The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5673 advisory.

    -----BEGIN PGP SIGNED MESSAGE-----     Hash: SHA512

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5673-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     April 23, 2024                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : glibc     CVE ID         : CVE-2024-2961     Debian Bug     : 1069191

    Charles Fol discovered that the iconv() function in the GNU C library is     prone to a buffer overflow vulnerability when converting strings to the     ISO-2022-CN-EXT character set, which may lead to denial of service     (application crash) or the execution of arbitrary code.

    For the oldstable distribution (bullseye), this problem has been fixed     in version 2.31-13+deb11u9.

    For the stable distribution (bookworm), this problem has been fixed in     version 2.36-9+deb12u6.

    We recommend that you upgrade your glibc packages.

    For the detailed security status of glibc please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/glibc

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmYnXlRfFIAAAAAALgAo     aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2     NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND     z0QQVQ//SFTCEazXKFiaeBQD+lGr4ROP2/rSm0WE682g+Xz7HVLJkLtNyLd7Y4SA     MVNQDlKntGM//MMQiIUsTGxc4Hq/HgMYVvhXZTlmwRaayTUlJ5jY704vrzMbyaTo     iK+88z8SrPwGlHvzzzpNx4/pN8uQYNIK7oLrvCv5ng50Lnh1jBxBTXuEgZQtMq7m     Wlo8B+nAaZQKpxHJK+ilNx9kT0g6au4FD+KXzyISBwz4KBEqb10fToHYzl/Wf209     boG9CAbn/rgTM0/wvXb3kDPc3k6yDk+6NI9NVqXSHzkpvbtBJxNi/crnR1Mu7KAh     MGqKC9pq6t8zL9v6YV9lGuL/dFBOg+bihsZ3dVyX0B6PDqvmRyZ5lDGZKiiS2jWT     RxWoEnM9JdzADd6bbJTICNbFgKNIzmcSxPgfS6/wRp0R679wrq+jhxhAhSNN1ozh     dQciRKiLfguTTI4HTRH42frSdXRFue4W48s7LS+Fy0oAaxUza5QNrsFgP9tPBFKl     t9ehi3sXqzWTD+Tl51np1dc3yOW9xq0btlUejy0W1L6q6POKIkRrNllVczWJixOA     UwuWY4u6zrcX1wgDRSmUsG8k4seHoH7EpfTIaaQ4qgPGalG+9r6ZrMApUS0eOVzd     ure7Qo7w6w/UGRxCsuU7pToZlkiHwOlimd7lAGqNMJwofDKbc8k=     =8z2B
    -----END PGP SIGNATURE-----

    Reply to:
    debian-security-announce@lists.debian.org     Salvatore Bonaccorso (on-list)     Salvatore Bonaccorso (off-list)

    Prev by Date:
    [SECURITY] [DSA 5672-1] openjdk-17 security update

    Next by Date:
    [SECURITY] [DSA 5674-1] pdns-recursor security update

    Previous by thread:
    [SECURITY] [DSA 5672-1] openjdk-17 security update

    Next by thread:
    [SECURITY] [DSA 5674-1] pdns-recursor security update

    Index(es):

    Date     Thread

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dsa-5673 : glibc-doc - security update

high Nessus Plugin ID 193726

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.6 Oct 6, 2025, 9:07 AM Exploit attributes ("Exploit framework core" set to "True") Plugin Feed: 202510060907
Version 1.5 Jan 24, 2025, 11:52 PM Plugin metadata CVSSv2 severity (based on None, severity decreased from "High" to "Low") CVSS metrics ("Cvssv4 score" set to 0.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C") CVSS metrics ("CVSSv2 score" set to 9.0) Plugin Feed: 202501242352
Version 1.4 Oct 21, 2024, 9:27 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploit framework metasploit" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202410210927
Version 1.3 Jul 4, 2024, 8:15 AM CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H") CVSS metrics ("CVSSv3 score" set to 7.3) Plugin Feed: 202407040815
Version 1.2 Apr 28, 2024, 2:25 PM Plugin metadata Detection (updated detection logic) Plugin Feed: 202404281425
Version 1.1 Apr 27, 2024, 4:43 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202404270443
Version 1.0 Apr 23, 2024, 5:11 PM New Plugin Feed: 202404231711