Debian dla-4533 : libnss-myhostname - security update

medium Nessus Plugin ID 307620

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4533 advisory.

- ------------------------------------------------------------------------- Debian LTS Advisory DLA-4533-1 [email protected] https://www.debian.org/lts/security/ Arnaud Rebillout April 15, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : systemd Version : 247.3-7+deb11u8 CVE ID : CVE-2026-4105 CVE-2026-29111 CVE-2026-40225 CVE-2026-40226 Debian Bug :

The following vulnerabilities have been discovered systemd:

CVE-2026-4105

The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.

CVE-2026-29111

When an unprivileged IPC API call is made with spurious data, a stack overwrite occurs, with the attacker controlled content.

CVE-2026-40225

udev: local root execution can occur via malicious hardware devices and unsanitized kernel output.

CVE-2026-40226

nspawn: an escape-to-host action can occur via a crafted optional config file.

For Debian 11 bullseye, these problems have been fixed in version 247.3-7+deb11u8.

We recommend that you upgrade your systemd packages.

For the detailed security status of systemd please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/systemd

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the libnss-myhostname packages.

Plugin Details

Severity: Medium

ID: 307620

File Name: debian_DLA-4533.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Debian Local Security Checks

Published: 4/20/2026

Updated: 4/20/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.4

CVSS v2

Risk Factor: Medium

Base Score: 6

Temporal Score: 4.4

Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-4105

CVSS v3

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5.6

Vector: CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-40226

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:libudev1-udeb, p-cpe:/a:debian:debian_linux:libnss-mymachines, p-cpe:/a:debian:debian_linux:systemd-container, p-cpe:/a:debian:debian_linux:libsystemd-dev, p-cpe:/a:debian:debian_linux:systemd, cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:libpam-systemd, p-cpe:/a:debian:debian_linux:systemd-coredump, p-cpe:/a:debian:debian_linux:libnss-myhostname, p-cpe:/a:debian:debian_linux:libsystemd0, p-cpe:/a:debian:debian_linux:udev-udeb, p-cpe:/a:debian:debian_linux:systemd-sysv, p-cpe:/a:debian:debian_linux:libudev1, p-cpe:/a:debian:debian_linux:systemd-tests, p-cpe:/a:debian:debian_linux:libudev-dev, p-cpe:/a:debian:debian_linux:libnss-systemd, p-cpe:/a:debian:debian_linux:systemd-journal-remote, p-cpe:/a:debian:debian_linux:udev, p-cpe:/a:debian:debian_linux:systemd-timesyncd, p-cpe:/a:debian:debian_linux:libnss-resolve

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 4/15/2026

Vulnerability Publication Date: 3/13/2026

Reference Information

CVE: CVE-2026-29111, CVE-2026-40225, CVE-2026-40226, CVE-2026-4105

Detections

Analytics