022-29458)

  - xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result     prefixes. (CVE-2024-55549)

  - numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath     context node can be modified but never restored. This is related to xsltNumberFormatGetValue,     xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. (CVE-2025-24855)

  - Allows modifying some file metadata (e.g. last modified) with filter=data or file permissions (chmod)     with filter=tar of files outside the extraction directory. You are affected by this vulnerability if     using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract()     using the filter= parameter with a value of data or tar. See the tarfile extraction filters     documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more     information. Only Python versions 3.12 or later are affected by these vulnerabilities, earlier versions     don't include the extraction filter feature. Note that for Python 3.14 or later the default value of     filter= changed from no filtering to `data, so if you are relying on this new default behavior then     your usage is also affected. Note that none of these vulnerabilities significantly affect the installation     of source distributions which are tar archives as source distributions already allow arbitrary code     execution during the build process. However when evaluating source distributions it's important to avoid     installing source distributions with suspicious links. (CVE-2024-12718)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:11066 advisory.

    * glibc: Vector register overwrite bug in glibc (CVE-2025-5702)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:11066 advisory.

    * glibc: Vector register overwrite bug in glibc (CVE-2025-5702)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7634-1 advisory.

    It was discovered that the GNU C Library incorrectly handled the strcmp implementation optimized for     Power10 processors. This could cause applications to crash, compute wrong results, or leak confidential     information. (CVE-2025-5702)

    It was discovered that the GNU C Library incorrectly handled the strncmp implementation optimized for     Power10 processors. This could cause applications to crash, compute wrong results, or leak confidential     information. This issue only affected Ubuntu 25.04. (CVE-2025-5745)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-11066 advisory.

    - CVE-2025-5702: Vector register overwrite bug in glibc (RHEL-95485)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:11066 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: Vector register overwrite bug in glibc (CVE-2025-5702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20411 advisory.

    [2.34-168.0.1.20]
    - Forward-port Oracle patches for ol9-u6       Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       Oracle history:
      June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.19
      - Forward-port Oracle patches for ol9-u6         Reviewed-by: David Faust <david.faust@oracle.com>       May-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1.14
      - Forward-port Oracle patches for ol9-u6         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-6-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-168.0.1
      - Forward-port Oracle patches for ol9-u6         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       February-18-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-160.0.1
      - Forward-port Oracle patches for ol9-u6 DP         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       November-12-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-125.0.1.1
      - Forward-port Oracle patches for ol9-u5         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-1-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.4
      - Forward-port Oracle patches for ol9-u4         Reviewed by: David Faust <david.faust@oracle.com>       August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.34-100.0.1.3
      - Forward-port Oracle patches for ol9-u4         Reviewed by: David Faust <david.faust@oracle.com>       May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1.2
      - Forward-port Oracle patches for ol9-u4         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-30-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1
      - Forward-port Oracle patches for ol9-u4         Reviewed by: Indu Bhagat <indu.bhagat@oracle.com>       March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-100.0.1
      - Forward-port Oracle patches for ol9-u4-beta         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       March 15 2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.12
      - Forward-port Oracle patches for ol9         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       February-26-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.2.7
      - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-24-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-83.0.1.7
      - Forward-port Oracle patches for ol9         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-82.0.1
      - Forward-port Oracle patches for ol9         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-18-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.2
      - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks
      - Created tunable glibc.pthread.stack_hugetlb to control when hugepages         can be used for stack allocation.
      - In case THP are enabled and glibc.pthread.stack_hugetlb is set to         0, glibc will madvise the kernel not to use allow hugepages for stack         allocations.
        Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-60.0.1
      - Merge Oracle patches for ol9-u2 beta         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-40.0.1
      - Merge Oracle patches for ol9-u1 beta         Reviewed by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-25-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.34-28.0.1
      - Merge Oracle patches with ol9 beta
      - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>

    [2.34-168.20]
    - CVE-2025-5702 glibc: Vector register overwrite bug in glibc (RHEL-95547)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-9877 advisory.

    [2.34-168.0.1.20]
    - Forward-port Oracle patches for ol9-u6       Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       Oracle history:

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:9877 advisory.

    * glibc: Vector register overwrite bug in glibc (CVE-2025-5702)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:9877 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard     math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    Security Fix(es):

    * glibc: Vector register overwrite bug in glibc (CVE-2025-5702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e489437b3d advisory.

    This update contains the following bug fixes and enhancements:
    * String function register clobbers specific to POWER10 machines (CVE-2025-5702, CVE-2025-5745).
    * Crashes in TLS management when auditors are used (rhbz#2330213)
    * Optimizations for x86-64 CPUs
    * Optimizations for AArch64 CPUs



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-851644b160 advisory.

    This update addresses two string function vulnerabilities specific to POWER10 machines (CVE-2025-5702,     CVE-2025-5745) and fixes a bug in TLS management when auditors are used (rhbz#2330213).


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
363398	Rocky Linux 10.0 [CIQ] Security Update: glibc / glibc-all-langpacks / glibc-benchtests / etc (crlsa-2025_11066)	Nessus	Rocky Linux Local Security Checks	Local	medium
359270	Rocky Linux 10 [CIQ] Security Update: glibc / glibc-all-langpacks / glibc-benchtests / etc (crlsa-2025_11066)	Nessus	Rocky Linux Local Security Checks	Local	medium
356238	Rocky Linux 9 [CIQ] Security Update: glibc / glibc-all-langpacks / glibc-benchtests / etc (crlsa-2025_9877)	Nessus	Rocky Linux Local Security Checks	Local	medium
282764	MiracleLinux 9 : glibc-2.34-168.el9_6.20 (AXSA:2025-10618:11)	Nessus	Miracle Linux Local Security Checks	Local	medium
278723	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0)	Nessus	Misc.	Local	high
269882	AlmaLinux 10 : glibc (ALSA-2025:11066)	Nessus	Alma Linux Local Security Checks	Local	medium
266502	RockyLinux 10 : glibc (RLSA-2025:11066)	Nessus	Rocky Linux Local Security Checks	Local	medium
242200	Ubuntu 24.04 LTS / 25.04 : GNU C Library vulnerabilities (USN-7634-1)	Nessus	Ubuntu Local Security Checks	Local	medium
242176	Oracle Linux 10 : glibc (ELSA-2025-11066)	Nessus	Oracle Linux Local Security Checks	Local	medium
242114	RHEL 10 : glibc (RHSA-2025:11066)	Nessus	Red Hat Local Security Checks	Local	medium
241519	Oracle Linux 9 : glibc (ELSA-2025-20411)	Nessus	Oracle Linux Local Security Checks	Local	medium
241050	Oracle Linux 9 : glibc (ELSA-2025-9877)	Nessus	Oracle Linux Local Security Checks	Local	medium
240940	AlmaLinux 9 : glibc (ALSA-2025:9877)	Nessus	Alma Linux Local Security Checks	Local	medium
240921	RHEL 9 : glibc (RHSA-2025:9877)	Nessus	Red Hat Local Security Checks	Local	medium
240529	Fedora 41 : glibc (2025-e489437b3d)	Nessus	Fedora Local Security Checks	Local	medium
240346	Fedora 42 : glibc (2025-851644b160)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2025-5702

medium

Tenable Plugins

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium