The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0547 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-5648:
    A vulnerability was found in Radare2 5.9.9. It has been classified as problematic. Affected is the     function r_cons_pal_init in the library /libr/cons/pal.c of the component radiff2. The manipulation of the     argument -T leads to memory corruption. An attack has to be approached locally. The complexity of an     attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the     public and may be used. The real existence of this vulnerability is still doubted at the moment. The name     of the patch is 5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to apply a patch to fix this     issue. The documentation explains that the parameter -T is experimental and crashy. Further analysis has     shown the race is not a real problem unless you use asan. A new warning has been added.

    CVE-2025-5647:
    A vulnerability was found in Radare2 5.9.9 and classified as problematic. This issue affects the function     r_cons_context_break_pop in the library /libr/cons/cons.c of the component radiff2. The manipulation of     the argument -T leads to memory corruption. The attack needs to be approached locally. The complexity of     an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the     public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch     is named 5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to apply a patch to fix this issue.
    The documentation explains that the parameter -T is experimental and crashy. Further analysis has shown     the race is not a real problem unless you use asan. A new warning has been added.

    CVE-2025-5646:
    A vulnerability has been found in Radare2 5.9.9 and classified as problematic. This vulnerability affects     the function r_cons_rainbow_free in the library /libr/cons/pal.c of the component radiff2. The     manipulation of the argument -T leads to memory corruption. It is possible to launch the attack on the     local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The     exploit has been disclosed to the public and may be used. The real existence of this vulnerability is     still doubted at the moment. The patch is identified as 5705d99cc1f23f36f9a84aab26d1724010b97798. It is     recommended to apply a patch to fix this issue. The documentation explains that the parameter -T is     experimental and crashy. Further analysis has shown the race is not a real problem unless you use     asan. A new warning has been added.

    CVE-2025-5645:
    A vulnerability, which was classified as problematic, was found in Radare2 5.9.9. This affects the     function r_cons_pal_init in the library /libr/cons/pal.c of the component radiff2. The manipulation of the     argument -T leads to memory corruption. Attacking locally is a requirement. The complexity of an attack is     rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and     may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of     the patch is 5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to apply a patch to fix this     issue. The documentation explains that the parameter -T is experimental and crashy. Further analysis has     shown the race is not a real problem unless you use asan. A new warning has been added.

    CVE-2025-5644:
    A vulnerability, which was classified as problematic, has been found in Radare2 5.9.9. Affected by this     issue is the function r_cons_flush in the library /libr/cons/cons.c of the component radiff2. The     manipulation of the argument -T leads to use after free. Local access is required to approach this attack.
    The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has     been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at     the moment. The name of the patch is 5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to apply     a patch to fix this issue. The documentation explains that the parameter -T is experimental and crashy.
    Further analysis has shown the race is not a real problem unless you use asan. A new warning has been     added.

    CVE-2025-5643:
    A vulnerability classified as problematic was found in Radare2 5.9.9. Affected by this vulnerability is     the function cons_stack_load in the library /libr/cons/cons.c of the component radiff2. The manipulation     of the argument -T leads to memory corruption. An attack has to be approached locally. The complexity of     an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the     public and may be used. The real existence of this vulnerability is still doubted at the moment. The patch     is named 5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to apply a patch to fix this issue.
    The documentation explains that the parameter -T is experimental and crashy. Further analysis has shown     the race is not a real problem unless you use asan. A new warning has been added.

    CVE-2025-5642:
    A vulnerability classified as problematic has been found in Radare2 5.9.9. Affected is the function     r_cons_pal_init in the library /libr/cons/pal.c of the component radiff2. The manipulation leads to memory     corruption. The attack needs to be approached locally. The complexity of an attack is rather high. The     exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The     real existence of this vulnerability is still doubted at the moment. The patch is identified as     5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to apply a patch to fix this issue. The     documentation explains that the parameter -T is experimental and crashy. Further analysis has shown the     race is not a real problem unless you use asan. A new warning has been added.

    CVE-2025-5641:
    A vulnerability was found in Radare2 5.9.9. It has been rated as problematic. This issue affects the     function r_cons_is_breaked in the library /libr/cons/cons.c of the component radiff2. The manipulation of     the argument -T leads to memory corruption. It is possible to launch the attack on the local host. The     complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been     disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the     moment. The identifier of the patch is 5705d99cc1f23f36f9a84aab26d1724010b97798. It is recommended to     apply a patch to fix this issue. The documentation explains that the parameter -T is experimental and     crashy. Further analysis has shown the race is not a real problem unless you use asan. An additional     warning regarding threading support has been added.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

TencentOS Server 4: radare2 (TSSA-2025:0547)

low Nessus Plugin ID 275939

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Mar 11, 2026, 10:59 PM CVSSv2 score source (changed from "CVE-2025-5648" to "CVE-2025-5647") CVSSv3 score source (changed from "CVE-2025-5647" to none) Plugin Feed: 202603112259
Version 1.2 Dec 5, 2025, 5:34 AM Detection (updated detection logic) Plugin Feed: 202512050534
Version 1.1 Nov 21, 2025, 2:12 PM New Plugin Feed: 202511211412